# SOME DESCRIPTIVE TITLE
# Copyright (C) YEAR The FreeBSD Project
# This file is distributed under the same license as the FreeBSD Documentation package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: FreeBSD Documentation VERSION\n"
"POT-Creation-Date: 2025-05-01 19:56-0300\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"

#. type: Title =
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:19
#, no-wrap
msgid "The TrustedBSD MAC Framework"
msgstr ""

#. type: YAML Front Matter: title
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1
#, no-wrap
msgid "Chapter 6. The TrustedBSD MAC Framework"
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:57
#, no-wrap
msgid "MAC Documentation Copyright"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:60
msgid ""
"This documentation was developed for the FreeBSD Project by Chris Costello "
"at Safeport Network Services and Network Associates Laboratories, the "
"Security Research Division of Network Associates, Inc. under DARPA/SPAWAR "
"contract N66001-01-C-8035 (\"CBOSS\"), as part of the DARPA CHATS research "
"program."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:62
msgid ""
"Redistribution and use in source (SGML DocBook) and 'compiled' forms (SGML, "
"HTML, PDF, PostScript, RTF and so forth) with or without modification, are "
"permitted provided that the following conditions are met:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:64
msgid ""
"Redistributions of source code (SGML DocBook) must retain the above "
"copyright notice, this list of conditions and the following disclaimer as "
"the first lines of this file unmodified."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:65
msgid ""
"Redistributions in compiled form (transformed to other DTDs, converted to "
"PDF, PostScript, RTF and other formats) must reproduce the above copyright "
"notice, this list of conditions and the following disclaimer in the "
"documentation and/or other materials provided with the distribution."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:70
msgid ""
"THIS DOCUMENTATION IS PROVIDED BY THE NETWORKS ASSOCIATES TECHNOLOGY, INC "
"\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED "
"TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR "
"PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NETWORKS ASSOCIATES TECHNOLOGY, "
"INC BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR "
"CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF "
"SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS "
"INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN "
"CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) "
"ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, EVEN IF ADVISED OF "
"THE POSSIBILITY OF SUCH DAMAGE."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:73
#, no-wrap
msgid "Synopsis"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:78
msgid ""
"FreeBSD includes experimental support for several mandatory access control "
"policies, as well as a framework for kernel security extensibility, the "
"TrustedBSD MAC Framework.  The MAC Framework is a pluggable access control "
"framework, permitting new security policies to be easily linked into the "
"kernel, loaded at boot, or loaded dynamically at run-time.  The framework "
"provides a variety of features to make it easier to implement new security "
"policies, including the ability to easily tag security labels (such as "
"confidentiality information) onto system objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:80
msgid ""
"This chapter introduces the MAC policy framework and provides documentation "
"for a sample MAC policy module."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:82
#, no-wrap
msgid "Introduction"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:88
msgid ""
"The TrustedBSD MAC framework provides a mechanism to allow the compile-time "
"or run-time extension of the kernel access control model.  New system "
"policies may be implemented as kernel modules and linked to the kernel; if "
"multiple policy modules are present, their results will be composed.  The "
"MAC Framework provides a variety of access control infrastructure services "
"to assist policy writers, including support for transient and persistent "
"policy-agnostic object security labels.  This support is currently "
"considered experimental."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:90
msgid ""
"This chapter provides information appropriate for developers of policy "
"modules, as well as potential consumers of MAC-enabled environments, to "
"learn about how the MAC Framework supports access control extension of the "
"kernel."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:92
#, no-wrap
msgid "Policy Background"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:99
msgid ""
"Mandatory Access Control (MAC), refers to a set of access control policies "
"that are mandatorily enforced on users by the operating system.  MAC "
"policies may be contrasted with Discretionary Access Control (DAC) "
"protections, by which non-administrative users may (at their discretion) "
"protect objects.  In traditional UNIX systems, DAC protections include file "
"permissions and access control lists; MAC protections include process "
"controls preventing inter-user debugging and firewalls.  A variety of MAC "
"policies have been formulated by operating system designers and security "
"researches, including the Multi-Level Security (MLS) confidentiality policy, "
"the Biba integrity policy, Role-Based Access Control (RBAC), Domain and Type "
"Enforcement (DTE), and Type Enforcement (TE).  Each model bases decisions on "
"a variety of factors, including user identity, role, and security clearance, "
"as well as security labels on objects representing concepts such as data "
"sensitivity and integrity."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:102
msgid ""
"The TrustedBSD MAC Framework is capable of supporting policy modules that "
"implement all of these policies, as well as a broad class of system "
"hardening policies, which may use existing security attributes, such as user "
"and group IDs, as well as extended attributes on files, and other system "
"properties.  In addition, despite the name, the MAC Framework can also be "
"used to implement purely discretionary policies, as policy modules are given "
"substantial flexibility in how they authorize protections."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:104
#, no-wrap
msgid "MAC Framework Kernel Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:108
msgid ""
"The TrustedBSD MAC Framework permits kernel modules to extend the operating "
"system security policy, as well as providing infrastructure functionality "
"required by many access control modules.  If multiple policies are "
"simultaneously loaded, the MAC Framework will usefully (for some definition "
"of useful) compose the results of the policies."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:110
#, no-wrap
msgid "Kernel Elements"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:113
msgid "The MAC Framework contains a number of kernel elements:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:115
msgid "Framework management interfaces"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:116
msgid "Concurrency and synchronization primitives."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:117
msgid "Policy registration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:118
msgid "Extensible security label for kernel objects"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:119
msgid "Policy entry point composition operators"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:120
msgid "Label management primitives"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:121
msgid "Entry point API invoked by kernel services"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:122
msgid "Entry point API to policy modules"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:123
msgid ""
"Entry points implementations (policy life cycle, object life cycle/label "
"management, access control checks)."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:124
msgid "Policy-agnostic label-management system calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:125
msgid "`mac_syscall()` multiplex system call"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:126
msgid "Various security policies implemented as MAC policy modules"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:128
#, no-wrap
msgid "Framework Management Interfaces"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:131
msgid ""
"The TrustedBSD MAC Framework may be directly managed using sysctl's, loader "
"tunables, and system calls."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:136
msgid ""
"In most cases, sysctl's and loader tunables of the same name modify the same "
"parameters, and control behavior such as enforcement of protections relating "
"to various kernel subsystems.  In addition, if MAC debugging support is "
"compiled into the kernel, several counters will be maintained tracking label "
"allocation.  It is generally advisable that per-subsystem enforcement "
"controls not be used to control policy behavior in production environments, "
"as they broadly impact the operation of all active policies.  Instead, per-"
"policy controls should be preferred, as they provide greater granularity and "
"greater operational consistency for policy modules."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:138
msgid ""
"Loading and unloading of policy modules is performed using the system module "
"management system calls and other system interfaces, including boot loader "
"variables; policy modules will have the opportunity to influence load and "
"unload events, including preventing undesired unloading of the policy."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:140
#, no-wrap
msgid "Policy List Concurrency and Synchronization"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:147
msgid ""
"As the set of active policies may change at run-time, and the invocation of "
"entry points is non-atomic, synchronization is required to prevent loading "
"or unloading of policies while an entry point invocation is in progress, "
"freezing the set of active policies for the duration.  This is accomplished "
"by means of a framework busy count: whenever an entry point is entered, the "
"busy count is incremented; whenever it is exited, the busy count is "
"decremented.  While the busy count is elevated, policy list changes are not "
"permitted, and threads attempting to modify the policy list will sleep until "
"the list is not busy.  The busy count is protected by a mutex, and a "
"condition variable is used to wake up sleepers waiting on policy list "
"modifications.  One side effect of this synchronization model is that "
"recursion into the MAC Framework from within a policy module is permitted, "
"although not generally used."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:150
msgid ""
"Various optimizations are used to reduce the overhead of the busy count, "
"including avoiding the full cost of incrementing and decrementing if the "
"list is empty or contains only static entries (policies that are loaded "
"before the system starts, and cannot be unloaded).  A compile-time option is "
"also provided which prevents any change in the set of loaded policies at run-"
"time, which eliminates the mutex locking costs associated with supporting "
"dynamically loaded and unloaded policies as synchronization is no longer "
"required."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:152
msgid ""
"As the MAC Framework is not permitted to block in some entry points, a "
"normal sleep lock cannot be used; as a result, it is possible for the load "
"or unload attempt to block for a substantial period of time waiting for the "
"framework to become idle."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:154
#, no-wrap
msgid "Label Synchronization"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:161
msgid ""
"As kernel objects of interest may generally be accessed from more than one "
"thread at a time, and simultaneous entry of more than one thread into the "
"MAC Framework is permitted, security attribute storage maintained by the MAC "
"Framework is carefully synchronized.  In general, existing kernel "
"synchronization on kernel object data is used to protect MAC Framework "
"security labels on the object: for example, MAC labels on sockets are "
"protected using the existing socket mutex.  Likewise, semantics for "
"concurrent access are generally identical to those of the container objects: "
"for credentials, copy-on-write semantics are maintained for label contents "
"as with the remainder of the credential structure.  The MAC Framework "
"asserts necessary locks on objects when invoked with an object reference.  "
"Policy authors must be aware of these synchronization semantics, as they "
"will sometimes limit the types of accesses permitted on labels: for example, "
"when a read-only reference to a credential is passed to a policy via an "
"entry point, only read operations are permitted on the label state attached "
"to the credential."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:163
#, no-wrap
msgid "Policy Synchronization and Concurrency"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:169
msgid ""
"Policy modules must be written to assume that many kernel threads may "
"simultaneously enter one more policy entry points due to the parallel and "
"preemptive nature of the FreeBSD kernel.  If the policy module makes use of "
"mutable state, this may require the use of synchronization primitives within "
"the policy to prevent inconsistent views on that state resulting in "
"incorrect operation of the policy.  Policies will generally be able to make "
"use of existing FreeBSD synchronization primitives for this purpose, "
"including mutexes, sleep locks, condition variables, and counting "
"semaphores.  However, policies should be written to employ these primitives "
"carefully, respecting existing kernel lock orders, and recognizing that some "
"entry points are not permitted to sleep, limiting the use of primitives in "
"those entry points to mutexes and wakeup operations."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:172
msgid ""
"When policy modules call out to other kernel subsystems, they will generally "
"need to release any in-policy locks in order to avoid violating the kernel "
"lock order or risking lock recursion.  This will maintain policy locks as "
"leaf locks in the global lock order, helping to avoid deadlock."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:174
#, no-wrap
msgid "Policy Registration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:181
msgid ""
"The MAC Framework maintains two lists of active policies: a static list, and "
"a dynamic list.  The lists differ only with regards to their locking "
"semantics: an elevated reference count is not required to make use of the "
"static list.  When kernel modules containing MAC Framework policies are "
"loaded, the policy module will use `SYSINIT` to invoke a registration "
"function; when a policy module is unloaded, `SYSINIT` will likewise invoke a "
"de-registration function.  Registration may fail if a policy module is "
"loaded more than once, if insufficient resources are available for the "
"registration (for example, the policy might require labeling and "
"insufficient labeling state might be available), or other policy "
"prerequisites might not be met (some policies may only be loaded prior to "
"boot).  Likewise, de-registration may fail if a policy is flagged as not "
"unloadable."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:183
#, no-wrap
msgid "Entry Points"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:190
msgid ""
"Kernel services interact with the MAC Framework in two ways: they invoke a "
"series of APIs to notify the framework of relevant events, and they provide "
"a policy-agnostic label structure pointer in security-relevant objects.  The "
"label pointer is maintained by the MAC Framework via label management entry "
"points, and permits the Framework to offer a labeling service to policy "
"modules through relatively non-invasive changes to the kernel subsystem "
"maintaining the object.  For example, label pointers have been added to "
"processes, process credentials, sockets, pipes, vnodes, Mbufs, network "
"interfaces, IP reassembly queues, and a variety of other security-relevant "
"structures.  Kernel services also invoke the MAC Framework when they perform "
"important security decisions, permitting policy modules to augment those "
"decisions based on their own criteria (possibly including data stored in "
"security labels).  Most of these security critical decisions will be "
"explicit access control checks; however, some affect more general decision "
"functions such as packet matching for sockets and label transition at "
"program execution."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:192
#, no-wrap
msgid "Policy Composition"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:200
msgid ""
"When more than one policy module is loaded into the kernel at a time, the "
"results of the policy modules will be composed by the framework using a "
"composition operator.  This operator is currently hard-coded, and requires "
"that all active policies must approve a request for it to return success.  "
"As policies may return a variety of error conditions (success, access "
"denied, object does not exist, ...), a precedence operator selects the "
"resulting error from the set of errors returned by policies.  In general, "
"errors indicating that an object does not exist will be preferred to errors "
"indicating that access to an object is denied.  While it is not guaranteed "
"that the resulting composition will be useful or secure, we have found that "
"it is for many useful selections of policies.  For example, traditional "
"trusted systems often ship with two or more policies using a similar "
"composition."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:202
#, no-wrap
msgid "Labeling Support"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:208
msgid ""
"As many interesting access control extensions rely on security labels on "
"objects, the MAC Framework provides a set of policy-agnostic label "
"management system calls covering a variety of user-exposed objects.  Common "
"label types include partition identifiers, sensitivity labels, integrity "
"labels, compartments, domains, roles, and types.  By policy agnostic, we "
"mean that policy modules are able to completely define the semantics of meta-"
"data associated with an object.  Policy modules participate in the "
"internalization and externalization of string-based labels provides by user "
"applications, and can expose multiple label elements to applications if "
"desired."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:216
msgid ""
"In-memory labels are stored in slab-allocated `struct label`, which consists "
"of a fixed-length array of unions, each holding a `void *` pointer and a "
"`long`.  Policies registering for label storage will be assigned a \"slot\" "
"identifier, which may be used to dereference the label storage.  The "
"semantics of the storage are left entirely up to the policy module: modules "
"are provided with a variety of entry points associated with the kernel "
"object life cycle, including initialization, association/creation, and "
"destruction.  Using these interfaces, it is possible to implement reference "
"counting and other storage models.  Direct access to the object structure is "
"generally not required by policy modules to retrieve a label, as the MAC "
"Framework generally passes both a pointer to the object and a direct pointer "
"to the object's label into entry points.  The primary exception to this rule "
"is the process credential, which must be manually dereferenced to access the "
"credential label.  This may change in future revisions of the MAC Framework."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:223
msgid ""
"Initialization entry points frequently include a sleeping disposition flag "
"indicating whether or not an initialization is permitted to sleep; if "
"sleeping is not permitted, a failure may be returned to cancel allocation of "
"the label (and hence object).  This may occur, for example, in the network "
"stack during interrupt handling, where sleeping is not permitted, or while "
"the caller holds a mutex.  Due to the performance cost of maintaining labels "
"on in-flight network packets (Mbufs), policies must specifically declare a "
"requirement that Mbuf labels be allocated.  Dynamically loaded policies "
"making use of labels must be able to handle the case where their init "
"function has not been called on an object, as objects may already exist when "
"the policy is loaded.  The MAC Framework guarantees that uninitialized label "
"slots will hold a 0 or NULL value, which policies may use to detect "
"uninitialized values.  However, as allocation of Mbuf labels is conditional, "
"policies must also be able to handle a NULL label pointer for Mbufs if they "
"have been loaded dynamically."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:229
msgid ""
"In the case of file system labels, special support is provided for the "
"persistent storage of security labels in extended attributes.  Where "
"available, extended attribute transactions are used to permit consistent "
"compound updates of security labels on vnodes--currently this support is "
"present only in the UFS2 file system.  Policy authors may choose to "
"implement multilabel file system object labels using one (or more) extended "
"attributes.  For efficiency reasons, the vnode label (`v_label`) is a cache "
"of any on-disk label; policies are able to load values into the cache when "
"the vnode is instantiated, and update the cache as needed.  As a result, the "
"extended attribute need not be directly accessed with every access control "
"check."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:233
msgid ""
"Currently, if a labeled policy permits dynamic unloading, its state slot "
"cannot be reclaimed, which places a strict (and relatively low) bound on the "
"number of unload-reload operations for labeled policies."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:236
#, no-wrap
msgid "System Calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:239
msgid ""
"The MAC Framework implements a number of system calls: most of these calls "
"support the policy-agnostic label retrieval and manipulation APIs exposed to "
"user applications."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:245
msgid ""
"The label management calls accept a label description structure, `struct "
"mac`, which contains a series of MAC label elements.  Each element contains "
"a character string name, and character string value.  Each policy will be "
"given the chance to claim a particular element name, permitting policies to "
"expose multiple independent elements if desired.  Policy modules perform the "
"internalization and externalization between kernel labels and user-provided "
"labels via entry points, permitting a variety of semantics.  Label "
"management system calls are generally wrapped by user library functions to "
"perform memory allocation and error handling, simplifying user applications "
"that must manage labels."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:247
msgid ""
"The following MAC-related system calls are present in the FreeBSD kernel:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:249
msgid ""
"`mac_get_proc()` may be used to retrieve the label of the current process."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:250
msgid ""
"`mac_set_proc()` may be used to request a change in the label of the current "
"process."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:251
msgid ""
"`mac_get_fd()` may be used to retrieve the label of an object (file, socket, "
"pipe, ...) referenced by a file descriptor."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:252
msgid ""
"`mac_get_file()` may be used to retrieve the label of an object referenced "
"by a file system path."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:253
msgid ""
"`mac_set_fd()` may be used to request a change in the label of an object "
"(file, socket, pipe, ...) referenced by a file descriptor."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:254
msgid ""
"`mac_set_file()` may be used to request a change in the label of an object "
"referenced by a file system path."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:255
msgid ""
"`mac_syscall()` permits policy modules to create new system calls without "
"modifying the system call table; it accepts a target policy name, operation "
"number, and opaque argument for use by the policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:256
msgid ""
"`mac_get_pid()` may be used to request the label of another process by "
"process id."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:257
msgid ""
"`mac_get_link()` is identical to `mac_get_file()`, only it will not follow a "
"symbolic link if it is the final entry in the path, so may be used to "
"retrieve the label on a symlink."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:258
msgid ""
"`mac_set_link()` is identical to `mac_set_file()`, only it will not follow a "
"symbolic link if it is the final entry in a path, so may be used to "
"manipulate the label on a symlink."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:260
msgid ""
"`mac_execve()` is identical to the `execve()` system call, only it also "
"accepts a requested label to set the process label to when beginning "
"execution of a new program.  This change in label on execution is referred "
"to as a \"transition\"."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:261
msgid ""
"`mac_get_peer()`, actually implemented via a socket option, retrieves the "
"label of a remote peer on a socket, if available."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:263
msgid ""
"In addition to these system calls, the `SIOCSIGMAC` and `SIOCSIFMAC` network "
"interface ioctls permit the labels on network interfaces to be retrieved and "
"set."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:265
#, no-wrap
msgid "MAC Policy Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:270
msgid ""
"Security policies are either linked directly into the kernel, or compiled "
"into loadable kernel modules that may be loaded at boot, or dynamically "
"using the module loading system calls at runtime.  Policy modules interact "
"with the system through a set of declared entry points, providing access to "
"a stream of system events and permitting the policy to influence access "
"control decisions.  Each policy contains a number of elements:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:272
msgid "Optional configuration parameters for policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:273
msgid "Centralized implementation of the policy logic and parameters."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:274
msgid ""
"Optional implementation of policy life cycle events, such as initialization "
"and destruction."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:275
msgid ""
"Optional support for initializing, maintaining, and destroying labels on "
"selected kernel objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:276
msgid ""
"Optional support for user process inspection and modification of labels on "
"selected objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:277
msgid ""
"Implementation of selected access control entry points that are of interest "
"to the policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:278
msgid ""
"Declaration of policy identity, module entry points, and policy properties."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:280
#, no-wrap
msgid "Policy Declaration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:283
msgid ""
"Modules may be declared using the `MAC_POLICY_SET()` macro, which names the "
"policy, provides a reference to the MAC entry point vector, provides load-"
"time flags determining how the policy framework should handle the policy, "
"and optionally requests the allocation of label state by the framework."
msgstr ""

#. type: delimited block . 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:297
#, no-wrap
msgid ""
"static struct mac_policy_ops mac_policy_ops =\n"
"{\n"
"        .mpo_destroy = mac_policy_destroy,\n"
"        .mpo_init = mac_policy_init,\n"
"        .mpo_init_bpfdesc_label = mac_policy_init_bpfdesc_label,\n"
"        .mpo_init_cred_label = mac_policy_init_label,\n"
"/* ... */\n"
"        .mpo_check_vnode_setutimes = mac_policy_check_vnode_setutimes,\n"
"        .mpo_check_vnode_stat = mac_policy_check_vnode_stat,\n"
"        .mpo_check_vnode_write = mac_policy_check_vnode_write,\n"
"};\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:302
msgid ""
"The MAC policy entry point vector, `mac__policy__ops` in this example, "
"associates functions defined in the module with specific entry points.  A "
"complete listing of available entry points and their prototypes may be found "
"in the MAC entry point reference section.  Of specific interest during "
"module registration are the .mpo_destroy and .mpo_init entry points."
msgstr ""

#. type: Block title
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:302
#, no-wrap
msgid "mpo_init will be invoked once a policy is successfully registered with the module framework but prior to any other entry points becoming active."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:304
msgid ""
"This permits the policy to perform any policy-specific allocation and "
"initialization, such as initialization of any data or locks."
msgstr ""

#. type: Block title
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:304
#, no-wrap
msgid "mpo_destroy will be invoked when a policy module is unloaded to permit releasing of any allocated memory and destruction of locks."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:306
msgid ""
"Currently, these two entry points are invoked with the MAC policy list mutex "
"held to prevent any other entry points from being invoked: this will be "
"changed, but in the mean time, policies should be careful about what kernel "
"primitives they invoke so as to avoid lock ordering or sleeping problems."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:310
msgid ""
"The policy declaration's module name field exists so that the module may be "
"uniquely identified for the purposes of module dependencies.  An appropriate "
"string should be selected.  The full string name of the policy is displayed "
"to the user via the kernel log during load and unload events, and also "
"exported when providing status information to userland processes."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:312
#, no-wrap
msgid "Policy Flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:316
msgid ""
"The policy declaration flags field permits the module to provide the "
"framework with information about its capabilities at the time the module is "
"loaded.  Currently, three flags are defined:"
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:317
#, no-wrap
msgid "MPC_LOADTIME_FLAG_UNLOADOK"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:321
msgid ""
"This flag indicates that the policy module may be unloaded.  If this flag is "
"not provided, then the policy framework will reject requests to unload the "
"module.  This flag might be used by modules that allocate label state and "
"are unable to free that state at runtime."
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:322
#, no-wrap
msgid "MPC_LOADTIME_FLAG_NOTLATE"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:326
msgid ""
"This flag indicates that the policy module must be loaded and initialized "
"early in the boot process.  If the flag is specified, attempts to register "
"the module following boot will be rejected.  The flag may be used by "
"policies that require pervasive labeling of all system objects, and cannot "
"handle objects that have not been properly initialized by the policy."
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:327
#, no-wrap
msgid "MPC_LOADTIME_FLAG_LABELMBUFS"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:332
msgid ""
"This flag indicates that the policy module requires labeling of Mbufs, and "
"that memory should always be allocated for the storage of Mbuf labels.  By "
"default, the MAC Framework will not allocate label storage for Mbufs unless "
"at least one loaded policy has this flag set.  This measurably improves "
"network performance when policies do not require Mbuf labeling.  A kernel "
"option, `MAC_ALWAYS_LABEL_MBUF`, exists to force the MAC Framework to "
"allocate Mbuf label storage regardless of the setting of this flag, and may "
"be useful in some environments."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:338
msgid ""
"Policies using the `MPC_LOADTIME_FLAG_LABELMBUFS` without the "
"`MPC_LOADTIME_FLAG_NOTLATE` flag set must be able to correctly handle `NULL` "
"Mbuf label pointers passed into entry points.  This is necessary as in-"
"flight Mbufs without label storage may persist after a policy enabling Mbuf "
"labeling has been loaded.  If a policy is loaded before the network "
"subsystem is active (i.e., the policy is not being loaded late), then all "
"Mbufs are guaranteed to have label storage."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:341
#, no-wrap
msgid "Policy Entry Points"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:345
msgid ""
"Four classes of entry points are offered to policies registered with the "
"framework: entry points associated with the registration and management of "
"policies, entry points denoting initialization, creation, destruction, and "
"other life cycle events for kernel objects, events associated with access "
"control decisions that the policy module may influence, and calls associated "
"with the management of labels on objects.  In addition, a `mac_syscall()` "
"entry point is provided so that policies may extend the kernel interface "
"without registering new system calls."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:350
msgid ""
"Policy module writers should be aware of the kernel locking strategy, as "
"well as what object locks are available during which entry points.  Writers "
"should attempt to avoid deadlock scenarios by avoiding grabbing non-leaf "
"locks inside of entry points, and also follow the locking protocol for "
"object access and modification.  In particular, writers should be aware that "
"while necessary locks to access objects and their labels are generally held, "
"sufficient locks to modify an object or its label may not be present for all "
"entry points.  Locking information for arguments is documented in the MAC "
"framework entry point document."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:354
msgid ""
"Policy entry points will pass a reference to the object label along with the "
"object itself.  This permits labeled policies to be unaware of the internals "
"of the object yet still make decisions based on the label.  The exception to "
"this is the process credential, which is assumed to be understood by "
"policies as a first class security object in the kernel."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:356
#, no-wrap
msgid "MAC Policy Entry Point Reference"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:359
#, no-wrap
msgid "General-Purpose Module Entry Points"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:362
#, no-wrap
msgid "`mpo_init`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:367
#, no-wrap
msgid "void mpo_init(struct mac_policy_conf *conf);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:373
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:397
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:420
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:458
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:487
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:533
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:556
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:608
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:637
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:664
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:687
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:737
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:787
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:810
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:833
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:856
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:879
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:902
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:925
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:948
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:971
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:998
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1021
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1044
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1067
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1090
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1113
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1139
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1165
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1192
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1232
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1272
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1312
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1352
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1392
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1432
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1469
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1506
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1543
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1580
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1665
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1708
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1746
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1781
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1813
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1846
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1890
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1943
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1979
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2001
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2036
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2072
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2112
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2148
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2180
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2213
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2318
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2355
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2394
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2425
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2453
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2488
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2523
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2558
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2594
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2630
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2702
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2746
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2782
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2820
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2855
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2892
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2922
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2992
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3014
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3036
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3096
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3131
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3153
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3179
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3232
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3262
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3307
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3346
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3377
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3408
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3443
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3474
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3505
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3538
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3575
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3606
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3636
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3695
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3730
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3791
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3826
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3859
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3889
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3927
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3991
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4034
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4081
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4118
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4189
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4279
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4314
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4349
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4380
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4416
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4460
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4508
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4541
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4578
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4615
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4648
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4682
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4715
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4756
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4804
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4841
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4878
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4920
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4990
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5023
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5058
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5099
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5140
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5173
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5203
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5225
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5251
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5274
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5305
#, no-wrap
msgid "Parameter"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:374
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:398
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:421
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:459
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:488
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:511
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:534
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:557
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:580
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:609
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:638
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:665
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:688
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:711
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:738
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:765
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:788
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:811
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:834
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:857
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:880
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:903
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:926
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:949
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:972
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:999
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1022
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1045
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1068
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1091
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1114
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1140
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1166
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1193
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1233
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1273
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1313
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1353
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1393
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1433
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1470
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1507
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1544
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1581
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1709
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1747
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1782
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1814
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1847
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1891
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1944
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1980
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2002
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2037
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2073
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2113
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2149
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2181
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2214
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2249
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2319
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2356
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2395
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2426
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2454
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2489
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2524
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2559
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2595
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2631
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2667
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2703
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2747
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2783
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2821
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2856
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2893
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2923
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2961
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2993
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3015
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3037
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3097
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3132
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3154
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3180
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3206
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3233
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3263
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3285
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3308
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3347
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3378
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3409
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3444
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3475
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3506
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3539
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3576
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3607
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3637
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3667
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3696
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3731
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3765
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3792
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3827
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3860
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3890
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3928
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3961
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3992
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4035
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4082
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4119
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4153
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4190
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4237
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4280
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4315
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4350
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4381
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4417
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4461
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4542
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4616
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4649
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4683
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4716
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4757
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4805
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4842
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4879
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4921
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4961
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4991
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5024
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5059
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5100
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5141
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5174
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5204
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5226
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5252
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5275
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5306
#, no-wrap
msgid "Description"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:376
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:400
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:423
