App Control: Agent Not Blocking Files as Expected on Linux Machines

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

App Control Agent is not blocking files as expected on Linux machines. 

Environment

• App Control Server: All Versions
• App Control Agent: All Versions
• Linux: All Supported Versions

Cause

a. 'Linux Shell' Script Rule has not been enabled

or

b. Script type, or script process generating blocking event(s) have not been added to the 'Script Type' or 'Script Process' section of  'Linux Shell' Script Rule

Resolution

1. Open the Console -> Software Rules -> Scripts tab, select View Details for the Linux Shell rule
2. Confirm Status shows Enabled, or confirm the 'Script Type' and/or 'Script Process' sections contain the script type and/or script process from blocking event(s)
3. Select Save & Exit
    

Additional Information

• Steps for updating the Linux Shell Scripts rule are discussed on Pg 632 of the User Guide:
  https://community.carbonblack.com/t5/Documentation-Downloads/VMware-Carbon-Black-App-Control-User-Guide-v8-6/ta-p/99694
• Check the 'Rescan Computers' option in the Definition section to approve all existing scripts matching the rule definition