rmmod: ERROR: could not remove 'cbsensor': Device or resource busy
Environment
EDR Sensor: All Supported Versions
Linux: All Supported Versions
Cause
As of sensor 6.1.7, cbsensor requires that rmmod or similar calls that unload the cbsensor module be invoked twice to fully unload the module.
Resolution
Execute the command a second time after the error
Example
rmmod cbsensor
Additional Information
The cbsensor detects if system call or LSM hooks have been modified since cbsensor loaded.
If these hooks have been modified, then cbsensor refuses to unload to prevent a kernel crash and the EDR Sensor is not operational until the situation is resolved.
The first call to unload checks and restores the system call LSM hooks, if it is safe to do so, and returns error EBUSY while it restores these hooks.
The second call succeeds if system calls and LSM hooks have not been modified since cbsensor was first loaded.