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:461
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:490
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:513
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:536
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:559
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:611
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:640
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:667
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:690
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:713
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:740
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:767
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:790
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:813
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:836
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:859
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:882
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:905
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:928
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:951
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:974
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1001
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1024
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1047
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1070
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1093
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1116
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1142
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1168
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1195
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1235
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1275
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1315
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1355
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1395
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1435
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1472
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1546
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1668
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1711
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1749
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1784
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1816
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1849
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1893
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1946
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1982
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2004
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2039
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2075
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2115
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2151
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2183
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2216
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2251
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2286
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2321
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2358
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2397
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2428
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2456
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2491
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2526
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2561
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2597
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2633
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2705
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2749
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2785
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2823
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2858
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2895
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2925
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2995
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3017
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3039
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3099
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3134
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3182
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3235
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3265
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3310
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3349
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3380
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3411
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3446
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3477
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3508
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3541
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3578
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3609
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3639
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3698
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3733
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3767
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3794
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3829
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3862
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3892
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3930
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3994
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4037
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4084
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4121
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4155
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4192
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4239
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4282
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4317
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4352
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4383
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4419
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4463
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4511
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4544
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4581
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4618
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4651
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4685
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4759
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4807
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4844
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4881
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4923
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4993
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5026
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5061
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5102
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5143
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5176
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5206
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5228
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5254
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5277
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5308
#, no-wrap
msgid "Locking"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:377
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:401
#, no-wrap
msgid "`conf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:378
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:402
#, no-wrap
msgid "MAC policy definition"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:384
msgid ""
"Policy load event.  The policy list mutex is held, so sleep operations "
"cannot be performed, and calls out to other kernel subsystems must be made "
"with caution.  If potentially sleeping memory allocations are required "
"during policy initialization, they should be made using a separate module "
"SYSINIT()."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:386
#, no-wrap
msgid "`mpo_destroy`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:391
#, no-wrap
msgid "void mpo_destroy(struct mac_policy_conf *conf);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:407
msgid ""
"Policy load event.  The policy list mutex is held, so caution should be "
"applied."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:409
#, no-wrap
msgid "`mpo_syscall`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:414
#, no-wrap
msgid "int mpo_syscall(struct thread *td, int call, void *arg);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:424
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:462
#, no-wrap
msgid "`td`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:425
#, no-wrap
msgid "Calling thread"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:428
#, no-wrap
msgid "`call`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:429
#, no-wrap
msgid "Policy-specific syscall number"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:432
#, no-wrap
msgid "`arg`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:433
#, no-wrap
msgid "Pointer to syscall arguments"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:440
msgid ""
"This entry point provides a policy-multiplexed system call so that policies "
"may provide additional services to user processes without registering "
"specific system calls.  The policy name provided during registration is used "
"to demultiplexer calls from userland, and the arguments will be forwarded to "
"this entry point.  When implementing new services, security modules should "
"be sure to invoke appropriate access control checks from the MAC framework "
"as needed.  For example, if a policy implements an augmented signal "
"functionality, it should call the necessary signal access control checks to "
"invoke the MAC framework and other registered policies."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:444
msgid ""
"Modules must currently perform the `copyin()` of the syscall data on their "
"own."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:447
#, no-wrap
msgid "`mpo_thread_userret`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:452
#, no-wrap
msgid "void mpo_thread_userret(struct thread *td);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:463
#, no-wrap
msgid "Returning thread"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:471
msgid ""
"This entry point permits policy modules to perform MAC-related events when a "
"thread returns to user space, via a system call return, trap return, or "
"otherwise.  This is required for policies that have floating process labels, "
"as it is not always possible to acquire the process lock at arbitrary points "
"in the stack during system call processing; process labels might represent "
"traditional authentication data, process history information, or other "
"data.  To employ this mechanism, intended changes to the process credential "
"label may be stored in the `p_label` protected by a per-policy spin lock, "
"and then set the per-thread `TDF_ASTPENDING` flag and per-process "
"`PS_MACPENDM` flag to schedule a call to the `userret` entry point.  From "
"this entry point, the policy may create a replacement credential with less "
"concern about the locking context.  Policy writers are cautioned that event "
"ordering relating to scheduling an AST and the AST being performed may be "
"complex and interlaced in multithreaded applications."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:473
#, no-wrap
msgid "Label Operations"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:476
#, no-wrap
msgid "`mpo_init_bpfdesc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:481
#, no-wrap
msgid "void mpo_init_bpfdesc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:491
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:514
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:537
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:560
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:616
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:668
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:691
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:714
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:741
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:791
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:814
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:837
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:860
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:883
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:906
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:929
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:952
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1002
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1048
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1071
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1094
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1196
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1276
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1316
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1356
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1396
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1436
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1473
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1547
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1584
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1793
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1902
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3901
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4054
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4093
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4130
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4164
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4201
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4256
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4291
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4326
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4396
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4436
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4480
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4590
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4660
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4694
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4727
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4816
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4853
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4890
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4932
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5035
#, no-wrap
msgid "`label`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:492
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:538
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:561
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:584
#, no-wrap
msgid "New label to apply"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:497
msgid ""
"Initialize the label on a newly instantiated bpfdesc (BPF descriptor).  "
"Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:499
#, no-wrap
msgid "`mpo_init_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:504
#, no-wrap
msgid "void mpo_init_cred_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:515
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:715
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:742
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:769
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:792
#, no-wrap
msgid "New label to initialize"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:520
msgid ""
"Initialize the label for a newly instantiated user credential.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:522
#, no-wrap
msgid "`mpo_init_devfsdirent_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:527
#, no-wrap
msgid "void mpo_init_devfsdirent_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:543
msgid ""
"Initialize the label on a newly instantiated devfs entry.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:545
#, no-wrap
msgid "`mpo_init_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:550
#, no-wrap
msgid "void mpo_init_ifnet_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:566
msgid ""
"Initialize the label on a newly instantiated network interface.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:568
#, no-wrap
msgid "`mpo_init_ipq_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:573
#, no-wrap
msgid "void mpo_init_ipq_label(struct label *label, int flag);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:587
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:612
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:745
#, no-wrap
msgid "`flag`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:588
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:613
#, no-wrap
msgid "Sleeping/non-sleeping man:malloc[9]; see below"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:595
msgid ""
"Initialize the label on a newly instantiated IP fragment reassembly queue.  "
"The `flag` field may be one of M_WAITOK and M_NOWAIT, and should be employed "
"to avoid performing a sleeping man:malloc[9] during this initialization "
"call.  IP fragment reassembly queue allocation frequently occurs in "
"performance sensitive environments, and the implementation should be careful "
"to avoid sleeping or long-lived operations.  This entry point is permitted "
"to fail resulting in the failure to allocate the IP fragment reassembly "
"queue."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:597
#, no-wrap
msgid "`mpo_init_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:602
#, no-wrap
msgid "void mpo_init_mbuf_label(int flag, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:617
#, no-wrap
msgid "Policy label to initialize"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:624
msgid ""
"Initialize the label on a newly instantiated mbuf packet header (`mbuf`).  "
"The `flag` field may be one of M_WAITOK and M_NOWAIT, and should be employed "
"to avoid performing a sleeping man:malloc[9] during this initialization "
"call.  Mbuf allocation frequently occurs in performance sensitive "
"environments, and the implementation should be careful to avoid sleeping or "
"long-lived operations.  This entry point is permitted to fail resulting in "
"the failure to allocate the mbuf header."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:626
#, no-wrap
msgid "`mpo_init_mount_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:631
#, no-wrap
msgid "void mpo_init_mount_label(struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:641
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:975
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1955
#, no-wrap
msgid "`mntlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:642
#, no-wrap
msgid "Policy label to be initialized for the mount itself"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:645
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:979
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1673
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1716
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1754
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1959
#, no-wrap
msgid "`fslabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:646
#, no-wrap
msgid "Policy label to be initialized for the file system"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:651
msgid ""
"Initialize the labels on a newly instantiated mount point.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:653
#, no-wrap
msgid "`mpo_init_mount_fs_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:658
#, no-wrap
msgid "void mpo_init_mount_fs_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:669
#, no-wrap
msgid "Label to be initialized"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:674
msgid ""
"Initialize the label on a newly mounted file system.  Sleeping is permitted"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:676
#, no-wrap
msgid "`mpo_init_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:681
#, no-wrap
msgid "void mpo_init_pipe_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:692
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1437
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1474
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1511
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1548
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1585
#, no-wrap
msgid "Label to be filled in"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:697
msgid ""
"Initialize a label for a newly instantiated pipe.  Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:699
#, no-wrap
msgid "`mpo_init_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:704
#, no-wrap
msgid "void mpo_init_socket_label(struct label *label, int flag);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:719
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:746
#, no-wrap
msgid "man:malloc[9] flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:724
msgid ""
"Initialize a label for a newly instantiated socket.  The `flag` field may be "
"one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a "
"sleeping man:malloc[9] during this initialization call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:726
#, no-wrap
msgid "`mpo_init_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:731
#, no-wrap
msgid "void mpo_init_socket_peer_label(struct label *label, int flag);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:751
msgid ""
"Initialize the peer label for a newly instantiated socket.  The `flag` field "
"may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid "
"performing a sleeping man:malloc[9] during this initialization call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:753
#, no-wrap
msgid "`mpo_init_proc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:758
#, no-wrap
msgid "void mpo_init_proc_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:774
msgid ""
"Initialize the label for a newly instantiated process.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:776
#, no-wrap
msgid "`mpo_init_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:781
#, no-wrap
msgid "void mpo_init_vnode_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:797
msgid ""
"Initialize the label on a newly instantiated vnode.  Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:799
#, no-wrap
msgid "`mpo_destroy_bpfdesc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:804
#, no-wrap
msgid "void mpo_destroy_bpfdesc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:815
#, no-wrap
msgid "bpfdesc label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:820
msgid ""
"Destroy the label on a BPF descriptor.  In this entry point a policy should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:822
#, no-wrap
msgid "`mpo_destroy_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:827
#, no-wrap
msgid "void mpo_destroy_cred_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:838
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:861
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:884
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:907
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:930
#, no-wrap
msgid "Label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:843
msgid ""
"Destroy the label on a credential.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:845
#, no-wrap
msgid "`mpo_destroy_devfsdirent_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:850
#, no-wrap
msgid "void mpo_destroy_devfsdirent_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:866
msgid ""
"Destroy the label on a devfs entry.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:868
#, no-wrap
msgid "`mpo_destroy_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:873
#, no-wrap
msgid "void mpo_destroy_ifnet_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:889
msgid ""
"Destroy the label on a removed interface.  In this entry point, a policy "
"module should free any internal storage associated with `label` so that it "
"may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:891
#, no-wrap
msgid "`mpo_destroy_ipq_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:896
#, no-wrap
msgid "void mpo_destroy_ipq_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:912
msgid ""
"Destroy the label on an IP fragment queue.  In this entry point, a policy "
"module should free any internal storage associated with `label` so that it "
"may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:914
#, no-wrap
msgid "`mpo_destroy_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:919
#, no-wrap
msgid "void mpo_destroy_mbuf_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:935
msgid ""
"Destroy the label on an mbuf header.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:937
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:960
#, no-wrap
msgid "`mpo_destroy_mount_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:942
#, no-wrap
msgid "void mpo_destroy_mount_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:953
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:976
#, no-wrap
msgid "Mount point label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:958
msgid ""
"Destroy the labels on a mount point.  In this entry point, a policy module "
"should free the internal storage associated with `mntlabel` so that they may "
"be destroyed."
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:965
#, no-wrap
msgid "void mpo_destroy_mount_label(struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:980
#, no-wrap
msgid "File system label being destroyed>"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:985
msgid ""
"Destroy the labels on a mount point.  In this entry point, a policy module "
"should free the internal storage associated with `mntlabel` and `fslabel` so "
"that they may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:987
#, no-wrap
msgid "`mpo_destroy_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:992
#, no-wrap
msgid "void mpo_destroy_socket_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1003
#, no-wrap
msgid "Socket label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1008
msgid ""
"Destroy the label on a socket.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1010
#, no-wrap
msgid "`mpo_destroy_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1015
#, no-wrap
msgid "void mpo_destroy_socket_peer_label(struct label *peerlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1025
#, no-wrap
msgid "`peerlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1026
#, no-wrap
msgid "Socket peer label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1031
msgid ""
"Destroy the peer label on a socket.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1033
#, no-wrap
msgid "`mpo_destroy_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1038
#, no-wrap
msgid "void mpo_destroy_pipe_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1049
#, no-wrap
msgid "Pipe label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1054
msgid ""
"Destroy the label on a pipe.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1056
#, no-wrap
msgid "`mpo_destroy_proc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1061
#, no-wrap
msgid "void mpo_destroy_proc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1072
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1095
#, no-wrap
msgid "Process label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1077
msgid ""
"Destroy the label on a process.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1079
#, no-wrap
msgid "`mpo_destroy_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1084
#, no-wrap
msgid "void mpo_destroy_vnode_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1100
msgid ""
"Destroy the label on a vnode.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1102
#, no-wrap
msgid "`mpo_copy_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1107
#, no-wrap
msgid "void mpo_copy_mbuf_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1117
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1143
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1169
#, no-wrap
msgid "`src`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1118
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1144
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1170
#, no-wrap
msgid "Source label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1121
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1147
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1173
#, no-wrap
msgid "`dest`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1122
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1148
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1174
#, no-wrap
msgid "Destination label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1126
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1178
msgid "Copy the label information in `src` into `dest`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1128
#, no-wrap
msgid "`mpo_copy_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1133
#, no-wrap
msgid "void mpo_copy_pipe_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1154
#, no-wrap
msgid "`mpo_copy_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1159
#, no-wrap
msgid "void mpo_copy_vnode_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1180
#, no-wrap
msgid "`mpo_externalize_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1186
#, no-wrap
msgid ""
"int mpo_externalize_cred_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1197
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1237
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1277
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1317
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1357
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1397
#, no-wrap
msgid "Label to be externalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1200
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1240
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1280
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1320
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1360
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1400
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1440
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1477
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1514
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1551
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1588
#, no-wrap
msgid "`element_name`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1201
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1241
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1281
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1321
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1361
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1401
#, no-wrap
msgid "Name of the policy whose label should be externalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1204
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1324
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1364
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1404
#, no-wrap
msgid "`sb`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1245
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1285
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1325
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1365
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1405
#, no-wrap
msgid "String buffer to be filled with a text representation of label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1288
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1328
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1368
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1408
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1448
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1485
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1522
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1559
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1596
#, no-wrap
msgid "`claimed`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1209
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1249
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1289
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1329
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1369
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1409
#, no-wrap
msgid "Should be incremented when `element_data` can be filled in."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1218
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1258
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1298
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1338
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1378
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1418
msgid ""
"Produce an externalized label based on the label structure passed.  An "
"externalized label consists of a text representation of the label contents "
"that can be used with userland applications and read by the user.  "
"Currently, all policies' `externalize` entry points will be called, so the "
"implementation should check the contents of `element_name` before attempting "
"to fill in `sb`.  If `element_name` does not match the name of your policy, "
"simply return 0.  Only return nonzero if an error occurs while externalizing "
"the label data.  Once the policy fills in `element_data`, `*claimed` should "
"be incremented."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1220
#, no-wrap
msgid "`mpo_externalize_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1226
#, no-wrap
msgid ""
"int mpo_externalize_ifnet_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1260
#, no-wrap
msgid "`mpo_externalize_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1266
#, no-wrap
msgid ""
"int mpo_externalize_pipe_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1300
#, no-wrap
msgid "`mpo_externalize_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1306
#, no-wrap
msgid ""
"int mpo_externalize_socket_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1340
#, no-wrap
msgid "`mpo_externalize_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1346
#, no-wrap
msgid ""
"int mpo_externalize_socket_peer_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1380
#, no-wrap
msgid "`mpo_externalize_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1386
#, no-wrap
msgid ""
"int mpo_externalize_vnode_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1420
#, no-wrap
msgid "`mpo_internalize_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1426
#, no-wrap
msgid ""
"int mpo_internalize_cred_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1441
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1478
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1515
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1552
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1589
#, no-wrap
msgid "Name of the policy whose label should be internalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1444
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1481
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1518
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1555
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1592
#, no-wrap
msgid "`element_data`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1445
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1482
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1519
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1556
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1593
#, no-wrap
msgid "Text data to be internalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1449
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1486
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1523
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1560
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1597
#, no-wrap
msgid "Should be incremented when data can be successfully internalized."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1455
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1492
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1529
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1566
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1603
msgid ""
"Produce an internal label structure based on externalized label data in text "
"format.  Currently, all policies' `internalize` entry points are called when "
"internalization is requested, so the implementation should compare the "
"contents of `element_name` to its own name in order to be sure it should be "
"internalizing the data in `element_data`.  Just as in the `externalize` "
"entry points, the entry point should return 0 if `element_name` does not "
"match its own name, or when data can successfully be internalized, in which "
"case `*claimed` should be incremented."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1457
#, no-wrap
msgid "`mpo_internalize_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1463
#, no-wrap
msgid ""
"int mpo_internalize_ifnet_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1494
#, no-wrap
msgid "`mpo_internalize_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1500
#, no-wrap
msgid ""
"int mpo_internalize_pipe_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1531
#, no-wrap
msgid "`mpo_internalize_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1537
#, no-wrap
msgid ""
"int mpo_internalize_socket_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1568
#, no-wrap
msgid "`mpo_internalize_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1574
#, no-wrap
msgid ""
"int mpo_internalize_vnode_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1605
#, no-wrap
msgid "Label Events"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1613
msgid ""
"This class of entry points is used by the MAC framework to permit policies "
"to maintain label information on kernel objects.  For each labeled kernel "
"object of interest to a MAC policy, entry points may be registered for "
"relevant life cycle events.  All objects implement initialization, creation, "
"and destruction hooks.  Some objects will also implement relabeling, "
"allowing user processes to change the labels on objects.  Some objects will "
"also implement object-specific events, such as label events associated with "
"IP reassembly.  A typical labeled object will have the following life cycle "
"of entry points:"
msgstr ""

#. type: delimited block . 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1625
#, no-wrap
msgid ""
"Label initialization          o\n"
"(object-specific wait)         \\\n"
"Label creation                  o\n"
"                                 \\\n"
"Relabel events,                   o--<--.\n"
"Various object-specific,          |     |\n"
"Access control events             ~-->--o\n"
"                                         \\\n"
"Label destruction                         o\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1629
msgid ""
"Label initialization permits policies to allocate memory and set initial "
"values for labels without context for the use of the object.  The label slot "
"allocated to a policy will be zeroed by default, so some policies may not "
"need to perform initialization."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1636
msgid ""
"Label creation occurs when the kernel structure is associated with an actual "
"kernel object.  For example, Mbufs may be allocated and remain unused in a "
"pool until they are required.  mbuf allocation causes label initialization "
"on the mbuf to take place, but mbuf creation occurs when the mbuf is "
"associated with a datagram.  Typically, context will be provided for a "
"creation event, including the circumstances of the creation, and labels of "
"other relevant objects in the creation process.  For example, when an mbuf "
"is created from a socket, the socket and its label will be presented to "
"registered policies in addition to the new mbuf and its label.  Memory "
"allocation in creation events is discouraged, as it may occur in performance "
"sensitive ports of the kernel; in addition, creation calls are not permitted "
"to fail so a failure to allocate memory cannot be reported."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1639
msgid ""
"Object specific events do not generally fall into the other broad classes of "
"label events, but will generally provide an opportunity to modify or update "
"the label on an object based on additional context.  For example, the label "
"on an IP fragment reassembly queue may be updated during the MAC_UPDATE_IPQ "
"entry point as a result of the acceptance of an additional mbuf to that "
"queue."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1641
msgid "Access control events are discussed in detail in the following section."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1643
msgid ""
"Label destruction permits policies to release storage or state associated "
"with a label during its association with an object so that the kernel data "
"structures supporting the object may be reused or released."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1647
msgid ""
"In addition to labels associated with specific kernel objects, an additional "
"class of labels exists: temporary labels.  These labels are used to store "
"update information submitted by user processes.  These labels are "
"initialized and destroyed as with other label types, but the creation event "
"is MAC_INTERNALIZE, which accepts a user label to be converted to an in-"
"kernel representation."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1649
#, no-wrap
msgid "File System Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1652
#, no-wrap
msgid "`mpo_associate_vnode_devfs`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1659
#, no-wrap
msgid ""
"void mpo_associate_vnode_devfs(struct mount *mp, struct label *fslabel,\n"
"    struct devfs_dirent *de, struct label *delabel, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1712
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1750
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1854
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1951
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3834
#, no-wrap
msgid "`mp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1670
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1855
#, no-wrap
msgid "Devfs mount point"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1674
#, no-wrap
msgid "Devfs file system label (`mp->mnt_fslabel`)"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1677
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1866
#, no-wrap
msgid "`de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1678
#, no-wrap
msgid "Devfs directory entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1681
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1870
#, no-wrap
msgid "`delabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1682
#, no-wrap
msgid "Policy label associated with `de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1685
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1720
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1758
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1914
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2009
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2044
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2084
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2934
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2968
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3240
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3799
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3897
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4050
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4089
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4126
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4160
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4197
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4252
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4322
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4357
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4392
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4432
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4476
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4586
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4656
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4690
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4723
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4812
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4849
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4886
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4928
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5031
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5181
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5282
#, no-wrap
msgid "`vp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1686
#, no-wrap
msgid "vnode associated with `de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1689
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1724
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1762
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1918
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2048
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5185
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5286
#, no-wrap
msgid "`vlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1690
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1725
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1763
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1919
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2049
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4257
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4292
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4397
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4437
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4481
#, no-wrap
msgid "Policy label associated with `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1694
msgid ""
"Fill in the label (`vlabel`) for a newly created devfs vnode based on the "
"devfs directory entry passed in `de` and its label."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1696
#, no-wrap
msgid "`mpo_associate_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1702
#, no-wrap
msgid ""
"int mpo_associate_vnode_extattr(struct mount *mp, struct label *fslabel,\n"
"    struct vnode *vp, struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1713
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1751
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1899
#, no-wrap
msgid "File system mount point"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1717
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1755
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1903
#, no-wrap
msgid "File system label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1721
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1759
#, no-wrap
msgid "Vnode to label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1732
msgid ""
"Attempt to retrieve the label for `vp` from the file system extended "
"attributes.  Upon success, the value `0` is returned.  Should extended "
"attribute retrieval not be supported, an accepted fallback is to copy "
"`fslabel` into `vlabel`.  In the event of an error, an appropriate value for "
"`errno` should be returned."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1734
#, no-wrap
msgid "`mpo_associate_vnode_singlelabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1740
#, no-wrap
msgid ""
"void mpo_associate_vnode_singlelabel(struct mount *mp, struct label *fslabel,\n"
"    struct vnode *vp, struct label *vlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1767
msgid ""
"On non-multilabel file systems, this entry point is called to set the policy "
"label for `vp` based on the file system label, `fslabel`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1769
#, no-wrap
msgid "`mpo_create_devfs_device`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1775
#, no-wrap
msgid ""
"void mpo_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent,\n"
"    struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1785
#, no-wrap
msgid "`dev`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1786
#, no-wrap
msgid "Device corresponding with `devfs_dirent`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1789
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1825
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2076
#, no-wrap
msgid "`devfs_dirent`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1790
#, no-wrap
msgid "Devfs directory entry to be labeled."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1794
#, no-wrap
msgid "Label for `devfs_dirent` to be filled in."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1799
msgid ""
"Fill out the label on a devfs_dirent being created for the passed device.  "
"This call will be made when the device file system is mounted, regenerated, "
"or a new device is made available."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1801
#, no-wrap
msgid "`mpo_create_devfs_directory`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1807
#, no-wrap
msgid ""
"void mpo_create_devfs_directory(char *dirname, int dirnamelen,\n"
"    struct devfs_dirent *devfs_dirent, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1817
#, no-wrap
msgid "`dirname`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1818
#, no-wrap
msgid "Name of directory being created"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1821
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5317
#, no-wrap
msgid "`namelen`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1822
#, no-wrap
msgid "Length of string `dirname`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1826
#, no-wrap
msgid "Devfs directory entry for directory being created."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1831
msgid ""
"Fill out the label on a devfs_dirent being created for the passed "
"directory.  This call will be made when the device file system is mounted, "
"regenerated, or a new device requiring a specific directory hierarchy is "
