106  * rules match).
111     "Disable/enable match first rule functionality");
228 	int mac_granted, match, priv_granted;  in ugidfw_rulecheck()  local
232 	 * Is there a subject match?  in ugidfw_rulecheck()
236 		match =  ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max &&  in ugidfw_rulecheck()
243 			match = !match;  in ugidfw_rulecheck()
244 		if (!match)  in ugidfw_rulecheck()
249 		match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&  in ugidfw_rulecheck()
253 		if (!match) {  in ugidfw_rulecheck()
259 					match = 1;  in ugidfw_rulecheck()
265 			match = !match;  in ugidfw_rulecheck()
266 		if (!match)  in ugidfw_rulecheck()
271 		match =  in ugidfw_rulecheck()
274 			match = !match;  in ugidfw_rulecheck()
275 		if (!match)  in ugidfw_rulecheck()
280 	 * Is there an object match?  in ugidfw_rulecheck()
283 		match = (vap->va_uid <= rule->mbr_object.mbo_uid_max &&  in ugidfw_rulecheck()
286 			match = !match;  in ugidfw_rulecheck()
287 		if (!match)  in ugidfw_rulecheck()
292 		match = (vap->va_gid <= rule->mbr_object.mbo_gid_max &&  in ugidfw_rulecheck()
295 			match = !match;  in ugidfw_rulecheck()
296 		if (!match)  in ugidfw_rulecheck()
301 		match = (fsidcmp(&vp->v_mount->mnt_stat.f_fsid,  in ugidfw_rulecheck()
304 			match = !match;  in ugidfw_rulecheck()
305 		if (!match)  in ugidfw_rulecheck()
310 		match = (vap->va_mode & S_ISUID);  in ugidfw_rulecheck()
312 			match = !match;  in ugidfw_rulecheck()
313 		if (!match)  in ugidfw_rulecheck()
318 		match = (vap->va_mode & S_ISGID);  in ugidfw_rulecheck()
320 			match = !match;  in ugidfw_rulecheck()
321 		if (!match)  in ugidfw_rulecheck()
326 		match = (vap->va_uid == cred->cr_uid ||  in ugidfw_rulecheck()
330 			match = !match;  in ugidfw_rulecheck()
331 		if (!match)  in ugidfw_rulecheck()
336 		match = (groupmember(vap->va_gid, cred) ||  in ugidfw_rulecheck()
340 			match = !match;  in ugidfw_rulecheck()
341 		if (!match)  in ugidfw_rulecheck()
348 			match = (rule->mbr_object.mbo_type & MBO_TYPE_REG);  in ugidfw_rulecheck()
351 			match = (rule->mbr_object.mbo_type & MBO_TYPE_DIR);  in ugidfw_rulecheck()
354 			match = (rule->mbr_object.mbo_type & MBO_TYPE_BLK);  in ugidfw_rulecheck()
357 			match = (rule->mbr_object.mbo_type & MBO_TYPE_CHR);  in ugidfw_rulecheck()
360 			match = (rule->mbr_object.mbo_type & MBO_TYPE_LNK);  in ugidfw_rulecheck()
363 			match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK);  in ugidfw_rulecheck()
366 			match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO);  in ugidfw_rulecheck()
369 			match = 0;  in ugidfw_rulecheck()
372 			match = !match;  in ugidfw_rulecheck()
373 		if (!match)  in ugidfw_rulecheck()
411 	 * If the rule matched, permits access, and first match is enabled,  in ugidfw_rulecheck()