On Wednesday, December 6, 2017 1:47:43 PM EST Casey Schaufler wrote: > > While it will be potentially painful to switch, the AppArmor project is > > considering to use a unique range in order for audit-userspace to > > support AppArmor audit records. IMHO, SMACK would be free to continue > > using 1400-1499 as long as they don't need audit-userspace support and > > SELinux would continue using 1400-1499. > > Aside from the comment that says 1400-1499 are for SELinux, and the three > events (1400-1402) that are SELinux specific, the events really are general. > Why not add the AppArmor specifics to the 1400 range? Give them a generic > sounding name and you'll achieve consistency. Change the comment to say > "Security Module use" instead of "SELinux use".
I really don't know what the status is for user space support on the other LSMs. I couldn't tell you if the searching/reporting are broken or working just fine. Additionally, there is auditctl which has very selinux specific field options to audit on a variety of pieces of the labels. Does this make sense for other LSMs? Do other LSMs have different needs? I really have no idea. But one thing for sure...if we combine them all, I expect patches are needed for user space. By separating them out by event number or some identifier like lsm=, then we can have lsm specific fixups if necessary. -Steve -- AppArmor mailing list AppArmor@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor