Unique audit record type ranges for individual LSMs

Hello - The AppArmor project would like for AppArmor audit records to be supported by the audit-userspace tools, such as ausearch, but it requires some coordination between the linux-security-module and linux-audit lists. This was raised as a feature request years ago in Ubuntu and more recently in Debian: https://launchpad.net/bugs/1117804 https://bugs.debian.org/872726 The quick summary of the problem at hand is that the audit-userspace project requires that each LSM use a unique record type range for audit records while the kernel's common_lsm_audit() function uses the same record type (1400) for all records. SELinux, AppArmor, and SMACK are all using common_lsm_audit() today and, therefore, the 1400-1499 range. While it will be potentially painful to switch, the AppArmor project is considering to use a unique range in order for audit-userspace to support AppArmor audit records. IMHO, SMACK would be free to continue using 1400-1499 as long as they don't need audit-userspace support and SELinux would continue using 1400-1499. Steve Grubb previously told me that he intends 1500-1599 to be used by AppArmor: https://www.redhat.com/archives/linux-audit/2014-May/msg00119.html John Johansen tells me that AppArmor previously used the 1500-1599 range before AppArmor was upstreamed. There's a conflicting comment in the kernel stating that 1500-1599 is to by used by kernel LSPP events. As far as I can tell, there were never any kernel LSPP events that used the range. Steve is the one that added that comment so I think it is a safe range for AppArmor to use: https://git.kernel.org/linus/90d526c074ae5db484388da56c399acf892b6c17 Considering audit-userspace's stance, does the LSM community agree that common_lsm_audit() should be modified to accept an audit record type parameter to pass on to audit_log_start()? If so, does everyone agree that 1500-1599 would be acceptable for AppArmor to use? Tyler