"made available."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1833
#, no-wrap
msgid "`mpo_create_devfs_symlink`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1840
#, no-wrap
msgid ""
"void mpo_create_devfs_symlink(struct ucred *cred, struct mount *mp,\n"
"    struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,\n"
"    struct label *delabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1850
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1894
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1947
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2005
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2040
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2184
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2252
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2398
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2824
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2996
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3018
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3040
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3135
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3157
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3183
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3209
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3266
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3288
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3311
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3350
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3381
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3412
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3447
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3478
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3542
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3610
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3670
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3699
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3734
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3795
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3830
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3863
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3893
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3931
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3964
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3995
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4038
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4085
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4122
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4193
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4240
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4318
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4353
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4420
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4464
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4512
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4545
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4619
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4652
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4686
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4719
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4760
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4808
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4845
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4882
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4924
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4964
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4994
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5027
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5062
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5103
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5144
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5207
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5229
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5255
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5278
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5309
#, no-wrap
msgid "`cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1851
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1895
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1948
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2006
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2041
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2153
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2185
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2253
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2288
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2399
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2825
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3041
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3136
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3158
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3184
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3210
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3237
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3267
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3289
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3312
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3351
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3382
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3413
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3448
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3479
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3543
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3580
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3611
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3641
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3671
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3700
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3735
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3769
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3796
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3831
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3864
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3894
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3932
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3965
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3996
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4039
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4086
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4123
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4157
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4194
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4241
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4354
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4385
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4421
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4465
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4513
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4546
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4620
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4653
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4687
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4720
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4761
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4809
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4846
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4883
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4925
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4965
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4995
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5028
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5063
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5104
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5145
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5178
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5230
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5256
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5279
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5310
#, no-wrap
msgid "Subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1858
#, no-wrap
msgid "`dd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1859
#, no-wrap
msgid "Link destination"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1862
#, no-wrap
msgid "`ddlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1863
#, no-wrap
msgid "Label associated with `dd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1867
#, no-wrap
msgid "Symlink entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1871
#, no-wrap
msgid "Label associated with `de`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1875
msgid ""
"Fill in the label (`delabel`) for a newly created man:devfs[5] symbolic link "
"entry."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1877
#, no-wrap
msgid "`mpo_create_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1884
#, no-wrap
msgid ""
"int mpo_create_vnode_extattr(struct ucred *cred, struct mount *mp,\n"
"    struct label *fslabel, struct vnode *dvp, struct label *dlabel,\n"
"    struct vnode *vp, struct label *vlabel, struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1898
#, no-wrap
msgid "`mount`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1906
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3935
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3968
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3999
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4042
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4424
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4468
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4549
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4623
#, no-wrap
msgid "`dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1907
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4043
#, no-wrap
msgid "Parent directory vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1910
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3939
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3972
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4003
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4046
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4428
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4472
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4553
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4627
#, no-wrap
msgid "`dlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1911
#, no-wrap
msgid "Label associated with `dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1915
#, no-wrap
msgid "Newly created vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1922
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4007
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4058
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4260
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4440
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4488
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4557
#, no-wrap
msgid "`cnp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1923
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4059
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4441
#, no-wrap
msgid "Component name for `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1929
msgid ""
"Write out the label for `vp` to the appropriate extended attribute.  If the "
"write succeeds, fill in `vlabel` with the label, and return 0.  Otherwise, "
"return an appropriate error."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1931
#, no-wrap
msgid "`mpo_create_mount`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1937
#, no-wrap
msgid ""
"void mpo_create_mount(struct ucred *cred, struct mount *mp, struct label *mnt,\n"
"    struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1952
#, no-wrap
msgid "Object; file system being mounted"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1956
#, no-wrap
msgid "Policy label to be filled in for `mp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1960
#, no-wrap
msgid "Policy label for the file system `mp` mounts."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1965
msgid ""
"Fill out the labels on the mount point being created by the passed subject "
"credential.  This call will be made when a new file system is mounted."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1967
#, no-wrap
msgid "`mpo_create_root_mount`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1973
#, no-wrap
msgid ""
"void mpo_create_root_mount(struct ucred *cred, struct mount *mp,\n"
"    struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1983
#, no-wrap
msgid "See crossref:mac[mac-mpo-create-mount, `mpo_create_mount`]."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1987
msgid ""
"Fill out the labels on the mount point being created by the passed subject "
"credential.  This call will be made when the root file system is mounted, "
"after `mpo_create_mount;`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1989
#, no-wrap
msgid "`mpo_relabel_vnode`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1995
#, no-wrap
msgid ""
"void mpo_relabel_vnode(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vnodelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2010
#, no-wrap
msgid "vnode to relabel"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2013
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2088
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2938
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2972
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3803
#, no-wrap
msgid "`vnodelabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2014
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3804
#, no-wrap
msgid "Existing policy label for `vp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2017
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2264
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2299
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2334
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2836
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3044
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3424
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3711
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3746
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3772
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3807
#, no-wrap
msgid "`newlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2018
#, no-wrap
msgid "New, possibly partial label to replace `vnodelabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2022
msgid ""
"Update the label on the passed vnode given the passed update vnode label and "
"the passed subject credential."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2024
#, no-wrap
msgid "`mpo_setlabel_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2030
#, no-wrap
msgid ""
"int mpo_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel, struct label *intlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2045
#, no-wrap
msgid "Vnode for which the label is being written"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2052
#, no-wrap
msgid "`intlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2053
#, no-wrap
msgid "Label to write out"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2058
msgid ""
"Write out the policy from `intlabel` to an extended attribute.  This is "
"called from `vop_stdcreatevnode_ea`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2060
#, no-wrap
msgid "`mpo_update_devfsdirent`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2066
#, no-wrap
msgid ""
"void mpo_update_devfsdirent(struct devfs_dirent *devfs_dirent,\n"
"    struct label *direntlabel, struct vnode *vp, struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2077
#, no-wrap
msgid "Object; devfs directory entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2080
#, no-wrap
msgid "`direntlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2081
#, no-wrap
msgid "Policy label for `devfs_dirent` to be updated."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2085
#, no-wrap
msgid "Parent vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2087
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2937
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3802
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4092
#, no-wrap
msgid "Locked"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2089
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2939
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2973
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3902
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4055
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4094
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4131
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4165
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4202
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4591
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4661
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4695
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4728
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4769
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4817
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4854
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4891
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4933
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5036
#, no-wrap
msgid "Policy label for `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2095
msgid ""
"Update the `devfs_dirent` label from the passed devfs vnode label.  This "
"call will be made when a devfs vnode has been successfully relabeled to "
"commit the label change such that it lasts even if the vnode is recycled.  "
"It will also be made when a symlink is created in devfs, following a call to "
"`mac_vnode_create_from_vnode` to initialize the vnode label."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2097
#, no-wrap
msgid "IPC Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2100
#, no-wrap
msgid "`mpo_create_mbuf_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2106
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,\n"
"    struct mbuf *m, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2116
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3513
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3546
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3674
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3738
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4516
#, no-wrap
msgid "`socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2117
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3584
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3615
#, no-wrap
msgid "Socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2119
#, no-wrap
msgid "Socket locking WIP"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2120
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2192
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3517
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3550
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3587
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3618
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3678
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3742
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4520
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5152
#, no-wrap
msgid "`socketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2121
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3518
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3551
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3679
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4521
#, no-wrap
msgid "Policy label for `socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2124
#, no-wrap
msgid "`m`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2125
#, no-wrap
msgid "Object; mbuf"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2128
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2326
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2610
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2646
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2682
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2863
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5078
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5119
#, no-wrap
msgid "`mbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2129
#, no-wrap
msgid "Policy label to fill in for `m`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2134
msgid ""
"Set the label on a newly created mbuf header from the passed socket label.  "
"This call is made when a new datagram or message is generated by the socket "
"and stored in the passed mbuf."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2136
#, no-wrap
msgid "`mpo_create_pipe`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2142
#, no-wrap
msgid ""
"void mpo_create_pipe(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2256
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3315
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3354
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3385
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3416
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3451
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3482
#, no-wrap
msgid "`pipe`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2157
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2257
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3316
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3355
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3386
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3417
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3452
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3483
#, no-wrap
msgid "Pipe"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2160
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3319
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3358
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3389
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3420
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3455
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3486
#, no-wrap
msgid "`pipelabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2161
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3320
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3359
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3390
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3456
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3487
#, no-wrap
msgid "Policy label associated with `pipe`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2166
msgid ""
"Set the label on a newly created pipe from the passed subject credential.  "
"This call is made when a new pipe is created."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2168
#, no-wrap
msgid "`mpo_create_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2174
#, no-wrap
msgid ""
"void mpo_create_socket(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2187
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2290
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2401
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2929
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2967
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3798
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3866
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4088
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5147
#, no-wrap
msgid "Immutable"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2188
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2291
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3614
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5148
#, no-wrap
msgid "`so`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2189
#, no-wrap
msgid "Object; socket to label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2193
#, no-wrap
msgid "Label to fill in for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2198
msgid ""
"Set the label on a newly created socket from the passed subject credential.  "
"This call is made when a socket is created."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2200
#, no-wrap
msgid "`mpo_create_socket_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2207
#, no-wrap
msgid ""
"void mpo_create_socket_from_socket(struct socket *oldsocket,\n"
"    struct label *oldsocketlabel, struct socket *newsocket,\n"
