Merge commit 'v2.6.39' into 20110526

Conflicts:
	lib/flex_array.c
	security/selinux/avc.c
	security/selinux/hooks.c
	security/selinux/ss/policydb.c
	security/smack/smack_lsm.c

16 files changed, 148 insertions, 64 deletions

diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index f204869399e..2dafe50a2e2 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -6,19 +6,47 @@ apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
               path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
               resource.o sid.o file.o
 
-clean-files: capability_names.h af_names.h
+clean-files := capability_names.h rlim_names.h
 
+
+# Build a lower case string table of capability names
+# Transforms lines from
+#    #define CAP_DAC_OVERRIDE     1
+# to
+#    [1] = "dac_override",
 quiet_cmd_make-caps = GEN     $@
-cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ; sed -n -e "/CAP_FS_MASK/d" -e "s/^\#define[ \\t]\\+CAP_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@
+cmd_make-caps = echo "static const char *capability_names[] = {" > $@ ;\
+        sed $< >>$@ -r -n -e '/CAP_FS_MASK/d' \
+        -e 's/^\#define[ \t]+CAP_([A-Z0-9_]+)[ \t]+([0-9]+)/[\2] = "\L\1",/p';\
+        echo "};" >> $@
+
 
+# Build a lower case string table of rlimit names.
+# Transforms lines from
+#    #define RLIMIT_STACK               3       /* max stack size */
+# to
+#    [RLIMIT_STACK] = "stack",
+#
+# and build a second integer table (with the second sed cmd), that maps
+# RLIMIT defines to the order defined in asm-generic/resource.h  Thi is
+# required by policy load to map policy ordering of RLIMITs to internal
+# ordering for architectures that redefine an RLIMIT.
+# Transforms lines from
+#    #define RLIMIT_STACK               3       /* max stack size */
+# to
+# RLIMIT_STACK, 
 quiet_cmd_make-rlim = GEN     $@
-cmd_make-rlim = echo "static const char *rlim_names[] = {" > $@ ; sed -n --e "/AF_MAX/d" -e "s/^\# \\?define[ \\t]\\+RLIMIT_\\([A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\\(.*\\)\$$/[\\2]  = \"\\1\",/p" $< | tr A-Z a-z >> $@ ; echo "};" >> $@ ; echo "static const int rlim_map[] = {" >> $@ ; sed -n -e "/AF_MAX/d" -e "s/^\# \\?define[ \\t]\\+\\(RLIMIT_[A-Z0-9_]\\+\\)[ \\t]\\+\\([0-9]\\+\\)\\(.*\\)\$$/\\1,/p" $< >> $@ ; echo "};" >> $@
+cmd_make-rlim = echo "static const char *rlim_names[] = {" > $@ ;\
+        sed $< >> $@ -r -n \
+            -e 's/^\# ?define[ \t]+(RLIMIT_([A-Z0-9_]+)).*/[\1] = "\L\2",/p';\
+        echo "};" >> $@ ;\
+        echo "static const int rlim_map[] = {" >> $@ ;\
+        sed -r -n "s/^\# ?define[ \t]+(RLIMIT_[A-Z0-9_]+).*/\1,/p" $< >> $@ ;\
+        echo "};" >> $@
 
 $(obj)/capability.o : $(obj)/capability_names.h
 $(obj)/resource.o : $(obj)/rlim_names.h
 $(obj)/capability_names.h : $(srctree)/include/linux/capability.h
         $(call cmd,make-caps)
-$(obj)/af_names.h : $(srctree)/include/linux/socket.h
-        $(call cmd,make-af)
 $(obj)/rlim_names.h : $(srctree)/include/asm-generic/resource.h
         $(call cmd,make-rlim)
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index b7106f192b7..ae3a698415e 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -22,6 +22,7 @@
 #include <linux/ctype.h>
 #include <linux/sysctl.h>
 #include <linux/audit.h>
+#include <linux/user_namespace.h>
 #include <net/sock.h>
 
