Sensor Kernel Module Does not Load with Linux Secure Boot Enabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why does the sensor health show as 50/100 percent

Environment

• RHEL/CentOS: 7.x
• Linux Kernel: 3.x
• EDR Sensor: 7.3.2 and Below

Resolution

EDR Sensors running on CentOS 7.x with Kernel 3.x and Secure Boot enabled is not supported unless using 7.3.2 and Higher using these instructions
 

Additional Information

• When the EDR Sensor attempts to load the Kernel Module it fails but does not generate an obviuos error
• The error can be verified by running the following command as root #insmod /var/carbonblack/response/modules/<Module for Kernel installed>

• For Example:
  
  insmod /opt/carbonblack/response/modules/cbsensor_3_1_1777950.ko.3.10.0-1160
  insmod: ERROR: could not insert module /opt/carbonblack/response/modules/cbsensor_3_1_1777950.ko.3.10.0-1160: Required key not available