Seccomp: replacing security modules?

it doesn't really matter how a call to open() is hooked into, what matters is what checks are done, and the checks done for SELinux are going to be very different than the checks done by AppArmor (and they will be looking at very different datastructures to determine if the access should be allowed), even if they are both hooking into the same tracepoints to implement their check.

I like the concept, it would be a lot of churn for the existing LSM modules to change from using the LSM hooks to using the trace hooks, but if it allows for layered policy enforcers (what have previously been called LSM modules), this would probably make it worth it by itself.