Zweasta
06/19/2020, 11:29 PMreturn code 78
mean in osquery ?Jams
06/20/2020, 3:07 AMZweasta
06/20/2020, 3:13 AMprocess = subprocess.run(['osqueryi', '--json', 'select * from os_version'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, universal_newlines=True)
print(process.stdout)
gives no output and when I checked the return code it says 78
Jams
06/20/2020, 3:34 AMZweasta
06/20/2020, 3:49 AMJams
06/20/2020, 4:29 AMosqueryd
with filesystem or tls logging.subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=use_shell, universal_newlines=True)
Zweasta
06/20/2020, 11:49 AM$osqueryi --json 'select * from os_version'
[
{"build":"","codename":"","major":"7","minor":"8","name":"CentOS Linux","patch":"2003","platform":"rhel","platform_like":"rhel","version":"CentOS Linux release 7.8.2003 (Core)"}
]
$echo $?
78
"]"
in the above output) it hangs for 2 seconds
and the osqueryi process ends. But, when I check the return code - It says 78seph
07/24/2020, 6:33 PMtouch no-exec
osqueryd --ephemeral --extension `pwd`/no-exec --allow-unsafe
Zweasta
07/24/2020, 6:52 PM--config_plugin=filesystem --config_path=/dev/null
seph
07/24/2020, 6:57 PMZweasta
07/24/2020, 7:11 PMseph
07/24/2020, 7:12 PMZweasta
07/24/2020, 7:13 PMtheopolis
07/24/2020, 8:12 PMseph
07/24/2020, 8:41 PMtheopolis
07/24/2020, 8:50 PMseph
07/24/2020, 8:50 PM