diff --git a/dm-bht-userspace.h b/dm-bht-userspace.h
index 96f5571..d480b55 100644
--- a/dm-bht-userspace.h
+++ b/dm-bht-userspace.h
@@ -5,8 +5,8 @@
  *
  * This file is released under the GPLv2.
  */
-#ifndef __LINUX_DM_BHT_USERSPACE_H
-#define __LINUX_DM_BHT_USERSPACE_H
+#ifndef VERITY_DM_BHT_USERSPACE_H_
+#define VERITY_DM_BHT_USERSPACE_H_
 
 #ifdef __cplusplus
 extern "C" {
@@ -24,4 +24,4 @@
 }
 #endif
 
-#endif /* __LINUX_DM_BHT_USERSPACE_H */
+#endif  // VERITY_DM_BHT_USERSPACE_H_
diff --git a/dm-bht.h b/dm-bht.h
index 19a2d4a..eac9663 100644
--- a/dm-bht.h
+++ b/dm-bht.h
@@ -6,8 +6,8 @@
  *
  * This file is released under the GPLv2.
  */
-#ifndef __LINUX_DM_BHT_H
-#define __LINUX_DM_BHT_H
+#ifndef VERITY_DM_BHT_H_
+#define VERITY_DM_BHT_H_
 
 #ifdef __cplusplus
 extern "C" {
@@ -48,9 +48,9 @@
    */
   void* io_context; /* Reserve a pointer for use during io */
   /* data should only be non-NULL if fully populated. */
+  // NOLINTNEXTLINE(readability/multiline_comment)
   u8* nodes; /* The hash data used to verify the children.
-              * Guaranteed to be page-aligned.
-              */
+              * Guaranteed to be page-aligned. */
 };
 
 /* dm_bht_level
@@ -189,4 +189,4 @@
 }
 #endif
 
-#endif /* __LINUX_DM_BHT_H */
+#endif  // VERITY_DM_BHT_H_
diff --git a/dm-bht_unittest.cc b/dm-bht_unittest.cc
index 1f4a46e..dba9c8c 100644
--- a/dm-bht_unittest.cc
+++ b/dm-bht_unittest.cc
@@ -23,7 +23,7 @@
 #include "dm-bht.c"
 #endif
 }
-#include "dm-bht-userspace.h"
+#include "verity/dm-bht-userspace.h"
 
 void* my_memalign(size_t boundary, size_t size) {
   void* memptr;
@@ -44,7 +44,7 @@
   sector_t sectors;
   // This should fail.
   unsigned int blocks, total_blocks = 16384;
-  u8* data = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* data = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
   u8* hash_data;
 
   blocks = total_blocks;
@@ -106,7 +106,7 @@
                  const char* salt,
                  void* hash_data) {
     struct dm_bht bht;
-    u8* data = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+    u8* data = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
     memset(data, 0, PAGE_SIZE);
 
@@ -163,7 +163,7 @@
   static const char kRootDigest[] =
       "45d65d6f9e5a962f4d80b5f1bd7a918152251c27bdad8c5f52b590c129833372";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -185,7 +185,7 @@
   static const char kRootDigest[] =
       "2d3a43008286f56536fa24dcdbf14d342f0548827e374210415c7be0b610d2ba";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -207,7 +207,7 @@
   static const char kRootDigest[] =
       "15d5a180b5080a1d43e3fbd1f2cd021d0fc3ea91a8e330bad468b980c2fd4d8b";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -229,7 +229,7 @@
   static const char kRootDigest[] =
       "dc8cec4220d388b05ba75c853f858bb8cc25edfb1d5d2f3be6bdf9edfa66dc6a";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -251,7 +251,7 @@
   static const char kRootDigest[] =
       "10832dd62c427bcf68c56c8de0d1f9c32b61d9e5ddf43c77c56a97b372ad4b07";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -273,7 +273,7 @@
   static const char kRootDigest[] =
       "45d65d6f9e5a962f4d80b5f1bd7a918152251c27bdad8c5f52b590c129833372";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -285,7 +285,7 @@
 
   // Corrupt one has hblock
   static const unsigned int kBadBlock = 256;
-  u8* bad_hash_block = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* bad_hash_block = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
   memset(bad_hash_block, 'A', PAGE_SIZE);
   EXPECT_EQ(dm_bht_store_block(bht_, kBadBlock, bad_hash_block), 0);
 
