CB Defense: OSX Sensor fails to upgrade or downgrade via unattended installation

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• The CB Defense sensor will fail to upgrade or downgrade when attempting to execute the unattended shell script. This error can be seen within the confer-preinstall-xxxxxxxxxxxx log.

07/31/19 12:39:06 [INFO] e1ba sensor version: 3.3.1.12 (44039)
07/31/19 12:39:06 [INFO] e1ba operating system: osx v10.14.6
07/31/19 12:39:06 [INFO] e1ba parent process is /System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/Resources/installd
07/31/19 12:39:06 [INFO] e1ba grandparent process is /sbin/launchd
07/31/19 12:39:06 [INFO] e1ba starting preinstall procedure
07/31/19 12:39:06 [INFO] e1ba install type: unattended upgrade
07/31/19 12:39:06 [INFO] e1ba preventing downgrade by default.
07/31/19 12:39:06 [INFO] e1ba version of install kit: 3.3.1.12
07/31/19 12:39:06 [INFO] e1ba version of installed sensor: 3.3.2.58
07/31/19 12:39:06 [ERROR] e1ba install kit is older than installed sensor
07/31/19 12:39:06 [ERROR] e1ba insufficient privileges to run this application
07/31/19 12:39:06 [INFO] e1ba program terminated with error code: 4

Environment

• CB Defense Sensor
• Apple macOS: All Supported Versions

Cause

Upgrading

• The install kit is older than the currently installed sensor.

Downgrading

• CB_DEFENSE_ALLOW_DOWNGRADE option has not been configured correctly, to allow the downgrade.

Resolution

Upgrading

• Ensure that the version of the new sensor package is higher than the version which is currently installed.

Downgrading

• Ensure when downgrading a sensor that the CB_DEFENSE_ALLOW_DOWNGRADE option within the unattended script is set to a value of 1. By default this value is set to 0.
  • CB_DEFENSE_ALLOW_DOWNGRADE=1