"    struct label *newsocketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2217
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2359
#, no-wrap
msgid "`oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2218
#, no-wrap
msgid "Listening socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2221
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2363
#, no-wrap
msgid "`oldsocketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2222
#, no-wrap
msgid "Policy label associated with `oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2225
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2367
#, no-wrap
msgid "`newsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2226
#, no-wrap
msgid "New socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2229
#, no-wrap
msgid "`newsocketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2230
#, no-wrap
msgid "Policy label associated with `newsocketlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2234
msgid ""
"Label a socket, `newsocket`, newly man:accept[2]ed, based on the "
"man:listen[2] socket, `oldsocket`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2236
#, no-wrap
msgid "`mpo_relabel_pipe`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2242
#, no-wrap
msgid ""
"void mpo_relabel_pipe(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2260
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2295
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2330
#, no-wrap
msgid "`oldlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2261
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3421
#, no-wrap
msgid "Current policy label associated with `pipe`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2265
#, no-wrap
msgid "Policy label update to apply to `pipe`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2269
msgid "Apply a new label, `newlabel`, to `pipe`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2271
#, no-wrap
msgid "`mpo_relabel_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2277
#, no-wrap
msgid ""
"void mpo_relabel_socket(struct ucred *cred, struct socket *so,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2292
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3675
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3739
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4517
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5149
#, no-wrap
msgid "Object; socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2296
#, no-wrap
msgid "Current label for `so`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2300
#, no-wrap
msgid "Label update for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2304
msgid "Update the label on a socket from the passed socket label update."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2306
#, no-wrap
msgid "`mpo_set_socket_peer_from_mbuf`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2312
#, no-wrap
msgid ""
"void mpo_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2322
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2606
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2642
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2678
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2859
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5074
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5115
#, no-wrap
msgid "`mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2323
#, no-wrap
msgid "First datagram received over socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2327
#, no-wrap
msgid "Label for `mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2331
#, no-wrap
msgid "Current label for the socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2335
#, no-wrap
msgid "Policy label to be filled out for the socket"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2340
msgid ""
"Set the peer label on a stream socket from the passed mbuf label.  This call "
"will be made when the first datagram is received by the stream socket, with "
"the exception of Unix domain sockets."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2342
#, no-wrap
msgid "`mpo_set_socket_peer_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2349
#, no-wrap
msgid ""
"void mpo_set_socket_peer_from_socket(struct socket *oldsocket,\n"
"    struct label *oldsocketlabel, struct socket *newsocket,\n"
"    struct label *newsocketpeerlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2360
#, no-wrap
msgid "Local socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2364
#, no-wrap
msgid "Policy label for `oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2368
#, no-wrap
msgid "Peer socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2371
#, no-wrap
msgid "`newsocketpeerlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2372
#, no-wrap
msgid "Policy label to fill in for `newsocket`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2377
msgid ""
"Set the peer label on a stream UNIX domain socket from the passed remote "
"socket endpoint.  This call will be made when the socket pair is connected, "
"and will be made for both endpoints."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2379
#, no-wrap
msgid "Network Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2382
#, no-wrap
msgid "`mpo_create_bpfdesc`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2388
#, no-wrap
msgid ""
"void mpo_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,\n"
"    struct label *bpflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2402
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2634
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3100
#, no-wrap
msgid "`bpf_d`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2403
#, no-wrap
msgid "Object; bpf descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2406
#, no-wrap
msgid "`bpf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2407
#, no-wrap
msgid "Policy label to be filled in for `bpf_d`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2412
msgid ""
"Set the label on a newly created BPF descriptor from the passed subject "
"credential.  This call will be made when a BPF device node is opened by a "
"process with the passed subject credential."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2414
#, no-wrap
msgid "`mpo_create_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2419
#, no-wrap
msgid "void mpo_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2429
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2598
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2670
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2714
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2828
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3108
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3703
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5066
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5107
#, no-wrap
msgid "`ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2430
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2599
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2671
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2715
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5067
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5108
#, no-wrap
msgid "Network interface"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2433
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2602
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2674
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2832
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3112
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3707
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5070
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5111
#, no-wrap
msgid "`ifnetlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2434
#, no-wrap
msgid "Policy label to fill in for `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2439
msgid ""
"Set the label on a newly created interface.  This call may be made when a "
"new physical interface becomes available to the system, or when a pseudo-"
"interface is instantiated during the boot or as a result of a user action."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2441
#, no-wrap
msgid "`mpo_create_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2447
#, no-wrap
msgid ""
"void mpo_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2457
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2535
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2786
#, no-wrap
msgid "`fragment`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2458
#, no-wrap
msgid "First received IP fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2461
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2539
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2790
#, no-wrap
msgid "`fragmentlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2462
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2791
#, no-wrap
msgid "Policy label for `fragment`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2465
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2492
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2794
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2867
#, no-wrap
msgid "`ipq`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2466
#, no-wrap
msgid "IP reassembly queue to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2469
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2496
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2798
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2871
#, no-wrap
msgid "`ipqlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2470
#, no-wrap
msgid "Policy label to be filled in for `ipq`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2474
msgid ""
"Set the label on a newly created IP fragment reassembly queue from the mbuf "
"header of the first received fragment."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2476
#, no-wrap
msgid "`mpo_create_datagram_from_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2482
#, no-wrap
msgid ""
"void mpo_create_create_datagram_from_ipq(struct ipq *ipq,\n"
"    struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2493
#, no-wrap
msgid "IP reassembly queue"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2497
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2799
#, no-wrap
msgid "Policy label for `ipq`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2500
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2527
#, no-wrap
msgid "`datagram`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2501
#, no-wrap
msgid "Datagram to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2504
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2531
#, no-wrap
msgid "`datagramlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2505
#, no-wrap
msgid "Policy label to be filled in for `datagramlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2509
msgid ""
"Set the label on a newly reassembled IP datagram from the IP fragment "
"reassembly queue from which it was generated."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2511
#, no-wrap
msgid "`mpo_create_fragment`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2517
#, no-wrap
msgid ""
"void mpo_create_fragment(struct mbuf *datagram, struct label *datagramlabel,\n"
"    struct mbuf *fragment, struct label *fragmentlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2528
#, no-wrap
msgid "Datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2532
#, no-wrap
msgid "Policy label for `datagram`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2536
#, no-wrap
msgid "Fragment to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2540
#, no-wrap
msgid "Policy label to be filled in for `datagram`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2544
msgid ""
"Set the label on the mbuf header of a newly created IP fragment from the "
"label on the mbuf header of the datagram it was generate from."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2546
#, no-wrap
msgid "`mpo_create_mbuf_from_mbuf`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2552
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct label *oldmbuflabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2562
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2706
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2750
#, no-wrap
msgid "`oldmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2563
#, no-wrap
msgid "Existing (source) mbuf"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2566
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2754
#, no-wrap
msgid "`oldmbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2567
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2711
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2755
#, no-wrap
msgid "Policy label for `oldmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2570
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2722
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2758
#, no-wrap
msgid "`newmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2571
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2643
#, no-wrap
msgid "New mbuf to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2574
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2726
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2762
#, no-wrap
msgid "`newmbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2575
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2727
#, no-wrap
msgid "Policy label to be filled in for `newmbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2580
msgid ""
"Set the label on the mbuf header of a newly created datagram from the mbuf "
"header of an existing datagram.  This call may be made in a number of "
"situations, including when an mbuf is re-allocated for alignment purposes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2582
#, no-wrap
msgid "`mpo_create_mbuf_linklayer`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2588
#, no-wrap
msgid ""
"void mpo_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2603
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2719
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2833
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3113
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5071
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5112
#, no-wrap
msgid "Policy label for `ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2607
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2679
#, no-wrap
msgid "mbuf header for new datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2611
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2683
#, no-wrap
msgid "Policy label to be filled in for `mbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2616
msgid ""
"Set the label on the mbuf header of a newly created datagram generated for "
"the purposes of a link layer response for the passed interface.  This call "
"may be made in a number of situations, including for ARP or ND6 responses in "
"the IPv4 and IPv6 stacks."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2618
#, no-wrap
msgid "`mpo_create_mbuf_from_bpfdesc`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2624
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2635
#, no-wrap
msgid "BPF descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2638
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3104
#, no-wrap
msgid "`bpflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2639
#, no-wrap
msgid "Policy label for `bpflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2647
#, no-wrap
msgid "Policy label to fill in for `mbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2652
msgid ""
"Set the label on the mbuf header of a newly created datagram generated using "
"the passed BPF descriptor.  This call is made when a write is performed to "
"the BPF device associated with the passed BPF descriptor."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2654
#, no-wrap
msgid "`mpo_create_mbuf_from_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2660
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2675
#, no-wrap
msgid "Policy label for `ifnetlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2687
msgid ""
"Set the label on the mbuf header of a newly created datagram generated from "
"the passed network interface."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2689
#, no-wrap
msgid "`mpo_create_mbuf_multicast_encap`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2696
#, no-wrap
msgid ""
"void mpo_create_mbuf_multicast_encap(struct mbuf *oldmbuf,\n"
"    struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2707
#, no-wrap
msgid "mbuf header for existing datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2723
#, no-wrap
msgid "mbuf header to be labeled for new datagram"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2732
msgid ""
"Set the label on the mbuf header of a newly created datagram generated from "
"the existing passed datagram when it is processed by the passed multicast "
"encapsulation interface.  This call is made when an mbuf is to be delivered "
"using the virtual interface."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2734
#, no-wrap
msgid "`mpo_create_mbuf_netlayer`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2740
#, no-wrap
msgid ""
"void mpo_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2751
#, no-wrap
msgid "Received datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2759
#, no-wrap
msgid "Newly created datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2763
#, no-wrap
msgid "Policy label for `newmbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2768
msgid ""
"Set the label on the mbuf header of a newly created datagram generated by "
"the IP stack in response to an existing received datagram (`oldmbuf`).  This "
"call may be made in a number of situations, including when responding to "
"ICMP request datagrams."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2770
#, no-wrap
msgid "`mpo_fragment_match`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2776
#, no-wrap
msgid ""
"int mpo_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2787
#, no-wrap
msgid "IP datagram fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2795
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2868
#, no-wrap
msgid "IP fragment reassembly queue"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2806
msgid ""
"Determine whether an mbuf header containing an IP datagram (`fragment`) "
"fragment matches the label of the passed IP fragment reassembly queue "
"(`ipq`).  Return (1) for a successful match, or (0) for no match.  This call "
"is made when the IP stack attempts to find an existing fragment reassembly "
"queue for a newly received fragment; if this fails, a new fragment "
"reassembly queue may be instantiated for the fragment.  Policies may use "
"this entry point to prevent the reassembly of otherwise matching IP "
"fragments if policy does not permit them to be reassembled based on the "
"label or other information."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2808
#, no-wrap
msgid "`mpo_relabel_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2814
#, no-wrap
msgid ""
"void mpo_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2829
#, no-wrap
msgid "Object; Network interface"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2837
#, no-wrap
msgid "Label update to apply to `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2841
msgid ""
"Update the label of network interface, `ifnet`, based on the passed update "
"label, `newlabel`, and the passed subject credential, `cred`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2843
#, no-wrap
msgid "`mpo_update_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2849
#, no-wrap
msgid ""
"void mpo_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2860
#, no-wrap
msgid "IP fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2864
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5079
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5120
#, no-wrap
msgid "Policy label for `mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2872
#, no-wrap
msgid "Policy label to be updated for `ipq`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2876
msgid ""
"Update the label on an IP fragment reassembly queue (`ipq`) based on the "
"acceptance of the passed IP fragment mbuf header (`mbuf`)."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2878
#, no-wrap
msgid "Process Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2881
#, no-wrap
msgid "`mpo_create_cred`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2886
#, no-wrap
msgid "void mpo_create_cred(struct ucred *parent_cred, struct ucred *child_cred);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2896
#, no-wrap
msgid "`parent_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2897
#, no-wrap
msgid "Parent subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2900
#, no-wrap
msgid "`child_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2901
#, no-wrap
msgid "Child subject credential"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2907
msgid ""
"Set the label of a newly created subject credential from the passed subject "
"credential.  This call will be made when man:crcopy[9] is invoked on a newly "
"created `struct ucred`.  This call should not be confused with a process "
"forking or creation event."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2909
#, no-wrap
msgid "`mpo_execve_transition`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2915
#, no-wrap
msgid ""
"void mpo_execve_transition(struct ucred *old, struct ucred *new,\n"
"    struct vnode *vp, struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2926
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2964
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5321
#, no-wrap
msgid "`old`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2927
#, no-wrap
msgid "Existing subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2930
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5333
#, no-wrap
msgid "`new`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2931
#, no-wrap
msgid "New subject credential to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2935
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2969
#, no-wrap
msgid "File to execute"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2946
msgid ""
"Update the label of a newly created subject credential (`new`) from the "
"passed existing subject credential (`old`) based on a label transition "
"caused by executing the passed vnode (`vp`).  This call occurs when a "
"process executes the passed vnode and one of the policies returns a success "
"from the `mpo_execve_will_transition` entry point.  Policies may choose to "
"implement this call simply by invoking `mpo_create_cred` and passing the two "
"subject credentials so as not to implement a transitioning event.  Policies "
"should not leave this entry point unimplemented if they implement "
"`mpo_create_cred`, even if they do not implement "
"`mpo_execve_will_transition`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2948
#, no-wrap
msgid "`mpo_execve_will_transition`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2954
#, no-wrap
msgid ""
"int mpo_execve_will_transition(struct ucred *old, struct vnode *vp,\n"
"    struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2965
#, no-wrap
msgid "Subject credential prior to man:execve[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2979
msgid ""
"Determine whether the policy will want to perform a transition event as a "
"result of the execution of the passed vnode by the passed subject "
"credential.  Return 1 if a transition is required, 0 if not.  Even if a "
"policy returns 0, it should behave correctly in the presence of an "
"unexpected invocation of `mpo_execve_transition`, as that call may happen as "
"a result of another policy requesting a transition."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2981
#, no-wrap
msgid "`mpo_create_proc0`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2986
#, no-wrap
msgid "void mpo_create_proc0(struct ucred *cred);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2997
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3019
#, no-wrap
msgid "Subject credential to be filled in"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3001
msgid ""
"Create the subject credential of process 0, the parent of all kernel "
"processes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3003
#, no-wrap
msgid "`mpo_create_proc1`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3008
#, no-wrap
msgid "void mpo_create_proc1(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3023
msgid ""
"Create the subject credential of process 1, the parent of all user processes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3025
#, no-wrap
msgid "`mpo_relabel_cred`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3030
#, no-wrap
msgid "void mpo_relabel_cred(struct ucred *cred, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3045
