Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Windows: Detect when an extension has not started #7355

Merged
merged 2 commits into from
Nov 1, 2021

Conversation

ameily
Copy link
Contributor

@ameily ameily commented Oct 22, 2021

Detect when a Windows extension has not started, which mirror how the Posix PlatformProcess operates. The problem was that GetExitCodeProcess() was being called with an invalid handle, which returns a value indicating that the process is still active. So, extensions were never executed.

The fix is to check if the handle is valid prior to checking if the process is alive.

fixes #7324

@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Oct 22, 2021

CLA Signed

The committers are authorized under a signed CLA.

@mike-myers-tob mike-myers-tob added bug extensions Related to osquery extension SDK or to extensions themselves Windows labels Oct 23, 2021
@mike-myers-tob mike-myers-tob changed the title Detect when a windows extension has not started Windows: Detect when an extension has not started Oct 23, 2021
@ameily ameily marked this pull request as ready for review October 24, 2021 20:51
@ameily ameily requested review from a team as code owners October 24, 2021 20:51
@directionless directionless merged commit 39c8651 into osquery:master Nov 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug extensions Related to osquery extension SDK or to extensions themselves Windows
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Extensions can no longer be started by osquery on Windows
4 participants