 #include "include/apparmor.h"
@@ -136,11 +137,11 @@ static int apparmor_capget(struct task_struct *target, kernel_cap_t *effective,
 }
 
 static int apparmor_capable(struct task_struct *task, const struct cred *cred,
-                            int cap, int audit)
+                            struct user_namespace *ns, int cap, int audit)
 {
         struct aa_profile *profile;
         /* cap_capable returns 0 on success, else -EPERM */
-        int error = cap_capable(task, cred, cap, audit);
+        int error = cap_capable(task, cred, ns, cap, audit);
         if (!error) {
                 profile = aa_cred_profile(cred);
                 if (!unconfined(profile))
@@ -693,11 +694,9 @@ static struct kernel_param_ops param_ops_aalockpolicy = {
 
 static int param_set_audit(const char *val, struct kernel_param *kp);
 static int param_get_audit(char *buffer, struct kernel_param *kp);
-#define param_check_audit(name, p) __param_check(name, p, int)
 
 static int param_set_mode(const char *val, struct kernel_param *kp);
 static int param_get_mode(char *buffer, struct kernel_param *kp);
-#define param_check_mode(name, p) __param_check(name, p, int)
 
 /* Flag values, also controllable via /sys/module/apparmor/parameters
  * We define special types as we want to do additional mediation.
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index 5cb4dc1f699..06d764ccbbe 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -195,7 +195,7 @@ void aa_dfa_free_kref(struct kref *kref)
  *
  * Unpack a dfa that has been serialized.  To find information on the dfa
  * format look in Documentation/apparmor.txt
- * Assumes the dfa @blob stream has been aligned on a 8 byte boundry
+ * Assumes the dfa @blob stream has been aligned on a 8 byte boundary
  *
  * Returns: an unpacked dfa ready for matching or ERR_PTR on failure
  */
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index eb3700e9fd3..e33aaf7e574 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -359,7 +359,7 @@ fail:
  * @e: serialized data extent information  (NOT NULL)
  * @profile: profile to add the accept table to (NOT NULL)
  *
- * Returns: 1 if table succesfully unpacked
+ * Returns: 1 if table successfully unpacked
  */
 static bool unpack_trans_table(struct aa_ext *e, struct aa_profile *profile)
 {
diff --git a/security/capability.c b/security/capability.c
index 56bb1605fd7..bbb51156261 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -761,7 +761,7 @@ static int cap_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 sk_sid, u8 dir)
 
 static int cap_xfrm_state_pol_flow_match(struct xfrm_state *x,
                                          struct xfrm_policy *xp,
-                                         struct flowi *fl)
+                                         const struct flowi *fl)
 {
         return 1;
 }
diff --git a/security/commoncap.c b/security/commoncap.c
index 64c2ed9c901..f20e984ccfb 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -27,6 +27,7 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/user_namespace.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -52,13 +53,12 @@ static void warn_setuid_and_fcaps_mixed(const char *fname)
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-        NETLINK_CB(skb).eff_cap = current_cap();
         return 0;
 }
 
 int cap_netlink_recv(struct sk_buff *skb, int cap)
 {
-        if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
+        if (!cap_raised(current_cap(), cap))
                 return -EPERM;
         return 0;
 }
@@ -68,6 +68,7 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_capable - Determine whether a task has a particular effective capability
  * @tsk: The task to query
  * @cred: The credentials to use
+ * @ns:  The user namespace in which we need the capability
  * @cap: The capability to check for
  * @audit: Whether to write an audit message or not
  *
@@ -79,10 +80,30 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_has_capability() returns 0 when a task has a capability, but the
  * kernel's capable() and has_capability() returns 1 for this case.
  */
-int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
-                int audit)
+int cap_capable(struct task_struct *tsk, const struct cred *cred,
+                struct user_namespace *targ_ns, int cap, int audit)
 {
-        return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+        for (;;) {
+                /* The creator of the user namespace has all caps. */
+                if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)
+                        return 0;
+
+                /* Do we have the necessary capabilities? */
+                if (targ_ns == cred->user->user_ns)
+                        return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+
+                /* Have we tried all of the parent namespaces? */
+                if (targ_ns == &init_user_ns)
+                        return -EPERM;
+
+                /*
+                 *If you have a capability in a parent user ns, then you have
+                 * it over all children user namespaces as well.
+                 */
+                targ_ns = targ_ns->creator->user_ns;
+        }
+
+        /* We never get here */
 }
 
