The
mac_set_file()
and
mac_set_fd()
functions associate a MAC label
specified by
label
to the file referenced to by
path_p,
or to the file descriptor
fd,
respectively.
Note that when a file descriptor references a socket, label operations
on the file descriptor act on the socket, not on the file that may
have been used as a rendezvous when binding the socket.
The
mac_set_link()
function is the same as
mac_set_file(),
except that it does not follow symlinks.
The
mac_set_proc()
function associates the MAC label
specified by
label
to the calling process.
A process is allowed to set a label for a file
only if it has MAC write access to the file,
and its effective user ID is equal to
the owner of the file,
or has appropriate privileges.