Error: CA Privileged Access Manager Server Control kernel module could not be unloaded.

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Not able to uninstall CA PAMSC endpoint application.

The following are notable error messages while running the uninstall.sh file

Error: CA Privileged Access Manager Server Control kernel module could not be unloaded.

Aborting uninstall

Environment

CA PAMSC 14.10.50.151

Cause

The root cause of the problem is that PAMSC interception is disabled out of order (PAMSC interception is no longer working because the call is in the middle of the stack or there are other kernel interception applications that are active on top of the stack)  When this happens, there is a built-in safeguard to prevent the SEOS_syscall kernel module from being unloaded.  If the SEOS_syscall module is removed without this safeguard, the system will crash.  Once a system in this state, it is complicated to recover because every system call intercepting product works differently and we don't have access to or knowledge of the other kernel module.  Theoretically, user can restart PAMSC to continue function; however, the system might become unstable due to incorrect operations on other products.  The only clean way to get out of the scenario is to reboot.

Resolution

PAMSC is a system call intercepting product. It intercepts system calls to determine if a process is allowed to access the object.  When there are multiple system call intercepting products running on a system, the intercepting functions that intercept the same system call work as a stack, the last activated one is on top of the stack. This (having multiple system call intercepting products) has an impact when uninstalling the product or deactivating the interception, an intercepting function will be removed from the stack. To remove an intercepting function that is not on top of the stack, all functions above it will need to be removed in order first.  

The fix produce by DE555167 is to prevent PAMSC from being unload when it detects that PAMSC is coexisting with other products and PAMSC is not the last activated product.  If a system is already in the chaotic condition, meaning one or multiple system call intercepting products including PAMSC has been deactivated out of order, applying this fix will not be in effect until after a reboot. If all products are deactivated in order, applying this fix will not require a reboot.

The fix was created for pamsc-14.10.40.182 version, but can as well be applied for 14.10.50.122, 14.10.50.151 version.