osquery-python icon indicating copy to clipboard operation
osquery-python copied to clipboard

BrokenPipeError when running deb_packages query

Open SarthakAdhikari opened this issue 3 years ago • 0 comments

Bug report

What operating system and version are you using?

Description: Ubuntu 20.04.3 LTS Release: 20.04 Codename: focal

What version of osquery are you using?

5.2.3

What steps did you take to reproduce the issue?

  1. Open a brand new EC2 Ubuntu instance

  2. Install osquery by performing the following

    sudo apt-get install -y gnupg software-properties-common python3-pip

    export debian_frontend=noninteractive
    export osquery_key=1484120ac4e9f8a1a577aeee97a80c63c9d8b80b

    sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $osquery_key
    sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
    sudo apt-get -y update
    sudo apt-get -y install osquery


   pip3 install osquery==3.0.7
  1. Run this small reproducible example:
    import osquery
    import time

    instance = osquery.SpawnInstance()
    instance.open()

    for i in range(5):
        # throws error in third iteration of `i`
        query = instance.client.query("select * from deb_packages")
        print(query.response)
        time.sleep(2)
  1. The following error during the third iteration of the loop:
        Traceback (most recent call last):
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 178, in write
            plus = self.handle.send(buff)
        BrokenPipeError: [Errno 32] Broken pipe

        During handling of the above exception, another exception occurred:

        Traceback (most recent call last):
        File "/home/ubuntu/osquery_demo.py", line 9, in <module>
            query = instance.client.query("select * from deb_packages")
        File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 181, in query
            self.send_query(sql)
        File "/home/ubuntu/.local/lib/python3.10/site-packages/osquery/extensions/ExtensionManager.py", line 190, in send_query
            self._oprot.trans.flush()
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TTransport.py", line 179, in flush
            self.__trans.write(out)
        File "/home/ubuntu/.local/lib/python3.10/site-packages/thrift/transport/TSocket.py", line 185, in write
            raise TTransportException(message="unexpected exception", inner=e)
        thrift.transport.TTransport.TTransportException: unexpected exception

What did you expect to see?

I expected osquery to return the query result for deb_packages 5 times(in the above demo example).

What did you see instead?

osquery successfully returned deb_packages two times in the loop but raised a BrokenPipeError exception on the third iteration of the loop.

SarthakAdhikari avatar May 09 '22 04:05 SarthakAdhikari