Kernal Panic when stopping or uninstalling DLP agent on Mac OSX

Products

• Data Loss Prevention

Issue/Introduction

When attempting to stop or uninstall the mac agent there is is a kernal panic error

** Panic Report ***

panic(cpu 0 caller 0xffffff8003dff085): Kernel trap at 0xffffff7f894250fc, type 14=page fault, registers:

CR0: 0x000000008001003b, CR2: 0xfffffcffffffffff, CR3: 0x00000003e1df1008, CR4: 0x00000000003627e0

RAX: 0x0000000000000000, RBX: 0xfffffcffffffffff, RCX: 0x0000000000090000, RDX: 0xfffffd0000090000

RSP: 0xffffff920422bae0, RBP: 0xffffff920422baf0, RSI: 0xffffff7f894307fa, RDI: 0xfffffd0000091520

R8:  0x000000000000004c, R9:  0x00000000ac00e300, R10: 0xd80b3b1670d60027, R11: 0x00000000002d08f5

R12: 0xffffff7f89430d45, R13: 0xffffff804eece8c0, R14: 0xffffff7f894307c7, R15: 0xffffff805375c500

RFL: 0x0000000000010296, RIP: 0xffffff7f894250fc, CS:  0x0000000000000008, SS:  0x0000000000000010

Fault CR2: 0xfffffcffffffffff, Error code: 0x0000000000000000, Fault CPU: 0x0, PL: 0, VF: 1

 

Backtrace (CPU 0), Frame : Return Address

0xffffff920422b770 : 0xffffff8003ce950c

0xffffff920422b7f0 : 0xffffff8003dff085

0xffffff920422b9d0 : 0xffffff8003c9a543

0xffffff920422b9f0 : 0xffffff7f894250fc

0xffffff920422baf0 : 0xffffff7f89424fa5

0xffffff920422bb40 : 0xffffff7f89424bff

0xffffff920422bb80 : 0xffffff7f89429466

0xffffff920422bba0 : 0xffffff7f894293ab

0xffffff920422bbd0 : 0xffffff7f8942877f

0xffffff920422bbf0 : 0xffffff7f8942fdc4

0xffffff920422bc20 : 0xffffff7f8943018a

0xffffff920422bc40 : 0xffffff7f8942f08c

0xffffff920422bc70 : 0xffffff8004160a6b

0xffffff920422bcb0 : 0xffffff80041c9d89

0xffffff920422bdf0 : 0xffffff80041da0b4

0xffffff920422bee0 : 0xffffff80041d9e26

0xffffff920422bf50 : 0xffffff8004224765

0xffffff920422bfb0 : 0xffffff8003c9ad36

      Kernel Extensions in backtrace:

         com.symantec.dlp.fsd(14.6)[7BCED6FA-BC11-3001-9D0B-D71995D9A0DB]@0xffffff7f89422000->0xffffff7f89436fff

Environment

OSX 10.11.x, 10.12.x, 10.13.x

Symantec Data Loss Prevention MAC Endpoint Agent

Cause

This issue has been seen when the version of OSX is upgraded past the version of OSX that is supported by the installed version of DLP agent. For example if the OS has the DLP 14.6.0200.01053 DLP agent and the OS is upgraded from 10.12.2 to 10.12.6 then the agent is no longer on a supported version of the operating system. 

Resolution

There are two options to resolve this issue:

Option 1: Disable the Agent then uninstall

1. Go to the agent overview in the console

2. Select the target agent machine and then select to disable that agent

3. Wait for the agent configuration polling interval

4. Uninstall the agent

 

Option 2: If the agent can not be disabled then a safe mode boot uninstall is required

1. Reboot the machine in to safe mode

2. Run the agent uninstall (see TECH247833 for details)