diff --git a/lib/libkvm/kvm_proc.c b/lib/libkvm/kvm_proc.c
index bacc3a4a8b3..8bf205b13ce 100644
--- a/lib/libkvm/kvm_proc.c
+++ b/lib/libkvm/kvm_proc.c
@@ -52,9 +52,8 @@ static char sccsid[] = "@(#)kvm_proc.c	8.3 (Berkeley) 9/23/93";
  */
 
 #include <sys/param.h>
-#define _KERNEL
+#define _WANT_UCRED	/* make ucred.h give us 'struct ucred' */
 #include <sys/ucred.h>
-#undef _KERNEL
 #include <sys/user.h>
 #include <sys/proc.h>
 #include <sys/exec.h>
diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h
index 60b5bd60271..3f970def678 100644
--- a/sys/sys/ucred.h
+++ b/sys/sys/ucred.h
@@ -37,19 +37,15 @@
 #ifndef _SYS_UCRED_H_
 #define	_SYS_UCRED_H_
 
-/*
- * XXXMAC: this recursive include could be #ifdef _KERNEL if struct
- * ucred could also be #ifdef _KERNEL.
- */
-#include <sys/_label.h>
-
 /*
  * Credentials.
  *
  * Please do not inspect cr_uid directly to determine superuserness.
  * Only the suser() or suser_cred() function should be used for this.
  */
-#ifdef _KERNEL
+#if defined(_KERNEL) || defined(_WANT_UCRED)
+#include <sys/_label.h>
+
 struct ucred {
 	u_int	cr_ref;			/* reference count */
 #define	cr_startcopy cr_uid
@@ -69,7 +65,7 @@ struct ucred {
 };
 #define	NOCRED	((struct ucred *)0)	/* no credential available */
 #define	FSCRED	((struct ucred *)-1)	/* filesystem credential */
-#endif /* _KERNEL */
+#endif /* _KERNEL || _WANT_UCRED */
 
 /*
  * This is the external representation of struct ucred.