there s an old patch < theopolis> added to thrift in <https osquery #core

there’s an old patch <@U09M563C7> added to thrift ...

groob

01/15/2019, 3:26 PM

there’s an old patch @theopolis added to thrift in https://github.com/facebook/osquery/blob/experimental/tools/provision/formula/thrift.rb it’s possible that it’s not being applied to the linux builds?

akindyakov

01/15/2019, 6:31 PM

Yes, it is possible. Let me check this out

groob

01/16/2019, 9:37 PM

any insights yet?

akindyakov

01/17/2019, 6:21 PM

So sorry, didn't have a chance to look on it today. Probably will do it tomorrow.

akindyakov

01/18/2019, 1:06 PM

Ok, I could not reproduce the problem on experimental build either on debug and release builds. Is it only

master

branch failure?

groob

01/18/2019, 1:12 PM

Possible.. are you building on linux?

akindyakov

01/18/2019, 1:16 PM

Yep, ubuntu 18.04.1

groob

01/18/2019, 2:14 PM

Ok. I’ve been pulling the binary from master. Interesting

groob

01/18/2019, 2:14 PM

I’ll build on Linux with buck today and update the issue

groob

01/18/2019, 2:34 PM

@akindyakov can you try reversing the arguments:

Copy code

"query": "select * from users cross join shell_history using (uid);",

groob

01/18/2019, 2:35 PM

i noticed that i don’t get the issue with

SELECT * FROM shell_history JOIN users on (uid);

akindyakov

01/18/2019, 4:38 PM

There is no crash in my test even with your query, but I can see in the log:

Copy code

Thrift: Fri Jan 18 16:37:42 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
I0118 16:37:42.519556  7636 extensions.cpp:309] Extension UUID 22549 has gone away

. It it the thing what you talking about?

groob

01/18/2019, 4:41 PM

yes, there’s an interrupt on thrift

groob

01/18/2019, 4:42 PM

Copy code

Thrift: Thu Dec 13 20:30:08 2018 TSocket::read() THRIFT_POLL() Interrupted system call
Thrift: Thu Dec 13 20:30:08 2018 TConnectedClient died: Unknown: Interrupted system call

this happens too

groob

01/18/2019, 4:42 PM

and

Copy code

2019/01/15 15:12:52 extension ping failed: write unix @->/osq/osquery.sock: write: broken pipe
Thrift: Tue Jan 15 15:12:52 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
I0115 15:12:52.873929    19 extensions.cpp:304] Extension UUID 63914 has gone away

akindyakov

01/18/2019, 4:54 PM

Yes, I see. I will have a look and fix it if possible. Thank you for your help to reproduce it!

akindyakov

01/23/2019, 11:11 AM

Commented in https://github.com/facebook/osquery/issues/5326 Sorry for being late, it took some time. I'll make some commits in order to fix it for now and attach them to this issue.

Open in Slack

Previous Next