From f62a5eb8dfc9f6e3b56dcf83924f365fae30e5f0 Mon Sep 17 00:00:00 2001 From: Alexander Kindyakov Date: Wed, 23 Jan 2019 11:26:02 -0800 Subject: [PATCH] Increase the amount of MaxRecvRetries for thrift socket (#5390) Summary: Pull Request resolved: https://github.com/facebook/osquery/pull/5390 to eliminate the effect of dropping privileges in other threads causing poll-ing EINTR errors in thrift. According to ref to [bugzilla.redhat](https://bugzilla.redhat.com/show_bug.cgi?id=473907) in case of changing privileges `glibc` sends SIGRT_1 to other threads which lead to poll be interrupted. On posix we can not have different credentials for thread of one process. Therefore the solution is either to do not use dropping privileges for the whole osquery process or patch all usages of poll in thrift code. I like first option more because playing with permissions of the whole `osqueryd` can cause unpredicted interferences between threads. For instance the same table can provide different results because some other thread dropping and regaining privileges at the same time. So, the solution for now I'd like to suggest is remove dropping privileges from safe places like reading files with known hostnames or shell history files. And because we can not interact with apt/rpm/yum databases as root and should drop to none user for it I'd suggest to increase the number of attempts to poll in case of EINTR. It can significantly eliminate the problem for now. To address the problem in issue: [#5326](https://github.com/facebook/osquery/issues/5326) Thanks fmanco for the help to investigate this problem. Reviewed By: fmanco Differential Revision: D13781886 fbshipit-source-id: 4b1f2b7d20c925cc19ba79cc0a2906b65e815c0b --- osquery/extensions/impl_thrift.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/osquery/extensions/impl_thrift.cpp b/osquery/extensions/impl_thrift.cpp index f77f7ac5..785f6bcb 100644 --- a/osquery/extensions/impl_thrift.cpp +++ b/osquery/extensions/impl_thrift.cpp @@ -28,6 +28,8 @@ #include "osquery/extensions/interface.h" +#include + namespace osquery { using namespace apache::thrift::protocol; @@ -311,6 +313,9 @@ void ExtensionClientCore::init(const std::string& path, bool manager) { client_ = std::make_unique(); client_->socket = std::make_shared(path); +#ifndef WIN32 + client_->socket->setMaxRecvRetries(std::numeric_limits::max()); +#endif client_->transport = std::make_shared(client_->socket); auto protocol = std::make_shared(client_->transport);