slevchenko
11/16/2021, 3:51 PMosqueryi --extension X
and it works too, but not when used via osqueryd, plugin getting registered, and that:
plugin X registered
plugin X failed validation
plugin X gone away
Mike Myers
11/16/2021, 7:52 PM--verbose
to see if there's more output about what is happening?
Is the extension process and osquery both running as root
?
Where is this message about "failed validation" coming from?slevchenko
11/17/2021, 9:11 AMI1117 10:53:12.349642 22285 interface.cpp:137] Registering extension (trusted_apps, 3493, version=0.0.1, sdk=1.8.0)
I1117 10:53:12.349845 22285 registry_factory.cpp:107] Extension 3493 registered table plugin trusted_apps
I1117 10:53:13.017935 21122 extensions.cpp:316] Extension UUID 3493 initial check failed
1. Extension is running as systemd service, in order to ensure that it's running:
[Unit]
Description=OSQuery trusted apps extension table
Wants=osqueryd.service ## Ensuring OSQuery service file installed
After=osqueryd.service ## Ensuring extension starts service file installed
[Service]
Requires=osqueryd.service ## Ensuring osqueryd service is in running state before starting
User=root ## Ensuring extension will have enough privileges to connect socket
Group=root ##
TimeoutStartSec=infinity ## Ensuring osqueryd boots up properly before extension starts
ExecStartPre=/bin/sleep 10 ##
ExecStart=/usr/local/bin/osquery-trusted-apps.py --socket /var/osquery/osquery.em ## script privileges are set to 700
Restart=always
[Install]
WantedBy=multi-user.target
1. So service actually starting and is bale to connect to socket:
osquery-trusted-apps.service - OSQuery trusted apps extension table
Loaded: loaded (/etc/systemd/system/osquery-trusted-binaries.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2021-11-17 10:43:37 EET; 2min 19s ago
Main PID: 18849 (osquery-trusted)
Tasks: 2 (limit: 38354)
Memory: 7.8M
CGroup: /system.slice/osquery-trusted-apps.service
└─18849 /usr/bin/python3 /usr/local/bin/osquery-trusted-apps.py --socket /var/osquery/osquery.em
2. Validation failed
is an output mentioned below, and it seems to be coming from osqueryd service, simultaneously with extension start
I1117 10:53:12.349642 22285 interface.cpp:137] Registering extension (trusted_apps, 3493, version=0.0.1, sdk=1.8.0)
I1117 10:53:12.349845 22285 registry_factory.cpp:107] Extension 3493 registered table plugin trusted_apps
I1117 10:53:13.017935 21122 extensions.cpp:316] Extension UUID 3493 initial check failed
/var/osquery/osquery.em
2. root:root
is an extension owner (that's known and expected requirement)
3. Python script ends with .ext
extensionMike Myers
11/18/2021, 5:33 PMslevchenko
11/18/2021, 5:53 PM.ext
extension