#, no-wrap
msgid "Label update to apply to `cred`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3049
msgid "Update the label on a subject credential from the passed update label."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3051
#, no-wrap
msgid "Access Control Checks"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3059
msgid ""
"Access control entry points permit policy modules to influence access "
"control decisions made by the kernel.  Generally, although not always, "
"arguments to an access control entry point will include one or more "
"authorizing credentials, information (possibly including a label) for any "
"other objects involved in the operation.  An access control entry point may "
"return 0 to permit the operation, or an man:errno[2] error value.  The "
"results of invoking the entry point across various registered policy modules "
"will be composed as follows: if all modules permit the operation to succeed, "
"success will be returned.  If one or modules returns a failure, a failure "
"will be returned.  If more than one module returns a failure, the errno "
"value to return to the user will be selected using the following precedence, "
"implemented by the `error_select()` function in [.filename]#kern_mac.c#:"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3065
#, no-wrap
msgid "Most precedence"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3067
#, no-wrap
msgid "EDEADLK"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3070
#, no-wrap
msgid "EINVAL"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3073
#, no-wrap
msgid "ESRCH"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3076
#, no-wrap
msgid "EACCES"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3077
#, no-wrap
msgid "Least precedence"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3078
#, no-wrap
msgid "EPERM"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3082
msgid ""
"If none of the error values returned by all modules are listed in the "
"precedence chart then an arbitrarily selected value from the set will be "
"returned.  In general, the rules provide precedence to errors in the "
"following order: kernel failures, invalid arguments, object not present, "
"access not permitted, other."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3084
#, no-wrap
msgid "`mpo_check_bpfdesc_receive`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3090
#, no-wrap
msgid ""
"int mpo_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,\n"
"    struct ifnet *ifnet, struct label *ifnetlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3101
#, no-wrap
msgid "Subject; BPF descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3105
#, no-wrap
msgid "Policy label for `bpf_d`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3109
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3704
#, no-wrap
msgid "Object; network interface"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3118
msgid ""
"Determine whether the MAC framework should permit datagrams from the passed "
"interface to be delivered to the buffers of the passed BPF descriptor.  "
"Return (0) for success, or an `errno` value for failure Suggested failure: "
"EACCES for label mismatches, EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3120
#, no-wrap
msgid "`mpo_check_kenv_dump`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3125
#, no-wrap
msgid "int mpo_check_kenv_dump(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3140
msgid ""
"Determine whether the subject should be allowed to retrieve the kernel "
"environment (see man:kenv[2])."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3142
#, no-wrap
msgid "`mpo_check_kenv_get`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3147
#, no-wrap
msgid "int mpo_check_kenv_get(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3161
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3187
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3213
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4209
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4776
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5313
#, no-wrap
msgid "`name`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3162
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3188
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3214
#, no-wrap
msgid "Kernel environment variable name"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3166
msgid ""
"Determine whether the subject should be allowed to retrieve the value of the "
"specified kernel environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3168
#, no-wrap
msgid "`mpo_check_kenv_set`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3173
#, no-wrap
msgid "int mpo_check_kenv_set(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3192
msgid ""
"Determine whether the subject should be allowed to set the specified kernel "
"environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3194
#, no-wrap
msgid "`mpo_check_kenv_unset`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3199
#, no-wrap
msgid "int mpo_check_kenv_unset(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3218
msgid ""
"Determine whether the subject should be allowed to unset the specified "
"kernel environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3220
#, no-wrap
msgid "`mpo_check_kld_load`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3226
#, no-wrap
msgid ""
"int mpo_check_kld_load(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3241
#, no-wrap
msgid "Kernel module vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3245
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5186
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5287
#, no-wrap
msgid "Label associated with `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3249
msgid ""
"Determine whether the subject should be allowed to load the specified module "
"file."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3251
#, no-wrap
msgid "`mpo_check_kld_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3256
#, no-wrap
msgid "int mpo_check_kld_stat(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3271
msgid ""
"Determine whether the subject should be allowed to retrieve a list of loaded "
"kernel module files and associated statistics."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3273
#, no-wrap
msgid "`mpo_check_kld_unload`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3278
#, no-wrap
msgid "int mpo_check_kld_unload(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3293
msgid ""
"Determine whether the subject should be allowed to unload a kernel module."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3295
#, no-wrap
msgid "`mpo_check_pipe_ioctl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3301
#, no-wrap
msgid ""
"int mpo_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel, unsigned long cmd, void *data);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3323
#, no-wrap
msgid "`cmd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3324
#, no-wrap
msgid "man:ioctl[2] command"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3327
#, no-wrap
msgid "`data`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3328
#, no-wrap
msgid "man:ioctl[2] data"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3332
msgid ""
"Determine whether the subject should be allowed to make the specified "
"man:ioctl[2] call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3334
#, no-wrap
msgid "`mpo_check_pipe_poll`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3340
#, no-wrap
msgid ""
"int mpo_check_pipe_poll(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3363
msgid "Determine whether the subject should be allowed to poll `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3365
#, no-wrap
msgid "`mpo_check_pipe_read`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3371
#, no-wrap
msgid ""
"int mpo_check_pipe_read(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3394
msgid "Determine whether the subject should be allowed read access to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3396
#, no-wrap
msgid "`mpo_check_pipe_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3402
#, no-wrap
msgid ""
"int mpo_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3425
#, no-wrap
msgid "Label update to `pipelabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3429
msgid "Determine whether the subject should be allowed to relabel `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3431
#, no-wrap
msgid "`mpo_check_pipe_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3437
#, no-wrap
msgid ""
"int mpo_check_pipe_stat(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3460
msgid ""
"Determine whether the subject should be allowed to retrieve statistics "
"related to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3462
#, no-wrap
msgid "`mpo_check_pipe_write`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3468
#, no-wrap
msgid ""
"int mpo_check_pipe_write(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3491
msgid "Determine whether the subject should be allowed to write to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3493
#, no-wrap
msgid "`mpo_check_socket_bind`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3499
#, no-wrap
msgid ""
"int mpo_check_socket_bind(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct sockaddr *sockaddr);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3514
#, no-wrap
msgid "Socket to be bound"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3521
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3554
#, no-wrap
msgid "`sockaddr`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3522
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3555
#, no-wrap
msgid "Address of `socket`"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3526
#, no-wrap
msgid "`mpo_check_socket_connect`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3532
#, no-wrap
msgid ""
"int mpo_check_socket_connect(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct sockaddr *sockaddr);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3547
#, no-wrap
msgid "Socket to be connected"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3561
msgid ""
"Determine whether the subject credential (`cred`) can connect the passed "
"socket (`socket`) to the passed socket address (`sockaddr`).  Return 0 for "
"success, or an `errno` value for failure.  Suggested failure: EACCES for "
"label mismatches, EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3563
#, no-wrap
msgid "`mpo_check_socket_receive`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3569
#, no-wrap
msgid ""
"int mpo_check_socket_receive(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3588
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3619
#, no-wrap
msgid "Policy label associated with `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3592
msgid ""
"Determine whether the subject should be allowed to receive information from "
"the socket `so`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3594
#, no-wrap
msgid "`mpo_check_socket_send`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3600
#, no-wrap
msgid ""
"int mpo_check_socket_send(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3623
msgid ""
"Determine whether the subject should be allowed to send information across "
"the socket `so`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3625
#, no-wrap
msgid "`mpo_check_cred_visible`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3630
#, no-wrap
msgid "int mpo_check_cred_visible(struct ucred *u1, struct ucred *u2);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3640
#, no-wrap
msgid "`u1`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3644
#, no-wrap
msgid "`u2`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3645
#, no-wrap
msgid "Object credential"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3652
msgid ""
"Determine whether the subject credential `u1` can \"see\" other subjects "
"with the passed subject credential `u2`.  Return 0 for success, or an "
"`errno` value for failure.  Suggested failure: EACCES for label mismatches, "
"EPERM for lack of privilege, or ESRCH to hide visibility.  This call may be "
"made in a number of situations, including inter-process status sysctl's used "
"by `ps`, and in procfs lookups."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3654
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5128
#, no-wrap
msgid "`mpo_check_socket_visible`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3660
#, no-wrap
msgid ""
"int mpo_check_socket_visible(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3683
#, no-wrap
msgid "`mpo_check_ifnet_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3689
#, no-wrap
msgid ""
"int mpo_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3708
#, no-wrap
msgid "Existing policy label for `ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3712
#, no-wrap
msgid "Policy label update to later be applied to `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3716
msgid ""
"Determine whether the subject credential can relabel the passed network "
"interface to the passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3718
#, no-wrap
msgid "`mpo_check_socket_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3724
#, no-wrap
msgid ""
"int mpo_check_socket_relabel(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3743
#, no-wrap
msgid "Existing policy label for `socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3747
#, no-wrap
msgid "Label update to later be applied to `socketlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3751
msgid ""
"Determine whether the subject credential can relabel the passed socket to "
"the passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3753
#, no-wrap
msgid "`mpo_check_cred_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3758
#, no-wrap
msgid "int mpo_check_cred_relabel(struct ucred *cred, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3773
#, no-wrap
msgid "Label update to later be applied to `cred`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3777
msgid ""
"Determine whether the subject credential can relabel itself to the passed "
"label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3779
#, no-wrap
msgid "`mpo_check_vnode_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3785
#, no-wrap
msgid ""
"int mpo_check_vnode_relabel(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vnodelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3800
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3898
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4000
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4090
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4161
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4198
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4550
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4587
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4657
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4691
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4724
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4765
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4813
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4850
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4887
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5032
#, no-wrap
msgid "Object; vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3808
#, no-wrap
msgid "Policy label update to later be applied to `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3812
msgid ""
"Determine whether the subject credential can relabel the passed vnode to the "
"passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3814
#, no-wrap
msgid "`mpo_check_mount_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3820
#, no-wrap
msgid ""
"int mpo_check_mount_stat(struct ucred *cred, struct mount *mp,\n"
"    struct label *mountlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3835
#, no-wrap
msgid "Object; file system mount"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3838
#, no-wrap
msgid "`mountlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3839
#, no-wrap
msgid "Policy label for `mp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3846
msgid ""
"Determine whether the subject credential can see the results of a statfs "
"performed on the file system.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatches or EPERM for lack "
"of privilege.  This call may be made in a number of situations, including "
"during invocations of man:statfs[2] and related calls, as well as to "
"determine what file systems to exclude from listings of file systems, such "
"as when man:getfsstat[2] is invoked."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3848
#, no-wrap
msgid "`mpo_check_proc_debug`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3853
#, no-wrap
msgid "int mpo_check_proc_debug(struct ucred *cred, struct proc *proc);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3867
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4968
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4998
#, no-wrap
msgid "`proc`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3868
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4969
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4999
#, no-wrap
msgid "Object; process"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3875
msgid ""
"Determine whether the subject credential can debug the passed process.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, EPERM for lack of privilege, or ESRCH to hide "
"visibility of the target.  This call may be made in a number of situations, "
"including use of the man:ptrace[2] and man:ktrace[2] APIs, as well as for "
"some types of procfs operations."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3877
#, no-wrap
msgid "`mpo_check_vnode_access`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3883
#, no-wrap
msgid ""
"int mpo_check_vnode_access(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int flags);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3905
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4820
#, no-wrap
msgid "`flags`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3906
#, no-wrap
msgid "man:access[2] flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3913
msgid ""
"Determine how invocations of man:access[2] and related calls by the subject "
"credential should return when performed on the passed vnode using the passed "
"access flags.  This should generally be implemented using the same semantics "
"used in `mpo_check_vnode_open`.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatches or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3915
#, no-wrap
msgid "`mpo_check_vnode_chdir`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3921
#, no-wrap
msgid ""
"int mpo_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3936
#, no-wrap
msgid "Object; vnode to man:chdir[2] into"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3940
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4004
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4047
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4554
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4628
#, no-wrap
msgid "Policy label for `dvp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3946
msgid ""
"Determine whether the subject credential can change the process working "
"directory to the passed vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3948
#, no-wrap
msgid "`mpo_check_vnode_chroot`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3954
#, no-wrap
msgid ""
"int mpo_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3969
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4245
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4425
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4469
#, no-wrap
msgid "Directory vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3973
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4249
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4429
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4473
#, no-wrap
msgid "Policy label associated with `dvp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3977
msgid ""
"Determine whether the subject should be allowed to man:chroot[2] into the "
"specified directory (`dvp`)."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3979
#, no-wrap
msgid "`mpo_check_vnode_create`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3985
#, no-wrap
msgid ""
"int mpo_check_vnode_create(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct componentname *cnp, struct vattr *vap);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4008
#, no-wrap
msgid "Component name for `dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4011
#, no-wrap
msgid "`vap`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4012
#, no-wrap
msgid "vnode attributes for `vap`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4019
msgid ""
"Determine whether the subject credential can create a vnode with the passed "
"parent directory, passed name information, and passed attribute "
"information.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege.  This call may be made in a number of situations, including as a "
"result of calls to man:open[2] with O_CREAT, man:mkfifo[2], and others."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4021
#, no-wrap
msgid "`mpo_check_vnode_delete`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4028
#, no-wrap
msgid ""
"int mpo_check_vnode_delete(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, void *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4051
#, no-wrap
msgid "Object; vnode to delete"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4067
msgid ""
"Determine whether the subject credential can delete a vnode from the passed "
"parent directory and passed name information.  Return 0 for success, or an "
"`errno` value for failure.  Suggested failure: EACCES for label mismatch, or "
"EPERM for lack of privilege.  This call may be made in a number of "
"situations, including as a result of calls to man:unlink[2] and "
"man:rmdir[2].  Policies implementing this entry point should also implement "
"`mpo_check_rename_to` to authorize deletion of objects as a result of being "
"the target of a rename."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4069
#, no-wrap
msgid "`mpo_check_vnode_deleteacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4075
#, no-wrap
msgid ""
"int mpo_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4097
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4168
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4731
#, no-wrap
msgid "`type`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4098
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4169
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4732
#, no-wrap
msgid "ACL type"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4104
msgid ""
"Determine whether the subject credential can delete the ACL of passed type "
"from the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4106
#, no-wrap
msgid "`mpo_check_vnode_exec`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4112
#, no-wrap
msgid ""
"int mpo_check_vnode_exec(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4127
#, no-wrap
msgid "Object; vnode to execute"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4138
msgid ""
"Determine whether the subject credential can execute the passed vnode.  "
"Determination of execute privilege is made separately from decisions about "
"any transitioning event.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4140
#, no-wrap
msgid "`mpo_check_vnode_getacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4146
#, no-wrap
msgid ""
"int mpo_check_vnode_getacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4175
msgid ""
"Determine whether the subject credential can retrieve the ACL of passed type "
"from the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4177
#, no-wrap
msgid "`mpo_check_vnode_getextattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4183
#, no-wrap
msgid ""
"int mpo_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int attrnamespace, const char *name, struct uio *uio);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4772
#, no-wrap
msgid "`attrnamespace`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4206
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4773
#, no-wrap
msgid "Extended attribute namespace"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4210
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4777
#, no-wrap
msgid "Extended attribute name"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4213
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4780
#, no-wrap
msgid "`uio`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4214
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4781
#, no-wrap
