From 3ad3d9c5ef2ef66ac2a019662eaadcb30d7c9044 Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Wed, 3 Jun 2009 19:41:12 +0000
Subject: [PATCH] Add one further check with mac_policy_count to an mbuf
 copying case (limited to netatalk) to avoid MAC label lookup on both mbufs if
 no policies are registered.

Obtained from:	TrustedBSD Project
---
 sys/security/mac/mac_net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 73154148b9a7..ed3388573bd7 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -258,6 +258,9 @@ mac_mbuf_copy(struct mbuf *m_from, struct mbuf *m_to)
 {
 	struct label *src_label, *dest_label;
 
+	if (mac_policy_count == 0)
+		return;
+
 	src_label = mac_mbuf_to_label(m_from);
 	dest_label = mac_mbuf_to_label(m_to);