Require MAC labels to be non-zero in length.

[markj]

Summary

In MAC_POLICY_EXTERNALIZE, the buffer length is used to create a
fixed-size sbuf. When creating such an sbuf, the code has a minimum
buffer size of 2. Thus, filter smaller buffers out when performing
validation.

Test Plan

Peter found the bug while doing syscall fuzz testing.

https://people.freebsd.org/~pho/stress/log/mark051.txt

[emaste]

I dislike the magic 2 without a comment or #define

[markj]

Add a comment and compare with 1 instead of 2.

[delphij]

sys/security/mac/mac_framework.c

590

LGTM as-is. If I was you I'd probably use sizeof("") in place of 1 because it would imply that the buffer would hold a nul-terminated string.