15 files changed, 193 insertions, 88 deletions

diff --git a/security/inode.c b/security/inode.c
index acc6cf0d7900..ca4958ebad8d 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -190,7 +190,7 @@ static int create_by_name(const char *name, mode_t mode,
  * @name: a pointer to a string containing the name of the file to create.
  * @mode: the permission that the file should have
  * @parent: a pointer to the parent dentry for this file.  This should be a
- *          directory dentry if set.  If this paramater is NULL, then the
+ *          directory dentry if set.  If this parameter is %NULL, then the
  *          file will be created in the root of the securityfs filesystem.
  * @data: a pointer to something that the caller will want to get to later
  *        on.  The inode.i_private pointer will point to this value on
@@ -199,18 +199,18 @@ static int create_by_name(const char *name, mode_t mode,
  *        this file.
  *
  * This is the basic "create a file" function for securityfs.  It allows for a
- * wide range of flexibility in createing a file, or a directory (if you
+ * wide range of flexibility in creating a file, or a directory (if you
  * want to create a directory, the securityfs_create_dir() function is
- * recommended to be used instead.)
+ * recommended to be used instead).
  *
- * This function will return a pointer to a dentry if it succeeds.  This
+ * This function returns a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the securityfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, NULL will be returned.
+ * you are responsible here).  If an error occurs, %NULL is returned.
  *
- * If securityfs is not enabled in the kernel, the value -ENODEV will be
+ * If securityfs is not enabled in the kernel, the value %-ENODEV is
  * returned.  It is not wise to check for this value, but rather, check for
- * NULL or !NULL instead as to eliminate the need for #ifdef in the calling
+ * %NULL or !%NULL instead as to eliminate the need for #ifdef in the calling
  * code.
  */
 struct dentry *securityfs_create_file(const char *name, mode_t mode,
@@ -252,19 +252,19 @@ EXPORT_SYMBOL_GPL(securityfs_create_file);
  * @name: a pointer to a string containing the name of the directory to
  *        create.
  * @parent: a pointer to the parent dentry for this file.  This should be a
- *          directory dentry if set.  If this paramater is NULL, then the
+ *          directory dentry if set.  If this parameter is %NULL, then the
  *          directory will be created in the root of the securityfs filesystem.
  *
- * This function creates a directory in securityfs with the given name.
+ * This function creates a directory in securityfs with the given @name.
  *
- * This function will return a pointer to a dentry if it succeeds.  This
+ * This function returns a pointer to a dentry if it succeeds.  This
  * pointer must be passed to the securityfs_remove() function when the file is
  * to be removed (no automatic cleanup happens if your module is unloaded,
- * you are responsible here.)  If an error occurs, NULL will be returned.
+ * you are responsible here).  If an error occurs, %NULL will be returned.
  *
- * If securityfs is not enabled in the kernel, the value -ENODEV will be
+ * If securityfs is not enabled in the kernel, the value %-ENODEV is
  * returned.  It is not wise to check for this value, but rather, check for
- * NULL or !NULL instead as to eliminate the need for #ifdef in the calling
+ * %NULL or !%NULL instead as to eliminate the need for #ifdef in the calling
  * code.
  */
 struct dentry *securityfs_create_dir(const char *name, struct dentry *parent)
@@ -278,16 +278,15 @@ EXPORT_SYMBOL_GPL(securityfs_create_dir);
 /**
  * securityfs_remove - removes a file or directory from the securityfs filesystem
  *
- * @dentry: a pointer to a the dentry of the file or directory to be
- *          removed.
+ * @dentry: a pointer to a the dentry of the file or directory to be removed.
  *
  * This function removes a file or directory in securityfs that was previously
  * created with a call to another securityfs function (like
  * securityfs_create_file() or variants thereof.)
  *
  * This function is required to be called in order for the file to be
- * removed, no automatic cleanup of files will happen when a module is
- * removed, you are responsible here.
+ * removed. No automatic cleanup of files will happen when a module is
+ * removed; you are responsible here.
  */
 void securityfs_remove(struct dentry *dentry)
 {
diff --git a/security/security.c b/security/security.c
index 3a4b4f55b33f..255b08559b2b 100644
--- a/security/security.c
+++ b/security/security.c
@@ -82,8 +82,8 @@ __setup("security=", choose_lsm);
  *
  * Return true if:
  *      -The passed LSM is the one chosen by user at boot time,
- *      -or user didsn't specify a specific LSM and we're the first to ask
- *       for registeration permissoin,
+ *      -or user didn't specify a specific LSM and we're the first to ask
+ *       for registration permission,
  *      -or the passed LSM is currently loaded.
  * Otherwise, return false.
  */
@@ -101,13 +101,13 @@ int __init security_module_enable(struct security_operations *ops)
  * register_security - registers a security framework with the kernel
  * @ops: a pointer to the struct security_options that is to be registered
  *
- * This function is to allow a security module to register itself with the
+ * This function allows a security module to register itself with the
  * kernel security subsystem.  Some rudimentary checking is done on the @ops
  * value passed to this function. You'll need to check first if your LSM
  * is allowed to register its @ops by calling security_module_enable(@ops).
  *
  * If there is already a security module registered with the kernel,
- * an error will be returned.  Otherwise 0 is returned on success.
+ * an error will be returned.  Otherwise %0 is returned on success.
  */
 int register_security(struct security_operations *ops)
 {
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 03fc6a81ae32..6b5790bba8f9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -957,7 +957,8 @@ out_err:
         return rc;
 }
 