@@ -317,7 +317,7 @@
       "45d65d6f9e5a962f4d80b5f1bd7a918152251c27bdad8c5f52b590c129833372";
   dm_bht_set_root_hexdigest(bht_, reinterpret_cast<const u8*>(kRootDigest));
   // A corrupt page
-  u8* bad_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* bad_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(bad_page, 'A', PAGE_SIZE);
 
@@ -340,7 +340,7 @@
   static const char salt[] =
       "01ad1f06255d452d91337bf037953053cc3e452541db4b8ca05811bf3e2b6027";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
@@ -365,7 +365,7 @@
       "01ad1f06255d452d91337bf037953053cc3e452541db4b8ca05811bf3e2b6027b2188a1"
       "d";
   // A page of all zeros
-  u8* zero_page = (u8*)my_memalign(PAGE_SIZE, PAGE_SIZE);
+  u8* zero_page = static_cast<u8*>(my_memalign(PAGE_SIZE, PAGE_SIZE));
 
   memset(zero_page, 0, PAGE_SIZE);
 
diff --git a/file_hasher.cc b/file_hasher.cc
index 81c20b2..4febfbd 100644
--- a/file_hasher.cc
+++ b/file_hasher.cc
@@ -106,8 +106,10 @@
   PLOG_IF(FATAL, !source.Read(sizeof(buf), buf))
       << "Failed to read the random source";
 
-  for (size_t i = 0; i < sizeof(buf); ++i)
+  for (size_t i = 0; i < sizeof(buf); ++i) {
+    // NOLINTNEXTLINE(runtime/printf)
     sprintf(&random_salt_[i * 2], "%02x", buf[i]);
+  }
   random_salt_[sizeof(random_salt_) - 1] = '\0';
 
   return random_salt_;
diff --git a/file_hasher.h b/file_hasher.h
index 5d9e40a..d48c303 100644
--- a/file_hasher.h
+++ b/file_hasher.h
@@ -9,8 +9,8 @@
 
 #include "verity/dm-bht.h"
 #include "verity/dm-bht-userspace.h"
-#include "verity/simple_file/file.h"
 #include "verity/include/asm/page.h"
+#include "verity/simple_file/file.h"
 
 namespace verity {
 // FileHasher takes a simple_file::File object and reads in |block_size|
@@ -40,7 +40,7 @@
   }
   virtual const char* salt(void) { return salt_; }
 
-  virtual ~FileHasher(){};
+  virtual ~FileHasher() = default;
   static int WriteCallback(void* file,
                            sector_t start,
                            u8* dst,
diff --git a/include/asm-generic/bitops/fls.h b/include/asm-generic/bitops/fls.h
index c809753..7741e42 100644
--- a/include/asm-generic/bitops/fls.h
+++ b/include/asm-generic/bitops/fls.h
@@ -1,8 +1,10 @@
+// NOLINT(legal/copyright)
+
 /* Duplicated under the terms of the GPLv2 from
  * linux-kernel:/include/asm-generic/bitops/fls.h
  */
-#ifndef _ASM_GENERIC_BITOPS_FLS_H_
-#define _ASM_GENERIC_BITOPS_FLS_H_
+#ifndef VERITY_INCLUDE_ASM_GENERIC_BITOPS_FLS_H_
+#define VERITY_INCLUDE_ASM_GENERIC_BITOPS_FLS_H_
 
 /**
  * fls - find last (most-significant) bit set
@@ -40,4 +42,4 @@
   return r;
 }
 
-#endif /* _ASM_GENERIC_BITOPS_FLS_H_ */
+#endif  // VERITY_INCLUDE_ASM_GENERIC_BITOPS_FLS_H_
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index 7500395..dd3ed10 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -10,8 +10,8 @@
  *
  */
 
-#ifndef _CRYPTO_HASH_H
-#define _CRYPTO_HASH_H
+#ifndef VERITY_INCLUDE_CRYPTO_HASH_H_
+#define VERITY_INCLUDE_CRYPTO_HASH_H_
 
 #include <linux/crypto.h>
 
@@ -53,4 +53,4 @@
   return desc->__ctx;
 }
 
-#endif /* _CRYPTO_HASH_H */
+#endif  // VERITY_INCLUDE_CRYPTO_HASH_H_
diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
index 5635640..ccc957e 100644
--- a/include/crypto/internal/hash.h
+++ b/include/crypto/internal/hash.h
@@ -15,4 +15,4 @@
   return 0;
 }
 