msgid "I/O structure pointer; see man:uio[9]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4221
msgid ""
"Determine whether the subject credential can retrieve the extended attribute "
"with the passed namespace and name from the passed vnode.  Policies "
"implementing labeling using extended attributes may be interested in special "
"handling of operations on those extended attributes.  Return 0 for success, "
"or an `errno` value for failure.  Suggested failure: EACCES for label "
"mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4223
#, no-wrap
msgid "`mpo_check_vnode_link`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4230
#, no-wrap
msgid ""
"int mpo_check_vnode_link(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4253
#, no-wrap
msgid "Link destination vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4261
#, no-wrap
msgid "Component name for the link being created"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4265
msgid ""
"Determine whether the subject should be allowed to create a link to the "
"vnode `vp` with the name specified by `cnp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4267
#, no-wrap
msgid "`mpo_check_vnode_mmap`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4273
#, no-wrap
msgid ""
"int mpo_check_vnode_mmap(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4288
#, no-wrap
msgid "Vnode to map"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4295
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4330
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4361
#, no-wrap
msgid "`prot`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4296
#, no-wrap
msgid "Mmap protections (see man:mmap[2])"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4300
msgid ""
"Determine whether the subject should be allowed to map the vnode `vp` with "
"the protections specified in `prot`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4302
#, no-wrap
msgid "`mpo_check_vnode_mmap_downgrade`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4308
#, no-wrap
msgid ""
"void mpo_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int *prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4319
#, no-wrap
msgid "See crossref:mac[mac-mpo-check-vnode-mmap, `mpo_check_vnode_mmap`]."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4331
#, no-wrap
msgid "Mmap protections to be downgraded"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4335
msgid "Downgrade the mmap protections based on the subject and object labels."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4337
#, no-wrap
msgid "`mpo_check_vnode_mprotect`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4343
#, no-wrap
msgid ""
"int mpo_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4358
#, no-wrap
msgid "Mapped vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4362
#, no-wrap
msgid "Memory protections"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4366
msgid ""
"Determine whether the subject should be allowed to set the specified memory "
"protections on memory mapped from the vnode `vp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4368
#, no-wrap
msgid "`mpo_check_vnode_poll`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4374
#, no-wrap
msgid ""
"int mpo_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,\n"
"    struct vnode *vp, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4384
#, no-wrap
msgid "`active_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4388
#, no-wrap
msgid "`file_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4389
#, no-wrap
msgid "Credential associated with the struct file"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4393
#, no-wrap
msgid "Polled vnode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4401
msgid "Determine whether the subject should be allowed to poll the vnode `vp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4403
#, no-wrap
msgid "`mpo_check_vnode_rename_from`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4410
#, no-wrap
msgid ""
"int mpo_vnode_rename_from(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4433
#, no-wrap
msgid "Vnode to be renamed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4445
msgid ""
"Determine whether the subject should be allowed to rename the vnode `vp` to "
"something else."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4447
#, no-wrap
msgid "`mpo_check_vnode_rename_to`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4454
#, no-wrap
msgid ""
"int mpo_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label, int samedir,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4477
#, no-wrap
msgid "Overwritten vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4484
#, no-wrap
msgid "`samedir`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4485
#, no-wrap
msgid "Boolean; `1` if the source and destination directories are the same"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4489
#, no-wrap
msgid "Destination component name"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4494
msgid ""
"Determine whether the subject should be allowed to rename to the vnode `vp`, "
"into the directory `dvp`, or to the name represented by `cnp`.  If there is "
"no existing file to overwrite, `vp` and `label` will be NULL."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4496
#, no-wrap
msgid "`mpo_check_socket_listen`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4502
#, no-wrap
msgid ""
"int mpo_check_socket_listen(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4527
msgid ""
"Determine whether the subject credential can listen on the passed socket.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4529
#, no-wrap
msgid "`mpo_check_vnode_lookup`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4535
#, no-wrap
msgid ""
"int mpo_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4558
#, no-wrap
msgid "Component name being looked up"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4564
msgid ""
"Determine whether the subject credential can perform a lookup in the passed "
"directory vnode for the passed name.  Return 0 for success, or an `errno` "
"value for failure.  Suggested failure: EACCES for label mismatch, or EPERM "
"for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4566
#, no-wrap
msgid "`mpo_check_vnode_open`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4572
#, no-wrap
msgid ""
"int mpo_check_vnode_open(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int acc_mode);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4594
#, no-wrap
msgid "`acc_mode`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4595
#, no-wrap
msgid "man:open[2] access mode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4601
msgid ""
"Determine whether the subject credential can perform an open operation on "
"the passed vnode with the passed access mode.  Return 0 for success, or an "
"errno value for failure.  Suggested failure: EACCES for label mismatch, or "
"EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4603
#, no-wrap
msgid "`mpo_check_vnode_readdir`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4609
#, no-wrap
msgid ""
"int mpo_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4624
#, no-wrap
msgid "Object; directory vnode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4634
msgid ""
"Determine whether the subject credential can perform a `readdir` operation "
"on the passed directory vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4636
#, no-wrap
msgid "`mpo_check_vnode_readlink`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4642
#, no-wrap
msgid ""
"int mpo_check_vnode_readlink(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4668
msgid ""
"Determine whether the subject credential can perform a `readlink` operation "
"on the passed symlink vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege.  This call may be made in a number of situations, including an "
"explicit `readlink` call by the user process, or as a result of an implicit "
"`readlink` during a name lookup by the process."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4670
#, no-wrap
msgid "`mpo_check_vnode_revoke`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4676
#, no-wrap
msgid ""
"int mpo_check_vnode_revoke(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4701
msgid ""
"Determine whether the subject credential can revoke access to the passed "
"vnode.  Return 0 for success, or an `errno` value for failure.  Suggested "
"failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4703
#, no-wrap
msgid "`mpo_check_vnode_setacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4709
#, no-wrap
msgid ""
"int mpo_check_vnode_setacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type, struct acl *acl);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4735
#, no-wrap
msgid "`acl`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4736
#, no-wrap
msgid "ACL"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4742
msgid ""
"Determine whether the subject credential can set the passed ACL of passed "
"type on the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4744
#, no-wrap
msgid "`mpo_check_vnode_setextattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4750
#, no-wrap
msgid ""
"int mpo_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int attrnamespace, const char *name, struct uio *uio);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4790
msgid ""
"Determine whether the subject credential can set the extended attribute of "
"passed name and passed namespace on the passed vnode.  Policies implementing "
"security labels backed into extended attributes may want to provide "
"additional protections for those attributes.  Additionally, policies should "
"avoid making decisions based on the data referenced from `uio`, as there is "
"a potential race condition between this check and the actual operation.  The "
"`uio` may also be `NULL` if a delete operation is being performed.  Return 0 "
"for success, or an `errno` value for failure.  Suggested failure: EACCES for "
"label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4792
#, no-wrap
msgid "`mpo_check_vnode_setflags`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4798
#, no-wrap
msgid ""
"int mpo_check_vnode_setflags(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, u_long flags);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4821
#, no-wrap
msgid "File flags; see man:chflags[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4827
msgid ""
"Determine whether the subject credential can set the passed flags on the "
"passed vnode.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4829
#, no-wrap
msgid "`mpo_check_vnode_setmode`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4835
#, no-wrap
msgid ""
"int mpo_check_vnode_setmode(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, mode_t mode);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4857
#, no-wrap
msgid "`mode`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4858
#, no-wrap
msgid "File mode; see man:chmod[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4864
msgid ""
"Determine whether the subject credential can set the passed mode on the "
"passed vnode.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4866
#, no-wrap
msgid "`mpo_check_vnode_setowner`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4872
#, no-wrap
msgid ""
"int mpo_check_vnode_setowner(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, uid_t uid, gid_t gid);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4894
#, no-wrap
msgid "`uid`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4895
#, no-wrap
msgid "User ID"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4898
#, no-wrap
msgid "`gid`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4899
#, no-wrap
msgid "Group ID"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4906
msgid ""
"Determine whether the subject credential can set the passed uid and passed "
"gid as file uid and file gid on the passed vnode.  The IDs may be set to "
"(`-1`) to request no update.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4908
#, no-wrap
msgid "`mpo_check_vnode_setutimes`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4914
#, no-wrap
msgid ""
"int mpo_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, struct timespec atime, struct timespec mtime);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4929
#, no-wrap
msgid "Object; vp"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4936
#, no-wrap
msgid "`atime`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4937
#, no-wrap
msgid "Access time; see man:utimes[2]"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4940
#, no-wrap
msgid "`mtime`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4941
#, no-wrap
msgid "Modification time; see man:utimes[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4947
msgid ""
"Determine whether the subject credential can set the passed access "
"timestamps on the passed vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4949
#, no-wrap
msgid "`mpo_check_proc_sched`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4954
#, no-wrap
msgid "int mpo_check_proc_sched(struct ucred *ucred, struct proc *proc);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4975
msgid ""
"Determine whether the subject credential can change the scheduling "
"parameters of the passed process.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, EPERM for lack "
"of privilege, or ESRCH to limit visibility."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4977
msgid "See man:setpriority[2] for more information."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4979
#, no-wrap
msgid "`mpo_check_proc_signal`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4984
#, no-wrap
msgid "int mpo_check_proc_signal(struct ucred *cred, struct proc *proc, int signal);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5002
#, no-wrap
msgid "`signal`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5003
#, no-wrap
msgid "Signal; see man:kill[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5009
msgid ""
"Determine whether the subject credential can deliver the passed signal to "
"the passed process.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, EPERM for lack of privilege, "
"or ESRCH to limit visibility."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5011
#, no-wrap
msgid "`mpo_check_vnode_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5017
#, no-wrap
msgid ""
"int mpo_check_vnode_stat(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5042
msgid ""
"Determine whether the subject credential can `stat` the passed vnode.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5044
msgid "See man:stat[2] for more information."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5046
#, no-wrap
msgid "`mpo_check_ifnet_transmit`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5052
#, no-wrap
msgid ""
"int mpo_check_ifnet_transmit(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5075
#, no-wrap
msgid "Object; mbuf to be sent"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5085
msgid ""
"Determine whether the network interface can transmit the passed mbuf.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5087
#, no-wrap
msgid "`mpo_check_socket_deliver`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5093
#, no-wrap
msgid ""
"int mpo_check_socket_deliver(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5116
#, no-wrap
msgid "Object; mbuf to be delivered"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5126
msgid ""
"Determine whether the socket may receive the datagram stored in the passed "
"mbuf header.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failures: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5134
#, no-wrap
msgid ""
"int mpo_check_socket_visible(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5153
#, no-wrap
msgid "Policy label for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5159
msgid ""
"Determine whether the subject credential cred can \"see\" the passed socket "
"(`socket`) using system monitoring functions, such as those employed by "
"man:netstat[8] and man:sockstat[1].  Return 0 for success, or an `errno` "
"value for failure.  Suggested failure: EACCES for label mismatches, EPERM "
"for lack of privilege, or ESRCH to hide visibility."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5161
#, no-wrap
msgid "`mpo_check_system_acct`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5167
#, no-wrap
msgid ""
"int mpo_check_system_acct(struct ucred *ucred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5177
#, no-wrap
msgid "`ucred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5182
#, no-wrap
msgid "Accounting file; man:acct[5]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5190
msgid ""
"Determine whether the subject should be allowed to enable accounting, based "
"on its label and the label of the accounting log file."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5192
#, no-wrap
msgid "`mpo_check_system_nfsd`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5197
#, no-wrap
msgid "int mpo_check_system_nfsd(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5212
msgid "Determine whether the subject should be allowed to call man:nfssvc[2]."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5214
#, no-wrap
msgid "`mpo_check_system_reboot`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5219
#, no-wrap
msgid "int mpo_check_system_reboot(struct ucred *cred, int howto);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5233
#, no-wrap
msgid "`howto`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5234
#, no-wrap
msgid "`howto` parameter from man:reboot[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5238
msgid ""
"Determine whether the subject should be allowed to reboot the system in the "
"specified manner."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5240
#, no-wrap
msgid "`mpo_check_system_settime`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5245
#, no-wrap
msgid "int mpo_check_system_settime(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5260
msgid "Determine whether the user should be allowed to set the system clock."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5262
#, no-wrap
msgid "`mpo_check_system_swapon`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5268
#, no-wrap
msgid ""
"int mpo_check_system_swapon(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5283
#, no-wrap
msgid "Swap device"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5291
msgid ""
"Determine whether the subject should be allowed to add `vp` as a swap device."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5293
#, no-wrap
msgid "`mpo_check_system_sysctl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5299
#, no-wrap
msgid ""
"int mpo_check_system_sysctl(struct ucred *cred, int *name, u_int *namelen,\n"
"    void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5314
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5334
#, no-wrap
msgid "See man:sysctl[3]"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5325
#, no-wrap
msgid "`oldlenp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5329
#, no-wrap
msgid "`inkernel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5330
#, no-wrap
msgid "Boolean; `1` if called from kernel"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5337
#, no-wrap
msgid "`newlen`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5342
msgid ""
"Determine whether the subject should be allowed to make the specified "
"man:sysctl[3] transaction."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5344
#, no-wrap
msgid "Label Management Calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5350
msgid ""
"Relabel events occur when a user process has requested that the label on an "
"object be modified.  A two-phase update occurs: first, an access control "
"check will be performed to determine if the update is both valid and "
"permitted, and then the update itself is performed via a separate entry "
"point.  Relabel entry points typically accept the object, object label "
"reference, and an update label submitted by the process.  Memory allocation "
"during relabel is discouraged, as relabel calls are not permitted to fail "
"(failure should be reported earlier in the relabel check)."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5352
#, no-wrap
msgid "Userland Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5356
msgid ""
"The TrustedBSD MAC Framework includes a number of policy-agnostic elements, "
"including MAC library interfaces for abstractly managing labels, "
"modifications to the system credential management and login libraries to "
"support the assignment of MAC labels to users, and a set of tools to monitor "
"and modify labels on processes, files, and network interfaces.  More details "
"on the user architecture will be added to this section in the near future."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5358
#, no-wrap
msgid "APIs for Policy-Agnostic Label Management"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5365
msgid ""
"The TrustedBSD MAC Framework provides a number of library and system calls "
"permitting applications to manage MAC labels on objects using a policy-"
"agnostic interface.  This permits applications to manipulate labels for a "
"variety of policies without being written to support specific policies.  "
"These interfaces are used by general-purpose tools such as man:ifconfig[8], "
"man:ls[1] and man:ps[1] to view labels on network interfaces, files, and "
"processes.  The APIs also support MAC management tools including "
"man:getfmac[8], man:getpmac[8], man:setfmac[8], man:setfsmac[8], and "
"man:setpmac[8].  The MAC APIs are documented in man:mac[3]."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5373
msgid ""
"Applications handle MAC labels in two forms: an internalized form used to "
"return and set labels on processes and objects (`mac_t`), and externalized "
"form based on C strings appropriate for storage in configuration files, "
"display to the user, or input from the user.  Each MAC label contains a "
"number of elements, each consisting of a name and value pair.  Policy "
"modules in the kernel bind to specific names and interpret the values in "
"policy-specific ways.  In the externalized string form, labels are "
"represented by a comma-delimited list of name and value pairs separated by "
"the `/` character.  Labels may be directly converted to and from text using "
"provided APIs; when retrieving labels from the kernel, internalized label "
"storage must first be prepared for the desired label element set.  "
"Typically, this is done in one of two ways: using man:mac_prepare[3] and an "
"arbitrary list of desired label elements, or one of the variants of the call "
"that loads a default element set from the man:mac.conf[5] configuration "
"file.  Per-object defaults permit application writers to usefully display "
"labels associated with objects without being aware of the policies present "
"in the system."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5378
msgid ""
"Currently, direct manipulation of label elements other than by conversion to "
"a text string, string editing, and conversion back to an internalized label "
"is not supported by the MAC library.  Such interfaces may be added in the "
"future if they prove necessary for application writers."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5381
#, no-wrap
msgid "Binding of Labels to Users"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5385
msgid ""
"The standard user context management interface, man:setusercontext[3], has "
"been modified to retrieve MAC labels associated with a user's class from "
"man:login.conf[5].  These labels are then set along with other user context "
"when either `LOGIN_SETALL` is specified, or when `LOGIN_SETMAC` is "
"explicitly specified."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5390
msgid ""
"It is expected that, in a future version of FreeBSD, the MAC label database "
"will be separated from the [.filename]#login.conf# user class abstraction, "
"and be maintained in a separate database.  However, the "
"man:setusercontext[3] API should remain the same following such a change."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5393
#, no-wrap
msgid "Conclusion"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5398
msgid ""
"The TrustedBSD MAC framework permits kernel modules to augment the system "
"security policy in a highly integrated manner.  They may do this based on "
"existing object properties, or based on label data that is maintained with "
"the assistance of the MAC framework.  The framework is sufficiently flexible "
"to implement a variety of policy types, including information flow security "
"policies such as MLS and Biba, as well as policies based on existing BSD "
"credentials or file protections.  Policy authors may wish to consult this "
"documentation as well as existing security modules when implementing a new "
"security service."
msgstr ""