Error executing rpm command via live response on RHEL servers - Remote error 0x00000001 - Incorrect function

Products

• Carbon Black Cloud Enterprise EDR

Issue/Introduction

You are trying to install software on Redhat based servers via Live response using

execfg rpm -ivh file.rpm

An error is returned

Remote error 0x00000001 - Incorrect function

This may also lead to the rpm database (/var/lib/rpm/Packages) becoming locked which will then give the below errors

error: rpmdb: BDB0196 Encrypted checksum: no encryption key specified
error: rpmdb: BDB0196 Encrypted checksum: no encryption key specified
error: rpmdb: BDB0210 /var/lib/rpm/Packages: metadata page checksum error
error: cannot open Packages index using db5 - Invalid argument (22)
error: cannot open Packages database in /var/lib/rpm

Environment

CBC Linux agent 2.15.x and 2.16.x

CentOS 7.x, RHEL 8.x and 9.x

Cause

execfg is designed to run a command and output the results to a text file that is then returned to the console.  Some commands such as rpm need user confirmation or may return stderr.

Resolution

Two options are available, use exec which will launch the process in the background or use execfg but append &> file.out to redirect stderr to a file.

exec rpm -ivh /path/tp/file.rpm

or

execfg rpm -ivf /path/to/file.rpm &> file.out

The execfg may still give the error but will prevent the rpmdb becoming locked.