Function mls_vnode_check_exec

freebsd/security/mac_mls/mac_mls.c:2596–2626

}

static int
mls_vnode_check_exec(struct ucred *cred, struct vnode *vp,
    struct label *vplabel, struct image_params *imgp,
    struct label *execlabel)
{
	struct mac_mls *subj, *obj, *exec;
	int error;

	if (execlabel != NULL) {
		/*
		 * We currently don't permit labels to be changed at
		 * exec-time as part of MLS, so disallow non-NULL MLS label
		 * elements in the execlabel.
		 */
		exec = SLOT(execlabel);
		error = mls_atmostflags(exec, 0);
		if (error)
			return (error);
	}

	if (!mls_enabled)
		return (0);

	subj = SLOT(cred->cr_label);
	obj = SLOT(vplabel);

	if (!mls_dominate_effective(subj, obj))
		return (EACCES);

	return (0);
}

static int
mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp,