Carbon Black Cloud: KEXT Approval failing on 3.5.x sensors

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• KEXT approval fails on MAC sensors with versions 3.5.1 and above.
• Sensor.log :

01/28/21 14:04:18 [INFO] 65ef detected not loaded kext com.carbonblack.defense.kext
01/28/21 14:04:18 [INFO] 65ef found system extension waiting for activation
01/28/21 14:04:18 [INFO] 65ef found system extension waiting for activation
01/28/21 14:04:18 [ERROR] 65ef repairToSystemExtension: Failed to load SYSEXT. Received error code: 254; Repmgr start-up will retry.

 

Environment

• Endpoint Sensor version : 3.5.1.x
• Apple macOS: 10.16.x and above
• Carbon Black Cloud: All supported versions

Cause

Although the user is trying to get the KEXT approval , the sytem is trying to load the System Extensions (SYSEXT), which is the new format for MAC Big sur.
 

Resolution

• Instead of KEXT approval steps should be followed for SYSEXT approval.
• Approving the System Extension: https://community.carbonblack.com/t5/Documentation-Downloads/Carbon-Black-Cloud-Approving-the-macOS-Sensor-s-System-Extension/ta-p/97893