-void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
+static void selinux_write_opts(struct seq_file *m,
+                               struct security_mnt_opts *opts)
 {
         int i;
         char *prefix;
@@ -3548,38 +3549,44 @@ out:
 #endif /* IPV6 */
 
 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
-                             char **addrp, int src, u8 *proto)
+                             char **_addrp, int src, u8 *proto)
 {
-        int ret = 0;
+        char *addrp;
+        int ret;
 
         switch (ad->u.net.family) {
         case PF_INET:
                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
-                if (ret || !addrp)
-                        break;
-                *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
-                                        &ad->u.net.v4info.daddr);
-                break;
+                if (ret)
+                        goto parse_error;
+                addrp = (char *)(src ? &ad->u.net.v4info.saddr :
+                                       &ad->u.net.v4info.daddr);
+                goto okay;
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         case PF_INET6:
                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
-                if (ret || !addrp)
-                        break;
-                *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
-                                        &ad->u.net.v6info.daddr);
-                break;
+                if (ret)
+                        goto parse_error;
+                addrp = (char *)(src ? &ad->u.net.v6info.saddr :
+                                       &ad->u.net.v6info.daddr);
+                goto okay;
 #endif  /* IPV6 */
         default:
-                break;
+                addrp = NULL;
+                goto okay;
         }
 
-        if (unlikely(ret))
-                printk(KERN_WARNING
-                       "SELinux: failure in selinux_parse_skb(),"
-                       " unable to parse packet\n");
-
+parse_error:
+        printk(KERN_WARNING
+               "SELinux: failure in selinux_parse_skb(),"
+               " unable to parse packet\n");
         return ret;
+
+okay:
+        if (_addrp)
+                *_addrp = addrp;
+        return 0;
 }
 
 /**
diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index a1be97f8beea..1215b8e47dba 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -98,7 +98,7 @@ struct avtab_node *
 avtab_insert_nonunique(struct avtab *h, struct avtab_key *key, struct avtab_datum *datum)
 {
         int hvalue;
-        struct avtab_node *prev, *cur, *newnode;
+        struct avtab_node *prev, *cur;
         u16 specified = key->specified & ~(AVTAB_ENABLED|AVTAB_ENABLED_OLD);
 
         if (!h || !h->htable)
@@ -122,9 +122,7 @@ avtab_insert_nonunique(struct avtab *h, struct avtab_key *key, struct avtab_datu
                     key->target_class < cur->key.target_class)
                         break;
         }
-        newnode = avtab_insert_node(h, hvalue, prev, cur, key, datum);
-
-        return newnode;
+        return avtab_insert_node(h, hvalue, prev, cur, key, datum);
 }
 
 struct avtab_datum *avtab_search(struct avtab *h, struct avtab_key *key)
@@ -231,7 +229,7 @@ void avtab_destroy(struct avtab *h)
 
         for (i = 0; i < h->nslot; i++) {
                 cur = h->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         temp = cur;
                         cur = cur->next;
                         kmem_cache_free(avtab_node_cachep, temp);
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index fb4efe4f4bc8..4a4e35cac22b 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -29,7 +29,7 @@ static int cond_evaluate_expr(struct policydb *p, struct cond_expr *expr)
         int s[COND_EXPR_MAXDEPTH];
         int sp = -1;
 
