Giter Club home page Giter Club logo

Comments (4)

getvictor avatar getvictor commented on July 19, 2024

If the extension fails to load, it should sleep instead of trying again. sleep can be added here:

_return.code = (int)extensions::ExtensionCode::EXT_FAILED;

from osquery.

Smjert avatar Smjert commented on July 19, 2024

I wouldn't put the sleep so deep; that's more a generic interface toward thrift.

That being said, there are two pieces at play here, the watcher/watchdog which attempts to start the extensions passed via --extensions_autoload, and the worker that waits some time the extensions to be registered, if extensions_require is given.

The watcher starts the extensions and if they die, they get restarted immediately, or at least it attempts to, but limits itself and warns about the fact that the extension is being restarted too quickly.
The logic is here:

createExtension(extension.first);

Then you have the worker which waits for the extensions to be registered before proceeding with its own initialization internally, because if the extensions are providing some fundamental feature (like a config or logging plugin), then that will cause failures for sure in the worker.
This is handled here:

auto status = applyExtensionDelay(([type, name](bool& stop) {

But worker and watcher do not communicate in this.

Furthermore, I'm not sure that extensions_require was ever intended to have the osquery worker exit if it cannot register the extensions in time (or if the extensions themselves are not started in time).
You have have to consider that extension may be loaded manually and not be controlled by osquery.

If an extension is providing a fundamental feature, like a config or logger plugin which is enabled via flags, osquery will fail anyway to enable them, and will exit.
If the extensions provide tables, then simply osquery won't be able to query those and the rest of the functionality will work, which might be desirable, instead of not having access to osquery at all.
Some do still put extensions_require with extensions providing tables because they don't want to see a query returning with an error (once), due to the table not being found, if the extension doesn't really have an issue.

I would also consider this desire here: #8067

EDIT: Oh and the definition of "bad extension" I think needs to be clarified. When the watcher is launching a managed extension, it restarts it if it exits, but doesn't know why it exited.
It just treats it as the worker; it's an important process that the user asked to keep alive.

from osquery.

getvictor avatar getvictor commented on July 19, 2024

Yes, I agree that --extensions_require doesn't seem useful for table extensions. I wouldn't want to specify it every time for every extension.

I opened a PR to change warnings to errors when extension could not be added: #8260

from osquery.

directionless avatar directionless commented on July 19, 2024

Yes, I agree that --extensions_require doesn't seem useful for table extensions. I wouldn't want to specify it every time for every extension.

If the tables are used for decorators, one might want this on table extensions

from osquery.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.