Nebula fails if osquery is not able to run a query

In Ubuntu 14, osquery fails when it tries to execute the following query:

- query_name: deb_packages
  query: SELECT t.unix_time AS query_time, deb.name, deb.version, deb.revision, deb.source AS package_source, deb.size, deb.arch FROM deb_packages AS deb JOIN time AS t;

I get the following error if I try to run this query manually using osqueryi:

osquery: error: failed to open package info file ‘/var/lib/dpkg//status’ for reading: Permission denied
terminate called without an active exception
Segmentation fault

The result object returned to nebula module does not contain any ‘data’ key, so the code fails and logs are not pushed for the whole group of nebula queries. Logs:

2017-09-26 20:15:08 [hubblestack.daemon][ERROR   ] Error executing schedule
Traceback (most recent call last):
  File "hubblestack/daemon.py", line 94, in main
  File "hubblestack/daemon.py", line 209, in schedule
  File "/opt/hubble/hubble-libs/hubblestack/extmods/modules/nebula_osquery.py", line 202, in queries
    for result in query_ret['data']:
KeyError: 'data'

[basepi]

Even if we fix the original error in the query, nebula should not fail so hard, so I’ll leave this open either way.

[basepi]

(The git issue is separate and should be in a separate issue)

Glad the new version of osquery helped. I still want to fix the underlying hard fail, so this isn’t as much of an issue in the future.