 /**
@@ -93,7 +114,7 @@ int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
  * Determine whether the current process may set the system clock and timezone
  * information, returning 0 if permission granted, -ve if denied.
  */
-int cap_settime(struct timespec *ts, struct timezone *tz)
+int cap_settime(const struct timespec *ts, const struct timezone *tz)
 {
         if (!capable(CAP_SYS_TIME))
                 return -EPERM;
@@ -106,18 +127,30 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
  * @child: The process to be accessed
  * @mode: The mode of attachment.
  *
+ * If we are in the same or an ancestor user_ns and have all the target
+ * task's capabilities, then ptrace access is allowed.
+ * If we have the ptrace capability to the target user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether a process may access another, returning 0 if permission
  * granted, -ve if denied.
  */
 int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
 {
         int ret = 0;
+        const struct cred *cred, *child_cred;
 
         rcu_read_lock();
-        if (!cap_issubset(__task_cred(child)->cap_permitted,
-                          current_cred()->cap_permitted) &&
-            !capable(CAP_SYS_PTRACE))
-                ret = -EPERM;
+        cred = current_cred();
+        child_cred = __task_cred(child);
+        if (cred->user->user_ns == child_cred->user->user_ns &&
+            cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+                goto out;
+        if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
+                goto out;
+        ret = -EPERM;
+out:
         rcu_read_unlock();
         return ret;
 }
@@ -126,18 +159,30 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
  * cap_ptrace_traceme - Determine whether another process may trace the current
  * @parent: The task proposed to be the tracer
  *
+ * If parent is in the same or an ancestor user_ns and has all current's
+ * capabilities, then ptrace access is allowed.
+ * If parent has the ptrace capability to current's user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether the nominated task is permitted to trace the current
  * process, returning 0 if permission is granted, -ve if denied.
  */
 int cap_ptrace_traceme(struct task_struct *parent)
 {
         int ret = 0;
+        const struct cred *cred, *child_cred;
 
         rcu_read_lock();
-        if (!cap_issubset(current_cred()->cap_permitted,
-                          __task_cred(parent)->cap_permitted) &&
-            !has_capability(parent, CAP_SYS_PTRACE))
-                ret = -EPERM;
+        cred = __task_cred(parent);
+        child_cred = current_cred();
+        if (cred->user->user_ns == child_cred->user->user_ns &&
+            cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+                goto out;
+        if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
+                goto out;
+        ret = -EPERM;
+out:
         rcu_read_unlock();
         return ret;
 }
@@ -177,7 +222,8 @@ static inline int cap_inh_is_capped(void)
         /* they are so limited unless the current task has the CAP_SETPCAP
          * capability
          */
-        if (cap_capable(current, current_cred(), CAP_SETPCAP,
+        if (cap_capable(current, current_cred(),
+                        current_cred()->user->user_ns, CAP_SETPCAP,
                         SECURITY_CAP_AUDIT) == 0)
                 return 0;
         return 1;
@@ -829,7 +875,8 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                      & (new->securebits ^ arg2))                        /*[1]*/
                     || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                     || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
-                    || (cap_capable(current, current_cred(), CAP_SETPCAP,
+                    || (cap_capable(current, current_cred(),
+                                    current_cred()->user->user_ns, CAP_SETPCAP,
                                     SECURITY_CAP_AUDIT) != 0)           /*[4]*/
                         /*
                          * [1] no changing of bits that are locked
@@ -894,7 +941,7 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int cap_sys_admin = 0;
 
