Agent on macOS With FIPS Enabled Crashes or Otherwise Unresponsive

Products

• Carbon Black App Control

Issue/Introduction

Agent is crashing or otherwise unresponsive when installed on a macOS endpoint where FIPS is enabled.

Environment

• App Control macOS Agent: Version 8.9.4 and lower
• Apple macOS: All Supported Versions

Cause

This issue was tracked under EPCB-18615 and resolved with the release of Agent 8.10.0.

Resolution

Upgrading to macOS Agent 8.10.0 or higher will resolve the issue. In the meantime the steps below can be used to workaround the issue:

 

Create an Agent Config to disable FIPS for the macOS Agents

1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
2. Click Add Agent Config and use the following details:
   • Name: Disable FIPS for macOS (EPCB-18615)
   • Host ID: 0
   • Value:

     fips_override=0

   • Platform: Mac
   • Status: Enabled
   • Create For: All Current and Future Policies
3. Click Save
4. Agents must receive the change, then restart in order for the change to be applied.
   • FIPS may need to temporarily be disabled at the OS level to allow the Agent to fully receive the changes.

Agents that are unable to receive the change

The following process may need to be followed if Agents are crashing before they have a chance to receive the change from the Server and FIPS cannot be disabled at the OS level:

1. Manually regenerate the Agent Installers to be sure the Agent Config created is included in the initial install.
2. Uninstall the Agent via Safe Mode, or Recovery Mode.
3. Re-install the Agent using the latest version of the Policy Installer which has the Agent Config included by default.

Additional Information

• App Control Common Criteria Certification / FIPS 140-2 Certifications