Skip to content

Commit 4cbe297

Browse files
authored
Fix handling of exceptions when osquery goes away (#83)
This resolves an issue where the extension does not shut down if osquery goes away unexpectedly (without sending a shutdown signal via Thrift). The scenario could be reliably reproduced by running `osqueryi`, connecting an extension, and then sending a `SIGKILL` to `osqueryi`. The exception thrown in the `start_watcher` function would be of type `thrift.transport.TTransport.TTransportException`, and would cause the watcher thread to exit without exiting the rest of the program. This is a possible fix for issues that users have experienced with extensions reconnecting after the Watchdog kills osquery.
1 parent 451045e commit 4cbe297

File tree

1 file changed

+13
-4
lines changed

1 file changed

+13
-4
lines changed

osquery/management.py

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -192,12 +192,21 @@ def start_watcher(client, interval):
192192
while True:
193193
status = client.extension_manager_client().ping()
194194
if status.code != 0:
195+
logging.error("Ping received nonzero status: %d", status)
195196
break
196197
time.sleep(interval)
197-
except socket.error:
198-
# The socket was torn down.
199-
pass
200-
os._exit(0)
198+
199+
except socket.error as e:
200+
logging.error("Ping received socket.error: %s", e)
201+
202+
except TTransport.TTransportException as e:
203+
logging.error("Ping received thrift.transport.TTransport.TTransportException: %s", e)
204+
205+
except Exception as e:
206+
logging.error("Ping received unknown exception: %s", e)
207+
208+
finally:
209+
os._exit(1)
201210

202211

203212
def start_extension(name="<unknown>",

0 commit comments

Comments
 (0)