diff --git a/sys/nfsserver/nfs_srvsock.c b/sys/nfsserver/nfs_srvsock.c
index 805c5ca4e521..5721b39e0f85 100644
--- a/sys/nfsserver/nfs_srvsock.c
+++ b/sys/nfsserver/nfs_srvsock.c
@@ -369,6 +369,9 @@ nfs_getreq(struct nfsrv_descript *nd, struct nfsd *nfsd, int has_header)
 		    nd->nd_cr->cr_svuid = fxdr_unsigned(uid_t, *tl++);
 		nd->nd_cr->cr_groups[0] = nd->nd_cr->cr_rgid =
 		    nd->nd_cr->cr_svgid = fxdr_unsigned(gid_t, *tl++);
+#ifdef MAC
+		mac_associate_nfsd_label(nd->nd_cr);
+#endif
 		len = fxdr_unsigned(int, *tl);
 		if (len < 0 || len > RPCAUTH_UNIXGIDS) {
 			m_freem(mrep);
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 65d879dca1a2..f1b6fe06b617 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -463,6 +463,7 @@ int	mac_setsockopt_label(struct ucred *cred, struct socket *so,
 int	mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
 	    struct label *label);
 void	mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
+void	mac_associate_nfsd_label(struct ucred *cred);
 
 /*
  * Calls to help various file systems implement labeling functionality
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 8573805c8178..fe0fa7c01670 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -599,6 +599,7 @@ struct mac_policy_ops {
 	int	(*mpo_check_vnode_write)(struct ucred *active_cred,
 		    struct ucred *file_cred, struct vnode *vp,
 		    struct label *label);
+	void	(*mpo_associate_nfsd_label)(struct ucred *cred);
 };
 
 /*
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 59aa61bc792d..c9ed9ccaf370 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -1028,3 +1028,10 @@ vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
 
 	return (0);
 }
+
+void
+mac_associate_nfsd_label(struct ucred *cred)
+{
+
+	MAC_PERFORM(associate_nfsd_label, cred);
+}
diff --git a/sys/sys/mac.h b/sys/sys/mac.h
index 65d879dca1a2..f1b6fe06b617 100644
--- a/sys/sys/mac.h
+++ b/sys/sys/mac.h
@@ -463,6 +463,7 @@ int	mac_setsockopt_label(struct ucred *cred, struct socket *so,
 int	mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
 	    struct label *label);
 void	mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
+void	mac_associate_nfsd_label(struct ucred *cred);
 
 /*
  * Calls to help various file systems implement labeling functionality
diff --git a/sys/sys/mac_policy.h b/sys/sys/mac_policy.h
index 8573805c8178..fe0fa7c01670 100644
--- a/sys/sys/mac_policy.h
+++ b/sys/sys/mac_policy.h
@@ -599,6 +599,7 @@ struct mac_policy_ops {
 	int	(*mpo_check_vnode_write)(struct ucred *active_cred,
 		    struct ucred *file_cred, struct vnode *vp,
 		    struct label *label);
+	void	(*mpo_associate_nfsd_label)(struct ucred *cred);
 };
 
 /*