Title
#general
e

Evgeny Sidorov

02/13/2019, 6:32 PM
I would still like to finish this PR https://github.com/facebook/osquery/pull/4982, what should I do for that? Is
master
branch completely deprecated and I need to rebase everything to
experimental
?
s

seph

02/13/2019, 7:14 PM
Yeah, I think master is totally deprecated. I’m not sure if rebasing is enough to attention for review, but it is probably a needed step. (I’m not speaking to the technical or product side of the PR)
7:15 PM
Depending on your needs, you can also ship tables as extensions,
e

Evgeny Sidorov

02/14/2019, 5:37 AM
Thanks! Unfortunately I cannot ship this table as extension as I need to read audit socket and process the corresponding data. Moreover apparmor shares the same event code as selinux and I need to tell one type of events from another. Sure I'll do all the steps to move my work to
experimental
branch.
s

seph

02/14/2019, 3:08 PM
Is this the kind of thing that fits as a column on the existing events table, vs a new table?
e

Evgeny Sidorov

02/14/2019, 5:54 PM
it's a new table