-#endif
+#endif  // VERITY_INCLUDE_CRYPTO_INTERNAL_HASH_H_
diff --git a/include/crypto/md5.h b/include/crypto/md5.h
index f131f88..8378ecc 100644
--- a/include/crypto/md5.h
+++ b/include/crypto/md5.h
@@ -1,5 +1,7 @@
-#ifndef _CRYPTO_MD5_H
-#define _CRYPTO_MD5_H
+// NOLINT(legal/copyright)
+
+#ifndef VERITY_INCLUDE_CRYPTO_MD5_H_
+#define VERITY_INCLUDE_CRYPTO_MD5_H_
 
 #include <linux/types.h>
 
@@ -14,4 +16,4 @@
   u64 byte_count;
 };
 
-#endif
+#endif  // VERITY_INCLUDE_CRYPTO_MD5_H_
diff --git a/include/crypto/sha.h b/include/crypto/sha.h
index 65ddde1..f55da25 100644
--- a/include/crypto/sha.h
+++ b/include/crypto/sha.h
@@ -1,9 +1,11 @@
+// NOLINT(legal/copyright)
+
 /*
  * Common values for SHA algorithms
  */
 
-#ifndef _CRYPTO_SHA_H
-#define _CRYPTO_SHA_H
+#ifndef VERITY_INCLUDE_CRYPTO_SHA_H_
+#define VERITY_INCLUDE_CRYPTO_SHA_H_
 
 #include <linux/types.h>
 
@@ -82,4 +84,4 @@
   u8 buf[SHA512_BLOCK_SIZE];
 };
 
-#endif
+#endif  // VERITY_INCLUDE_CRYPTO_SHA_H_
diff --git a/include/linux/bitops.h b/include/linux/bitops.h
index 33f9ded..eaf03d4 100644
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -11,16 +11,18 @@
 #define BITS_PER_BYTE 8
 /* For verity, this is based on the compilation target and not
  * CONFIG_64BIT. */
+// NOLINTNEXTLINE(runtime/int)
 #define BITS_PER_LONG (sizeof(long) * BITS_PER_BYTE)
 
 #define BIT(nr) (1UL << (nr))
 #define BIT_MASK(nr) (1UL << ((nr) % BITS_PER_LONG))
 #define BIT_WORD(nr) ((nr) / BITS_PER_LONG)
+// NOLINTNEXTLINE(runtime/int)
 #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
 
 #include <asm-generic/bitops/fls.h>
-#include <strings.h>
 #include <linux/types.h>
+#include <strings.h>
 
 /**
  * rol32 - rotate a 32-bit value left
@@ -40,4 +42,4 @@
   return (word >> shift) | (word << (32 - shift));
 }
 
-#endif /* VERITY_INCLUDE_LINUX_BITOPS_H_ */
+#endif  //  VERITY_INCLUDE_LINUX_BITOPS_H_
diff --git a/include/linux/bug.h b/include/linux/bug.h
index f55709a..a55055e 100644
--- a/include/linux/bug.h
+++ b/include/linux/bug.h
@@ -20,4 +20,4 @@
     }                                                                    \
   }
 
-#endif /* VERITY_INCLUDE_LINUX_BUG_ */
+#endif  // VERITY_INCLUDE_LINUX_BUG_H_
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 61e9a6c..b25ca74 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -8,8 +8,8 @@
 #ifndef VERITY_INCLUDE_LINUX_CRYPTO_H_
 #define VERITY_INCLUDE_LINUX_CRYPTO_H_
 
-#include <linux/string.h>
 #include <linux/kernel.h>
+#include <linux/string.h>
 
 #define CRYPTO_ALG_TYPE_SHASH 0
 
diff --git a/include/linux/cryptohash.h b/include/linux/cryptohash.h
index 61043f7..fe7ff9f 100644
--- a/include/linux/cryptohash.h
+++ b/include/linux/cryptohash.h
@@ -1,5 +1,7 @@
-#ifndef __CRYPTOHASH_H
-#define __CRYPTOHASH_H
+// NOLINT(legal/copyright)
+
+#ifndef VERITY_INCLUDE_LINUX_CRYPTOHASH_H_
+#define VERITY_INCLUDE_LINUX_CRYPTOHASH_H_
 
 #define SHA_DIGEST_WORDS 5
 #define SHA_MESSAGE_BYTES (512 /*bits*/ / 8)
@@ -13,4 +15,4 @@
 
 void md5_transform(__u32* hash, __u32 const* in);
 
-#endif
+#endif  // VERITY_INCLUDE_LINUX_CRYPTOHASH_H_
diff --git a/logging/logging.h b/logging/logging.h
index 7ffe7c8..1e76ab0 100644
--- a/logging/logging.h
+++ b/logging/logging.h
@@ -29,6 +29,7 @@
           MessageType type,
           int errn,
           const char* file,
+          // NOLINTNEXTLINE(runtime/int)
           unsigned long line)
       : type_(type), log_errno_(errn), file_(file), line_(line) {
 #ifdef NDEBUG
@@ -87,6 +88,7 @@
   MessageType type() const { return type_; }
   int log_errno() const { return log_errno_; }
   const char* file() const { return file_; }
+  // NOLINTNEXTLINE(runtime/int)
   unsigned long line() const { return line_; }
 
   void set_level(MessageLevel l) { level_ = l; }
@@ -96,6 +98,7 @@
   MessageType type_;
   int log_errno_;
   const char* file_;
+  // NOLINTNEXTLINE(runtime/int)
   unsigned long line_;
 };
 }  // namespace logging
diff --git a/simple_file/env.h b/simple_file/env.h
index 38dc115..af6ed31 100644
--- a/simple_file/env.h
+++ b/simple_file/env.h
@@ -10,8 +10,8 @@
 #include <fcntl.h>
 #include <sys/ioctl.h>
 #include <sys/mount.h>
-#include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include "verity/logging.h"
diff --git a/simple_file/file.h b/simple_file/file.h
index f9174ea..f5b22c1 100644
--- a/simple_file/file.h
+++ b/simple_file/file.h
@@ -4,13 +4,13 @@
 //
 // Simple wrapper for synchronous file operations
 // TODO(wad) clean up the API then propose moving it to a standalone location.
-#ifndef VERITY_SIMPLE_FILE_FILE_H__
-#define VERITY_SIMPLE_FILE_FILE_H__ 1
+#ifndef VERITY_SIMPLE_FILE_FILE_H_
+#define VERITY_SIMPLE_FILE_FILE_H_
 
 #include <fcntl.h>
 #include <inttypes.h>
-#include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/types.h>
 #include <unistd.h>
 
 #include "verity/logging.h"
@@ -57,4 +57,4 @@
 };
 
 }  // namespace simple_file
-#endif  // VERITY_SIMPLE_FILE_H__
+#endif  // VERITY_SIMPLE_FILE_FILE_H_
diff --git a/utils.cc b/utils.cc
index 5646694..5ffb1a3 100644
--- a/utils.cc
+++ b/utils.cc
@@ -13,6 +13,7 @@
             const uint8_t *digest,
             unsigned int digest_length) {
   for (unsigned int i = 0; i < digest_length ; i++) {
+    // NOLINTNEXTLINE(runtime/printf)
     sprintf(hexdigest+(2*i), "%02x", static_cast<int>(digest[i]));
   }
 }
diff --git a/verity_main.cc b/verity_main.cc
index 46fdcb9..97e042c 100644
--- a/verity_main.cc
+++ b/verity_main.cc
@@ -69,23 +69,21 @@
       print_usage(argv[0]);
       return -1;
     }
-    if (!strcmp(key, "alg"))
+    if (!strcmp(key, "alg")) {
       alg = val;
-    else if (!strcmp(key, "payload"))
+    } else if (!strcmp(key, "payload")) {
       payload = val;
-    else if (!strcmp(key, "payload_blocks"))
+    } else if (!strcmp(key, "payload_blocks")) {
       payload_blocks = parse_blocks(val);
-    else if (!strcmp(key, "hashtree"))
+    } else if (!strcmp(key, "hashtree")) {
       hashtree = val;
-    else if (!strcmp(key, "root_hexdigest"))
+    } else if (!strcmp(key, "root_hexdigest")) {
       // Silently drop root_hexdigest for now...
-      ;
-    else if (!strcmp(key, "mode"))
+    } else if (!strcmp(key, "mode")) {
       // Silently drop the mode for now...
-      ;
-    else if (!strcmp(key, "salt"))
+    } else if (!strcmp(key, "salt")) {
       salt = val;
-    else {
+    } else {
       fprintf(stderr, "bogus key: '%s'\n", key);
       print_usage(argv[0]);
       return -1;