First, remove process_checkioperm() calls from MD code. Similar checks using kauth(9) routines (on the process scope, using appropriate action) are done in the callers. Add secmodel back-end to handle each subsystem.