Carbon Black Cloud: macOS Sensor UI Process Does Not Restart After Stop Command is Issued by Root

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• A user running as root can stop the Carbon Black Cloud macOS sensor UI process with the "kill -STOP" command
• The Sensor UI process does not attempt to restart without intervention

 

Environment

• Carbon Black Cloud Sensor: All versions
• Apple macOS: All supported versions

Cause

The sensor UI process does not immediately attempt to restart when the "kill -STOP" command is used in place of the "kill" command

Resolution

The sensor UI process can be restarted manually via the command line or by restarting the sensor

Additional Information

• Stopping the Sensor UI process does not impact other sensor processes 
• Detection and prevention are not impacted 
• An enhancement may be added in the future to block -STOP command options against the UI process