-        if (cap_capable(current, current_cred(), CAP_SYS_ADMIN,
+        if (cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_ADMIN,
                         SECURITY_CAP_NOAUDIT) == 0)
                 cap_sys_admin = 1;
         return __vm_enough_memory(mm, pages, cap_sys_admin);
@@ -921,7 +968,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
         int ret = 0;
 
         if (addr < dac_mmap_min_addr) {
-                ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+                ret = cap_capable(current, current_cred(), &init_user_ns, CAP_SYS_RAWIO,
                                   SECURITY_CAP_AUDIT);
                 /* set PF_SUPERPRIV if it turns out we allow the low mmap */
                 if (ret == 0)
diff --git a/security/security.c b/security/security.c
index 7e34f98bf43..4ba6d4cc061 100644
--- a/security/security.c
+++ b/security/security.c
@@ -154,29 +154,33 @@ int security_capset(struct cred *new, const struct cred *old,
                                     effective, inheritable, permitted);
 }
 
-int security_capable(const struct cred *cred, int cap)
+int security_capable(struct user_namespace *ns, const struct cred *cred,
+                     int cap)
 {
-        return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
+        return security_ops->capable(current, cred, ns, cap,
+                                     SECURITY_CAP_AUDIT);
 }
 
-int security_real_capable(struct task_struct *tsk, int cap)
+int security_real_capable(struct task_struct *tsk, struct user_namespace *ns,
+                          int cap)
 {
         const struct cred *cred;
         int ret;
 
         cred = get_task_cred(tsk);
-        ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_AUDIT);
+        ret = security_ops->capable(tsk, cred, ns, cap, SECURITY_CAP_AUDIT);
         put_cred(cred);
         return ret;
 }
 
-int security_real_capable_noaudit(struct task_struct *tsk, int cap)
+int security_real_capable_noaudit(struct task_struct *tsk,
+                                  struct user_namespace *ns, int cap)
 {
         const struct cred *cred;
         int ret;
 
         cred = get_task_cred(tsk);
-        ret = security_ops->capable(tsk, cred, cap, SECURITY_CAP_NOAUDIT);
+        ret = security_ops->capable(tsk, cred, ns, cap, SECURITY_CAP_NOAUDIT);
         put_cred(cred);
         return ret;
 }
@@ -196,7 +200,7 @@ int security_syslog(int type)
         return security_ops->syslog(type);
 }
 
-int security_settime(struct timespec *ts, struct timezone *tz)
+int security_settime(const struct timespec *ts, const struct timezone *tz)
 {
         return security_ops->settime(ts, tz);
 }
@@ -1103,7 +1107,7 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
 
 void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
-        security_ops->sk_getsecid(sk, &fl->secid);
+        security_ops->sk_getsecid(sk, &fl->flowi_secid);
 }
 EXPORT_SYMBOL(security_sk_classify_flow);
 
@@ -1236,7 +1240,8 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 }
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                                       struct xfrm_policy *xp, struct flowi *fl)
+                                       struct xfrm_policy *xp,
+                                       const struct flowi *fl)
 {
         return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
 }
@@ -1248,7 +1253,7 @@ int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 
 void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
 {
-        int rc = security_ops->xfrm_decode_session(skb, &fl->secid, 0);
+        int rc = security_ops->xfrm_decode_session(skb, &fl->flowi_secid, 0);
 
         BUG_ON(rc);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9f426b8a12b..a0d38459d65 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -79,6 +79,7 @@
 #include <linux/mutex.h>
 #include <linux/posix-timers.h>
 #include <linux/syslog.h>
+#include <linux/user_namespace.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -1866,11 +1867,11 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
-                           int cap, int audit)
+                           struct user_namespace *ns, int cap, int audit)
 {
         int rc;
 
-        rc = cap_capable(tsk, cred, cap, audit);
+        rc = cap_capable(tsk, cred, ns, cap, audit);
         if (rc)
                 return rc;
 
@@ -1951,7 +1952,8 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int rc, cap_sys_admin = 0;
 
-        rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
+        rc = selinux_capable(current, current_cred(),
+                             &init_user_ns, CAP_SYS_ADMIN,
                              SECURITY_CAP_NOAUDIT);
         if (rc == 0)
                 cap_sys_admin = 1;
@@ -2746,7 +2748,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         if (!(sbsec->flags & SE_SBLABELSUPP))
                 return -EOPNOTSUPP;
 
-        if (!is_owner_or_cap(inode))
+        if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
@@ -2857,7 +2859,8 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
          * and lack of permission just means that we fall back to the
          * in-core context value, not a denial.
          */
-        error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
+        error = selinux_capable(current, current_cred(),
+                                &init_user_ns, CAP_MAC_ADMIN,
                                 SECURITY_CAP_NOAUDIT);
         if (!error)
                 error = security_sid_to_context_force(isec->sid, &context,
@@ -2991,7 +2994,7 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
         case KDSKBENT:
         case KDSKBSENT:
                 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
-                                            SECURITY_CAP_AUDIT);
+                                        SECURITY_CAP_AUDIT);
                 break;
 
         /* default case assumes that the command will go
@@ -4369,7 +4372,7 @@ static void selinux_secmark_refcount_dec(void)
 static void selinux_req_classify_flow(const struct request_sock *req,
                                       struct flowi *fl)
 {
-        fl->secid = req->secid;
+        fl->flowi_secid = req->secid;
 }
 
 static int selinux_tun_dev_create(void)
@@ -4718,6 +4721,7 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
 {
         int err;
         struct common_audit_data ad;
+        u32 sid;
 
         err = cap_netlink_recv(skb, capability);
         if (err)
@@ -4726,8 +4730,9 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
         COMMON_AUDIT_DATA_INIT(&ad, CAP);
         ad.u.cap = capability;
 
-        return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
-                            SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
+        security_task_getsecid(current, &sid);
+        return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
+                            CAP_TO_MASK(capability), &ad);
 }
 
 static int ipc_alloc_security(struct task_struct *task,
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 13128f9a3e5..b43813c9e04 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -19,7 +19,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x);
 int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                        struct xfrm_policy *xp, struct flowi *fl);
+                        struct xfrm_policy *xp, const struct flowi *fl);
 
 /*
  * Extract the security blob from the sock (it's actually on the socket)
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 1c2fc46544b..c3bf3ed07b0 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -151,7 +151,7 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
  *
  * Description:
  * Called when the NetLabel state of a sk_security_struct needs to be reset.
- * The caller is responsibile for all the NetLabel sk_security_struct locking.
+ * The caller is responsible for all the NetLabel sk_security_struct locking.
  *
  */
 void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index e11b4b038f4..c3e4b52699f 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2814,7 +2814,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
         case AUDIT_SUBJ_CLR:
         case AUDIT_OBJ_LEV_LOW:
         case AUDIT_OBJ_LEV_HIGH:
-                /* we do not allow a range, indicated by the presense of '-' */
+                /* we do not allow a range, indicated by the presence of '-' */
                 if (strchr(rulestr, '-'))
                         return -EINVAL;
                 break;
@@ -3083,7 +3083,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
  * Description:
  * Convert the given NetLabel security attributes in @secattr into a
  * SELinux SID.  If the @secattr field does not contain a full SELinux
- * SID/context then use SECINITSID_NETMSG as the foundation.  If possibile the
+ * SID/context then use SECINITSID_NETMSG as the foundation.  If possible the
  * 'cache' field of @secattr is set and the CACHE flag is set; this is to
  * allow the @secattr to be used by NetLabel to cache the secattr to SID
  * conversion for future lookups.  Returns zero on success, negative values on
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 728c57e3d65..68178b76a2b 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -112,7 +112,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  */
 
