macOS Sensor Kernel Extensions Failed to Load

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

macOS sensor kernel extensions fail to load: 

• Error on the console: 

  Health Score continues to say: "Cb Response kernel extensions failed to load. Endpoint must be restarted to complete upgrade."

• Sensor logs show: 

  E0502 15:41:16.719012 185365952 sensor_service.cpp:565] Failed to start CbOsxSensorProcmon.kext
  E0502 15:41:16.812042 185365952 sensor_service.cpp:591] Failed to start CbOsxSensorNetmon.kext

Environment

• Carbon Black EDR Sensor: 6.2.3+
• macOS: 10.13+

Cause

The issue is that macOS sensor kernel extensions are not being approved before the reboot is being conducted. the "Secure Kernel Extension Loading" (or SKEL) feature which was introduced on 10.13 macOS will not load kernel extensions unless specifically given approval to.

Resolution

Granting macOS Sensor v7.0+ Access on macOS v11.0+ Big Sur

Additional Information

This approval UI is only present in the Security & Privacy preferences pane for 30 minutes after the alert. Until the user approves the KEXT, future load attempts will cause the approval UI to reappear but will not trigger another user alert.