-        for (cur = expr; cur != NULL; cur = cur->next) {
+        for (cur = expr; cur; cur = cur->next) {
                 switch (cur->expr_type) {
                 case COND_BOOL:
                         if (sp == (COND_EXPR_MAXDEPTH - 1))
@@ -97,14 +97,14 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node)
                 if (new_state == -1)
                         printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n");
                 /* turn the rules on or off */
-                for (cur = node->true_list; cur != NULL; cur = cur->next) {
+                for (cur = node->true_list; cur; cur = cur->next) {
                         if (new_state <= 0)
                                 cur->node->key.specified &= ~AVTAB_ENABLED;
                         else
                                 cur->node->key.specified |= AVTAB_ENABLED;
                 }
 
-                for (cur = node->false_list; cur != NULL; cur = cur->next) {
+                for (cur = node->false_list; cur; cur = cur->next) {
                         /* -1 or 1 */
                         if (new_state)
                                 cur->node->key.specified &= ~AVTAB_ENABLED;
@@ -128,7 +128,7 @@ int cond_policydb_init(struct policydb *p)
 static void cond_av_list_destroy(struct cond_av_list *list)
 {
         struct cond_av_list *cur, *next;
-        for (cur = list; cur != NULL; cur = next) {
+        for (cur = list; cur; cur = next) {
                 next = cur->next;
                 /* the avtab_ptr_t node is destroy by the avtab */
                 kfree(cur);
@@ -139,7 +139,7 @@ static void cond_node_destroy(struct cond_node *node)
 {
         struct cond_expr *cur_expr, *next_expr;
 
-        for (cur_expr = node->expr; cur_expr != NULL; cur_expr = next_expr) {
+        for (cur_expr = node->expr; cur_expr; cur_expr = next_expr) {
                 next_expr = cur_expr->next;
                 kfree(cur_expr);
         }
@@ -155,7 +155,7 @@ static void cond_list_destroy(struct cond_node *list)
         if (list == NULL)
                 return;
 
-        for (cur = list; cur != NULL; cur = next) {
+        for (cur = list; cur; cur = next) {
                 next = cur->next;
                 cond_node_destroy(cur);
         }
@@ -239,7 +239,7 @@ int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto err;
-        key[len] = 0;
+        key[len] = '\0';
         if (hashtab_insert(h, key, booldatum))
                 goto err;
 
@@ -291,7 +291,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
                                         goto err;
                                 }
                                 found = 0;
-                                for (cur = other; cur != NULL; cur = cur->next) {
+                                for (cur = other; cur; cur = cur->next) {
                                         if (cur->node == node_ptr) {
                                                 found = 1;
                                                 break;
@@ -485,7 +485,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decisi
         if (!ctab || !key || !avd)
                 return;
 
-        for (node = avtab_search_node(ctab, key); node != NULL;
+        for (node = avtab_search_node(ctab, key); node;
                                 node = avtab_search_node_next(node, key->specified)) {
                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h
index 65b9f8366e9c..53ddb013ae57 100644
--- a/security/selinux/ss/conditional.h
+++ b/security/selinux/ss/conditional.h
@@ -28,7 +28,7 @@ struct cond_expr {
 #define COND_XOR        5 /* bool ^ bool */
 #define COND_EQ         6 /* bool == bool */
 #define COND_NEQ        7 /* bool != bool */
-#define COND_LAST       8
+#define COND_LAST       COND_NEQ
         __u32 expr_type;
         __u32 bool;
         struct cond_expr *next;
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index ddc275490af8..68c7348d1acc 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -109,7 +109,7 @@ int ebitmap_netlbl_export(struct ebitmap *ebmap,
         *catmap = c_iter;
         c_iter->startbit = e_iter->startbit & ~(NETLBL_CATMAP_SIZE - 1);
 
-        while (e_iter != NULL) {
+        while (e_iter) {
                 for (i = 0; i < EBITMAP_UNIT_NUMS; i++) {
                         unsigned int delta, e_startbit, c_endbit;
 
@@ -197,7 +197,7 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap,
                         }
                 }
                 c_iter = c_iter->next;
-        } while (c_iter != NULL);
+        } while (c_iter);
         if (e_iter != NULL)
                 ebmap->highbit = e_iter->startbit + EBITMAP_SIZE;
         else
diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c
index 2e7788e13213..933e735bb185 100644
--- a/security/selinux/ss/hashtab.c
+++ b/security/selinux/ss/hashtab.c
@@ -81,7 +81,7 @@ void *hashtab_search(struct hashtab *h, const void *key)
 
         hvalue = h->hash_value(h, key);
         cur = h->htable[hvalue];
-        while (cur != NULL && h->keycmp(h, key, cur->key) > 0)
+        while (cur && h->keycmp(h, key, cur->key) > 0)
                 cur = cur->next;
 
         if (cur == NULL || (h->keycmp(h, key, cur->key) != 0))
@@ -100,7 +100,7 @@ void hashtab_destroy(struct hashtab *h)
 
         for (i = 0; i < h->size; i++) {
                 cur = h->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         temp = cur;
                         cur = cur->next;
                         kfree(temp);
@@ -127,7 +127,7 @@ int hashtab_map(struct hashtab *h,
 
         for (i = 0; i < h->size; i++) {
                 cur = h->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         ret = apply(cur->key, cur->datum, args);
                         if (ret)
                                 return ret;
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 77d745da48bb..b5407f16c2a4 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -283,8 +283,8 @@ int mls_context_to_sid(struct policydb *pol,
                 p++;
 
         delim = *p;
-        if (delim != 0)
-                *p++ = 0;
+        if (delim != '\0')
+                *p++ = '\0';
 
         for (l = 0; l < 2; l++) {
                 levdatum = hashtab_search(pol->p_levels.table, scontextp);
@@ -302,14 +302,14 @@ int mls_context_to_sid(struct policydb *pol,
                                 while (*p && *p != ',' && *p != '-')
                                         p++;
                                 delim = *p;
-                                if (delim != 0)
-                                        *p++ = 0;
+                                if (delim != '\0')
+                                        *p++ = '\0';
 
                                 /* Separate into range if exists */
                                 rngptr = strchr(scontextp, '.');
                                 if (rngptr != NULL) {
                                         /* Remove '.' */
-                                        *rngptr++ = 0;
+                                        *rngptr++ = '\0';
                                 }
 
                                 catdatum = hashtab_search(pol->p_cats.table,
@@ -357,8 +357,8 @@ int mls_context_to_sid(struct policydb *pol,
                                 p++;
 
                         delim = *p;
-                        if (delim != 0)
-                                *p++ = 0;
+                        if (delim != '\0')
+                                *p++ = '\0';
                 } else
                         break;
         }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 2391761ae422..26646305dc0e 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -932,7 +932,7 @@ static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         rc = hashtab_insert(h, key, perdatum);
         if (rc)
@@ -979,7 +979,7 @@ static int common_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         for (i = 0; i < nel; i++) {
                 rc = perm_read(p, comdatum->permissions.table, fp);
@@ -1117,7 +1117,7 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         if (len2) {
                 cladatum->comkey = kmalloc(len2 + 1, GFP_KERNEL);
@@ -1128,7 +1128,7 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
                 rc = next_entry(cladatum->comkey, fp, len2);
                 if (rc < 0)
                         goto bad;
-                cladatum->comkey[len2] = 0;
+                cladatum->comkey[len2] = '\0';
 
                 cladatum->comdatum = hashtab_search(p->p_commons.table,
                                                     cladatum->comkey);
@@ -1201,7 +1201,7 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         rc = ebitmap_read(&role->dominates, fp);
         if (rc)
@@ -1262,7 +1262,7 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         rc = hashtab_insert(h, key, typdatum);
         if (rc)
@@ -1334,7 +1334,7 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         rc = ebitmap_read(&usrdatum->roles, fp);
         if (rc)
@@ -1388,7 +1388,7 @@ static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         levdatum->level = kmalloc(sizeof(struct mls_level), GFP_ATOMIC);
         if (!levdatum->level) {
@@ -1440,7 +1440,7 @@ static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = next_entry(key, fp, len);
         if (rc < 0)
                 goto bad;
-        key[len] = 0;
+        key[len] = '\0';
 
         rc = hashtab_insert(h, key, catdatum);
         if (rc)
@@ -1523,7 +1523,7 @@ int policydb_read(struct policydb *p, void *fp)
                 kfree(policydb_str);
                 goto bad;
         }
-        policydb_str[len] = 0;
+        policydb_str[len] = '\0';
         if (strcmp(policydb_str, POLICYDB_STRING)) {
                 printk(KERN_ERR "SELinux:  policydb string %s does not match "
                        "my string %s\n", policydb_str, POLICYDB_STRING);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index b52f923ce680..5a0536bddc63 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -356,7 +356,7 @@ static int context_struct_compute_av(struct context *scontext,
                         avkey.source_type = i + 1;
                         avkey.target_type = j + 1;
                         for (node = avtab_search_node(&policydb.te_avtab, &avkey);
-                             node != NULL;
+                             node;
                              node = avtab_search_node_next(node, avkey.specified)) {
                                 if (node->key.specified == AVTAB_ALLOWED)
                                         avd->allowed |= node->datum.data;
@@ -1037,7 +1037,7 @@ static int security_compute_sid(u32 ssid,
         /* If no permanent rule, also check for enabled conditional rules */
         if (!avdatum) {
                 node = avtab_search_node(&policydb.te_cond_avtab, &avkey);
-                for (; node != NULL; node = avtab_search_node_next(node, specified)) {
+                for (; node; node = avtab_search_node_next(node, specified)) {
                         if (node->key.specified & AVTAB_ENABLED) {
                                 avdatum = &node->datum;
                                 break;
@@ -2050,7 +2050,7 @@ int security_set_bools(int len, int *values)
                         policydb.bool_val_to_struct[i]->state = 0;
         }
 
-        for (cur = policydb.cond_list; cur != NULL; cur = cur->next) {
+        for (cur = policydb.cond_list; cur; cur = cur->next) {
                 rc = evaluate_cond_node(&policydb, cur);
                 if (rc)
                         goto out;
@@ -2102,7 +2102,7 @@ static int security_preserve_bools(struct policydb *p)
                 if (booldatum)
                         booldatum->state = bvalues[i];
         }
-        for (cur = p->cond_list; cur != NULL; cur = cur->next) {
+        for (cur = p->cond_list; cur; cur = cur->next) {
                 rc = evaluate_cond_node(p, cur);
                 if (rc)
                         goto out;
diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c
index a81ded104129..e817989764cd 100644
--- a/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@ -43,7 +43,7 @@ int sidtab_insert(struct sidtab *s, u32 sid, struct context *context)
         hvalue = SIDTAB_HASH(sid);
         prev = NULL;
         cur = s->htable[hvalue];
-        while (cur != NULL && sid > cur->sid) {
+        while (cur && sid > cur->sid) {
                 prev = cur;
                 cur = cur->next;
         }
@@ -92,7 +92,7 @@ static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force)
 
         hvalue = SIDTAB_HASH(sid);
         cur = s->htable[hvalue];
-        while (cur != NULL && sid > cur->sid)
+        while (cur && sid > cur->sid)
                 cur = cur->next;
 
         if (force && cur && sid == cur->sid && cur->context.len)
@@ -103,7 +103,7 @@ static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force)
                 sid = SECINITSID_UNLABELED;
                 hvalue = SIDTAB_HASH(sid);
                 cur = s->htable[hvalue];
-                while (cur != NULL && sid > cur->sid)
+                while (cur && sid > cur->sid)
                         cur = cur->next;
                 if (!cur || sid != cur->sid)
                         return NULL;
@@ -136,7 +136,7 @@ int sidtab_map(struct sidtab *s,
 
         for (i = 0; i < SIDTAB_SIZE; i++) {
                 cur = s->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         rc = apply(cur->sid, &cur->context, args);
                         if (rc)
                                 goto out;
@@ -155,7 +155,7 @@ static inline u32 sidtab_search_context(struct sidtab *s,
 
         for (i = 0; i < SIDTAB_SIZE; i++) {
                 cur = s->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         if (context_cmp(&cur->context, context))
                                 return cur->sid;
                         cur = cur->next;
@@ -242,7 +242,7 @@ void sidtab_destroy(struct sidtab *s)
 
         for (i = 0; i < SIDTAB_SIZE; i++) {
                 cur = s->htable[i];
-                while (cur != NULL) {
+                while (cur) {
                         temp = cur;
                         cur = cur->next;
                         context_destroy(&temp->context);
diff --git a/security/smack/smack.h b/security/smack/smack.h
index 4a4477f5afdc..31dce559595a 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -178,6 +178,7 @@ u32 smack_to_secid(const char *);
 extern int smack_cipso_direct;
 extern int smack_net_nltype;
 extern char *smack_net_ambient;
+extern char *smack_onlycap;
 
 extern struct smack_known *smack_known;
 extern struct smack_known smack_known_floor;
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index f6b5f6eed6dd..79ff21ed4c3b 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -157,7 +157,7 @@ int smk_access(char *subject_label, char *object_label, int request)
  *
  * This function checks the current subject label/object label pair
  * in the access rule list and returns 0 if the access is permitted,
- * non zero otherwise. It allows that current my have the capability
+ * non zero otherwise. It allows that current may have the capability
  * to override the rules.
  */
 int smk_curacc(char *obj_label, u32 mode)
@@ -168,6 +168,14 @@ int smk_curacc(char *obj_label, u32 mode)
         if (rc == 0)
                 return 0;
 
