diff --git a/sys/security/mac/mac_inet.c b/sys/security/mac/mac_inet.c
index fe06dcaf3f97..b1d8df23615f 100644
--- a/sys/security/mac/mac_inet.c
+++ b/sys/security/mac/mac_inet.c
@@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/mount.h>
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 791dc67970c4..a16ac6bea3f8 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -43,6 +43,10 @@
 #ifndef _SYS_SECURITY_MAC_MAC_INTERNAL_H_
 #define	_SYS_SECURITY_MAC_MAC_INTERNAL_H_
 
+#ifndef _KERNEL
+#error "no user-serviceable parts inside"
+#endif
+
 /*
  * MAC Framework sysctl namespace.
  */
diff --git a/sys/security/mac/mac_label.c b/sys/security/mac/mac_label.c
index 619df355729a..977efc7d5692 100644
--- a/sys/security/mac/mac_label.c
+++ b/sys/security/mac/mac_label.c
@@ -35,7 +35,6 @@ __FBSDID("$FreeBSD$");
 #include "opt_mac.h"
 
 #include <sys/param.h>
-#include <sys/mac.h>
 #include <sys/sysctl.h>
 #include <sys/systm.h>
 
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 02860a4d4e7a..88d181e899c8 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index d5dd9eb280b0..750218f32aca 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -43,6 +43,12 @@
 #ifndef _SYS_SECURITY_MAC_MAC_POLICY_H_
 #define	_SYS_SECURITY_MAC_MAC_POLICY_H_
 
+#ifndef _KERNEL
+#error "no user-serviceable parts inside"
+#endif
+
+#include <sys/_label.h>
+
 /*-
  * Pluggable access control policy definition structure.
  *
diff --git a/sys/security/mac/mac_posix_sem.c b/sys/security/mac/mac_posix_sem.c
index ba4d191e2108..a00a30e1e376 100644
--- a/sys/security/mac/mac_posix_sem.c
+++ b/sys/security/mac/mac_posix_sem.c
@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/ksem.h>
 #include <sys/malloc.h>
-#include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/systm.h>
 #include <sys/sysctl.h>
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 6c95d3b6ce01..32a9b79b78b5 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/sysctl.h>
diff --git a/sys/security/mac/mac_sysv_msg.c b/sys/security/mac/mac_sysv_msg.c
index 5044157890dc..054614b1b48b 100644
--- a/sys/security/mac/mac_sysv_msg.c
+++ b/sys/security/mac/mac_sysv_msg.c
@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
diff --git a/sys/security/mac/mac_sysv_sem.c b/sys/security/mac/mac_sysv_sem.c
index 8e981a7dfc78..e77331e8f4d3 100644
--- a/sys/security/mac/mac_sysv_sem.c
+++ b/sys/security/mac/mac_sysv_sem.c
@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
diff --git a/sys/security/mac/mac_sysv_shm.c b/sys/security/mac/mac_sysv_shm.c
index 66940c9150e3..6cabeb42397e 100644
--- a/sys/security/mac/mac_sysv_shm.c
+++ b/sys/security/mac/mac_sysv_shm.c
@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 038ac80e1efc..9196779cb28a 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -51,7 +51,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/proc.h>
 #include <sys/sbuf.h>
 #include <sys/systm.h>
diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c
index 490b66042451..21e2096cc648 100644
--- a/sys/security/mac_biba/mac_biba.c
+++ b/sys/security/mac_biba/mac_biba.c
@@ -46,7 +46,6 @@
 #include <sys/extattr.h>
 #include <sys/kernel.h>
 #include <sys/ksem.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c
index 8ed58d20f16e..2ebf9b86dcca 100644
--- a/sys/security/mac_bsdextended/mac_bsdextended.c
+++ b/sys/security/mac_bsdextended/mac_bsdextended.c
@@ -49,7 +49,6 @@
 #include <sys/kernel.h>
 #include <sys/jail.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
diff --git a/sys/security/mac_ifoff/mac_ifoff.c b/sys/security/mac_ifoff/mac_ifoff.c
index 4814db2ad889..6658fccb1b81 100644
--- a/sys/security/mac_ifoff/mac_ifoff.c
+++ b/sys/security/mac_ifoff/mac_ifoff.c
@@ -45,7 +45,6 @@
 #include <sys/param.h>
 #include <sys/conf.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index daa4e24eb087..2e3ca265718b 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -46,7 +46,6 @@
 #include <sys/extattr.h>
 #include <sys/kernel.h>
 #include <sys/ksem.h>
-#include <sys/mac.h>
 #include <sys/mman.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
diff --git a/sys/security/mac_none/mac_none.c b/sys/security/mac_none/mac_none.c
index 922a021ae514..76a4bec8f295 100644
--- a/sys/security/mac_none/mac_none.c
+++ b/sys/security/mac_none/mac_none.c
@@ -48,7 +48,6 @@
 #include <sys/conf.h>
 #include <sys/extattr.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
diff --git a/sys/security/mac_partition/mac_partition.c b/sys/security/mac_partition/mac_partition.c
index 75d62b11b17f..1b282e88a989 100644
--- a/sys/security/mac_partition/mac_partition.c
+++ b/sys/security/mac_partition/mac_partition.c
@@ -43,7 +43,6 @@
 #include <sys/param.h>
 #include <sys/conf.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/priv.h>
 #include <sys/proc.h>
diff --git a/sys/security/mac_portacl/mac_portacl.c b/sys/security/mac_portacl/mac_portacl.c
index 4277ad5319c2..713b314ce492 100644
--- a/sys/security/mac_portacl/mac_portacl.c
+++ b/sys/security/mac_portacl/mac_portacl.c
@@ -62,7 +62,6 @@
 #include <sys/kernel.h>
 #include <sys/libkern.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
diff --git a/sys/security/mac_seeotheruids/mac_seeotheruids.c b/sys/security/mac_seeotheruids/mac_seeotheruids.c
index 39d60db987ad..62ccd619739a 100644
--- a/sys/security/mac_seeotheruids/mac_seeotheruids.c
+++ b/sys/security/mac_seeotheruids/mac_seeotheruids.c
@@ -44,7 +44,6 @@
 #include <sys/param.h>
 #include <sys/conf.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/priv.h>
 #include <sys/proc.h>
diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c
index af84561637f1..e80da04026ce 100644
--- a/sys/security/mac_stub/mac_stub.c
+++ b/sys/security/mac_stub/mac_stub.c
@@ -52,7 +52,6 @@
 #include <sys/extattr.h>
 #include <sys/kernel.h>
 #include <sys/ksem.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c
index b0bd07eaffd4..803b882f7de2 100644
--- a/sys/security/mac_test/mac_test.c
+++ b/sys/security/mac_test/mac_test.c
@@ -47,7 +47,6 @@
 #include <sys/extattr.h>
 #include <sys/kernel.h>
 #include <sys/ksem.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
diff --git a/sys/sys/mac.h b/sys/sys/mac.h
index 56ab0a9ab1e7..96fd348372e8 100644
--- a/sys/sys/mac.h
+++ b/sys/sys/mac.h
@@ -47,8 +47,6 @@
 #ifndef _SYS_MAC_H_
 #define	_SYS_MAC_H_
 
-#include <sys/_label.h>
-
 #ifndef _POSIX_MAC
 #define	_POSIX_MAC
 #endif