DCS 6.8.2 Agent drivers do not load if RHEL is booted in secure UEFI mode

Products

• Data Center Security Server Advanced

Issue/Introduction

DCS 6.8.2 kernel modules do not support UEFI Secure boot on RHEL.

The following entry in /var/log/messages will show if RHEL is booted in secure mode.

      kernel: secureboot: Secure boot enabled

sisap.init file will show the error below:

insmod: ERROR: could not insert module /etc/symantec/sis/driver/3.10.0-1160.el7/sisap-x86_64-default.ko: Required key not available
02/02/21 18:36:06: sisap.init: error loading Symantec Data Center Security Server Agent AP driver

You can verify if UEFI Secure Boot is enable by executing the command below:

mokutil --sb-state

Alternatively you can check dmesg.txt log file from DCS Agent GAI. If enabled there will be entries as below: 

[    0.000000] secureboot: Secure boot enabled
[    0.000000] Kernel is locked down from EFI secure boot; see man kernel_lockdown.7

 

All DCS Agent drivers sisfim, sisevt, sisips init files will include an exception when loading the drivers : Required key not available 

Environment

DCS 6.8.2

Cause

DCS 6.8.2 kernel modules do not support UEFI Secure boot on RHEL 8.x

Resolution

In DCS 6.8.2 only IDS is supported in polling mode with UEFI Secure boot enabled. DCS 6.9.x has support for Secure boot

To allow all Agent features, you can load the DCS drivers on RHEL platforms by disabling secure boot from Hardware firmware/BIOS, or upgrading to DCS 6.9.2 or higher that supports the features.