valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-06 17:45:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Increase the amount of MaxRecvRetries for thrift socket (#5390)

Browse Source 
Summary:
Pull Request resolved: https://github.com/facebook/osquery/pull/5390

to eliminate the effect of dropping privileges in other threads causing poll-ing EINTR errors in thrift.

According to ref to [bugzilla.redhat](https://bugzilla.redhat.com/show_bug.cgi?id=473907) in case of changing privileges `glibc` sends SIGRT_1 to other threads which lead to poll be interrupted. On posix we can not have different credentials for thread of one process. Therefore the solution is either to do not use dropping privileges for the whole osquery process or patch all usages of poll in thrift code. I like first option more because playing with permissions of the whole `osqueryd` can cause unpredicted interferences between threads. For instance the same table can provide different results because some other thread dropping and regaining privileges at the same time.

So, the solution for now I'd like to suggest is remove dropping privileges from safe places like reading files with known hostnames or shell history files. And because we can not interact with apt/rpm/yum databases as root and should drop to none user for it I'd suggest to increase the number of attempts to poll in case of EINTR. It can significantly eliminate the problem for now.

To address the problem in issue: [#5326](https://github.com/facebook/osquery/issues/5326)

Thanks fmanco for the help to investigate this problem.

Reviewed By: fmanco

Differential Revision: D13781886

fbshipit-source-id: 4b1f2b7d20c925cc19ba79cc0a2906b65e815c0b
This commit is contained in:
Alexander Kindyakov 2019-01-23 11:26:02 -08:00 committed by Facebook Github Bot
parent c83685866a
commit f62a5eb8df
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
osquery/extensions/impl_thrift.cpp
View File

@ -28,6 +28,8 @@
#include "osquery/extensions/interface.h"
#include <limits>
namespace osquery {
using namespace apache::thrift::protocol;
@ -311,6 +313,9 @@ void ExtensionClientCore::init(const std::string& path, bool manager) {
client_ = std::make_unique<ImplExtensionClient>();
client_->socket = std::make_shared<TPlatformSocket>(path);
#ifndef WIN32
client_->socket->setMaxRecvRetries(std::numeric_limits<int>::max());
#endif
client_->transport = std::make_shared<TBufferedTransport>(client_->socket);
auto protocol = std::make_shared<TBinaryProtocol>(client_->transport);