https://github.com/osquery/osquery logo
Powered by
#core
Title
# core
g

groob

01/15/2019, 3:26 PM
there’s an old patch @theopolis added to thrift in https://github.com/facebook/osquery/blob/experimental/tools/provision/formula/thrift.rb it’s possible that it’s not being applied to the linux builds?
a

akindyakov

01/15/2019, 6:31 PM
Yes, it is possible. Let me check this out
g

groob

01/16/2019, 9:37 PM
any insights yet?
a

akindyakov

01/17/2019, 6:21 PM
So sorry, didn't have a chance to look on it today. Probably will do it tomorrow.
Ok, I could not reproduce the problem on experimental build either on debug and release builds. Is it only 
master
branch failure?
g

groob

01/18/2019, 1:12 PM
Possible.. are you building on linux?
a

akindyakov

01/18/2019, 1:16 PM
Yep, ubuntu 18.04.1
g

groob

01/18/2019, 2:14 PM
Ok. I’ve been pulling the binary from master. Interesting
I’ll build on Linux with buck today and update the issue
@akindyakov can you try reversing the arguments:
Copy code
"query": "select * from users cross join shell_history using (uid);",
i noticed that i don’t get the issue with 
SELECT * FROM shell_history JOIN users on (uid);
a

akindyakov

01/18/2019, 4:38 PM
There is no crash in my test even with your query, but I can see in the log:
Copy code
Thrift: Fri Jan 18 16:37:42 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
I0118 16:37:42.519556  7636 extensions.cpp:309] Extension UUID 22549 has gone away
. It it the thing what you talking about?
g

groob

01/18/2019, 4:41 PM
yes, there’s an interrupt on thrift
Copy code
Thrift: Thu Dec 13 20:30:08 2018 TSocket::read() THRIFT_POLL() Interrupted system call
Thrift: Thu Dec 13 20:30:08 2018 TConnectedClient died: Unknown: Interrupted system call
this happens too
and
Copy code
2019/01/15 15:12:52 extension ping failed: write unix @->/osq/osquery.sock: write: broken pipe
Thrift: Tue Jan 15 15:12:52 2019 TSocket::open() connect() <Host:  Port: 0>Connection refused
I0115 15:12:52.873929    19 extensions.cpp:304] Extension UUID 63914 has gone away
a

akindyakov

01/18/2019, 4:54 PM
Yes, I see. I will have a look and fix it if possible. Thank you for your help to reproduce it!
Commented in https://github.com/facebook/osquery/issues/5326 Sorry for being late, it took some time. I'll make some commits in order to fix it for now and attach them to this issue.
Powered by