Hi everyone. Does anybody know if it's possible to run python extensions on current version of osqueryd ? I'm able to run my extension (script) without osquery and it works, I'm able to run is via

osqueryi --extension X

and it works too, but not when used via osqueryd, plugin getting registered, and that:

plugin X registered 
plugin X failed validation 
plugin X gone away

Can you run with

--verbose

to see if there's more output about what is happening? Is the extension process and osquery both running as

root

? Where is this message about "failed validation" coming from?

1. Running osqueryd in foreground, gives no relevant output except:

I1117 10:53:12.349642 22285 interface.cpp:137] Registering extension (trusted_apps, 3493, version=0.0.1, sdk=1.8.0)
I1117 10:53:12.349845 22285 registry_factory.cpp:107] Extension 3493 registered table plugin trusted_apps
I1117 10:53:13.017935 21122 extensions.cpp:316] Extension UUID 3493 initial check failed

1. Extension is running as systemd service, in order to ensure that it's running:

[Unit]
Description=OSQuery trusted apps extension table
Wants=osqueryd.service ## Ensuring OSQuery service file installed
After=osqueryd.service ## Ensuring extension starts service file installed

[Service]
Requires=osqueryd.service ## Ensuring osqueryd service is in running state before starting
User=root  ## Ensuring extension will have enough privileges to connect socket
Group=root ##
TimeoutStartSec=infinity   ## Ensuring osqueryd boots up properly before extension starts
ExecStartPre=/bin/sleep 10 ##
ExecStart=/usr/local/bin/osquery-trusted-apps.py --socket /var/osquery/osquery.em ## script privileges are set to 700
Restart=always

[Install]
WantedBy=multi-user.target

1. So service actually starting and is bale to connect to socket:

osquery-trusted-apps.service - OSQuery trusted apps extension table
     Loaded: loaded (/etc/systemd/system/osquery-trusted-binaries.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2021-11-17 10:43:37 EET; 2min 19s ago
   Main PID: 18849 (osquery-trusted)
      Tasks: 2 (limit: 38354)
     Memory: 7.8M
     CGroup: /system.slice/osquery-trusted-apps.service
             └─18849 /usr/bin/python3 /usr/local/bin/osquery-trusted-apps.py --socket /var/osquery/osquery.em

2.

Validation failed

is an output mentioned below, and it seems to be coming from osqueryd service, simultaneously with extension start

I1117 10:53:12.349642 22285 interface.cpp:137] Registering extension (trusted_apps, 3493, version=0.0.1, sdk=1.8.0)
I1117 10:53:12.349845 22285 registry_factory.cpp:107] Extension 3493 registered table plugin trusted_apps
I1117 10:53:13.017935 21122 extensions.cpp:316] Extension UUID 3493 initial check failed

Glad you have found a resolution -- should we update the extensions documentation?

Yeah I think it'll be very helpful to indicate that for extensions to autoload, any kind of extension file (be it native, or golang, python,..) has to have

.ext

extension