steffen
01/11/2017, 9:37 AMExecuting: sudo osqueryd --verbose --extensions_autoload=extensions.load --extensions_timeout=3 --extensions_interval=3 --logger_plugin bro --config_plugin update --allow_unsafe --log_result_events=0
I0111 10:27:50.133235 25250 init.cpp:364] osquery initialized [version=2.2.1-8-g0307ec3]
I0111 10:27:50.147181 25250 system.cpp:228] Found stale process for osqueryd (25229) removing pidfile
I0111 10:27:50.147239 25250 system.cpp:264] Writing osqueryd pid (25250) to /var/osquery/osqueryd.pidfile
W0111 10:27:50.147323 25250 extensions.cpp:323] Will not autoload extension with unsafe directory permissions: ./osquery/build/linux/osquery/external/extension_bro_osquery/bro-osquery.ext --interval 5
This happens for an extensions.load like this
./osquery/build/linux/osquery/external/extension_bro_osquery/bro-osquery.ext --interval 5
The "unsafe" error does not happen when removing the interval option. Is there any reason to prohibit the use for autoload extensions?