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
-                        struct flowi *fl)
+                        const struct flowi *fl)
 {
         u32 state_sid;
         int rc;
@@ -135,10 +135,10 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
 
         state_sid = x->security->ctx_sid;
 
-        if (fl->secid != state_sid)
+        if (fl->flowi_secid != state_sid)
                 return 0;
 
-        rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
+        rc = avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__SENDTO,
                           NULL)? 0:1;
 
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 86453db4333..9637e107f7e 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -431,7 +431,7 @@ char *smk_import(const char *string, int len)
  * smack_from_secid - find the Smack label associated with a secid
  * @secid: an integer that might be associated with a Smack label
  *
- * Returns a pointer to the appropraite Smack label if there is one,
+ * Returns a pointer to the appropriate Smack label if there is one,
  * otherwise a pointer to the invalid Smack label.
  */
 char *smack_from_secid(const u32 secid)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 410825a4439..9831a39c11f 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1804,7 +1804,7 @@ static void smack_set_catset(char *catset, struct netlbl_lsm_secattr *sap)
  * Casey says that CIPSO is good enough for now.
  * It can be used to effect.
  * It can also be abused to effect when necessary.
- * Appologies to the TSIG group in general and GW in particular.
+ * Apologies to the TSIG group in general and GW in particular.
  */
 static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp)
 {
@@ -2540,7 +2540,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         switch (sbp->s_magic) {
         case SMACK_MAGIC:
                 /*
-                 * Casey says that it's a little embarassing
+                 * Casey says that it's a little embarrassing
                  * that the smack file system doesn't do
                  * extended attributes.
                  */
@@ -3094,7 +3094,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         /*
          * We need to decide if we want to label the incoming connection here
          * if we do we only need to label the request_sock and the stack will
-         * propogate the wire-label to the sock when it is created.
+         * propagate the wire-label to the sock when it is created.
          */
         hdr = ip_hdr(skb);
         addr.sin_addr.s_addr = hdr->saddr;
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 90d1bbaaa6f..f93460156dc 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -208,7 +208,7 @@ static ssize_t smk_write_load_list(struct file *file, const char __user *buf,
         if (*ppos != 0)
                 return -EINVAL;
         /*
-         * Minor hack for backward compatability
+         * Minor hack for backward compatibility
          */
         if (count < (SMK_OLOADLEN) || count > SMK_LOADLEN)
                 return -EINVAL;
@@ -223,7 +223,7 @@ static ssize_t smk_write_load_list(struct file *file, const char __user *buf,
         }
 
         /*
-         * More on the minor hack for backward compatability
+         * More on the minor hack for backward compatibility
          */
         if (count == (SMK_OLOADLEN))
                 data[SMK_OLOADLEN] = '-';
@@ -927,7 +927,7 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
                 }
         } else {
                 /* we delete the unlabeled entry, only if the previous label
-                 * wasnt the special CIPSO option */
+                 * wasn't the special CIPSO option */
                 if (skp->smk_label != smack_cipso_option)
                         rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
                                         &skp->smk_host.sin_addr, &skp->smk_mask,
diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
index bbada7ca1b9..3312e5624f2 100644
--- a/security/tomoyo/load_policy.c
+++ b/security/tomoyo/load_policy.c
@@ -23,7 +23,7 @@ static bool tomoyo_policy_loader_exists(void)
          * If the initrd includes /sbin/init but real-root-dev has not
          * mounted on / yet, activating MAC will block the system since
          * policies are not loaded yet.
-         * Thus, let do_execve() call this function everytime.
+         * Thus, let do_execve() call this function every time.
          */
         struct path path;