+        /*
+         * Return if a specific label has been designated as the
+         * only one that gets privilege and current does not
+         * have that label.
+         */
+        if (smack_onlycap != NULL && smack_onlycap != current->security)
+                return rc;
+
         if (capable(CAP_MAC_OVERRIDE))
                 return 0;
 
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 271a835fbbe3..e7c642458ec9 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -39,6 +39,7 @@ enum smk_inos {
         SMK_DIRECT      = 6,    /* CIPSO level indicating direct label */
         SMK_AMBIENT     = 7,    /* internet ambient label */
         SMK_NLTYPE      = 8,    /* label scheme to use by default */
+        SMK_ONLYCAP     = 9,    /* the only "capable" label */
 };
 
 /*
@@ -68,6 +69,16 @@ int smack_net_nltype = NETLBL_NLTYPE_CIPSOV4;
  */
 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
 
+/*
+ * Unless a process is running with this label even
+ * having CAP_MAC_OVERRIDE isn't enough to grant
+ * privilege to violate MAC policy. If no label is
+ * designated (the NULL case) capabilities apply to
+ * everyone. It is expected that the hat (^) label
+ * will be used if any label is used.
+ */
+char *smack_onlycap;
+
 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
 struct smk_list_entry *smack_list;
 
@@ -787,6 +798,85 @@ static const struct file_operations smk_ambient_ops = {
         .write          = smk_write_ambient,
 };
 
+/**
+ * smk_read_onlycap - read() for /smack/onlycap
+ * @filp: file pointer, not actually used
+ * @buf: where to put the result
+ * @cn: maximum to send along
+ * @ppos: where to start
+ *
+ * Returns number of bytes read or error code, as appropriate
+ */
+static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
+                                size_t cn, loff_t *ppos)
+{
+        char *smack = "";
+        ssize_t rc = -EINVAL;
+        int asize;
+
+        if (*ppos != 0)
+                return 0;
+
+        if (smack_onlycap != NULL)
+                smack = smack_onlycap;
+
+        asize = strlen(smack) + 1;
+
+        if (cn >= asize)
+                rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
+
+        return rc;
+}
+
+/**
+ * smk_write_onlycap - write() for /smack/onlycap
+ * @filp: file pointer, not actually used
+ * @buf: where to get the data from
+ * @count: bytes sent
+ * @ppos: where to start
+ *
+ * Returns number of bytes written or error code, as appropriate
+ */
+static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        char in[SMK_LABELLEN];
+        char *sp = current->security;
+
+        if (!capable(CAP_MAC_ADMIN))
+                return -EPERM;
+
+        /*
+         * This can be done using smk_access() but is done
+         * explicitly for clarity. The smk_access() implementation
+         * would use smk_access(smack_onlycap, MAY_WRITE)
+         */
+        if (smack_onlycap != NULL && smack_onlycap != sp)
+                return -EPERM;
+
+        if (count >= SMK_LABELLEN)
+                return -EINVAL;
+
+        if (copy_from_user(in, buf, count) != 0)
+                return -EFAULT;
+
+        /*
+         * Should the null string be passed in unset the onlycap value.
+         * This seems like something to be careful with as usually
+         * smk_import only expects to return NULL for errors. It
+         * is usually the case that a nullstring or "\n" would be
+         * bad to pass to smk_import but in fact this is useful here.
+         */
+        smack_onlycap = smk_import(in, count);
+
+        return count;
+}
+
+static const struct file_operations smk_onlycap_ops = {
+        .read           = smk_read_onlycap,
+        .write          = smk_write_onlycap,
+};
+
 struct option_names {
         int     o_number;
         char    *o_name;
@@ -919,6 +1009,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent)
                         {"ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
                 [SMK_NLTYPE]    =
                         {"nltype", &smk_nltype_ops, S_IRUGO|S_IWUSR},
+                [SMK_ONLYCAP]   =
+                        {"onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
                 /* last one */ {""}
         };