-
Notifications
You must be signed in to change notification settings - Fork 103
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Removing osquery-extension #838
Removing osquery-extension #838
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So what will actually populate osquery-extension.ext
into the options? I had imagined something around
launcher/cmd/launcher/extension.go
Line 215 in fae3d1e
func osqueryRunnerOptions(logger log.Logger, db *bbolt.DB, opts *launcher.Options) ([]runtime.OsqueryInstanceOption, error) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is looking pretty nice. Good to remove this stuff.
Could also remove the rosetta install in preinstall-darwin.sh
, but probably better in a separate PR.
@@ -456,6 +491,7 @@ func (opts *osqueryOptions) createOsquerydCommand(osquerydBinary string, paths * | |||
fmt.Sprintf("--extensions_autoload=%s", paths.extensionAutoloadPath), | |||
"--disable_extensions=false", | |||
"--extensions_timeout=20", | |||
"--extensions_require", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
extensions_require
take an argument of which extensions to wait for. Which should probably be set to the union of: autoload, config plugin, logger plugin, distributed plugin
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated, I should have RTFMed that first. Curious that even passing the option blank caused it to respect the extensions_timeout ... ultimately creating a race condition I suppose. Anyways, I think this is an overall improvement.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would bet there are bugs lurking
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm game for testing this as a nightly!
I don't know if we'll need to exempt tls
from the required extensions (and other osquery buildins) But we can test on the nightlies.
Removes the need for an additional osquery-extension.ext file to run launcher. It may have been required in the past in order to force osquery to wait for other extensions to load. However, now we can add the
extensions_require
flag when launching osquery and it will cause osquery to respect theextensions_timeout
flag before loading the rest of the configuration.Also adds new flag for autoloading extensions.