macOS Resource Leak in Bypass Mode Caused by Unapproved System Extension

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

• Repcli status shows:
  • Sensor State: Bypass Mode
  • System Extension Status: Not Running
• ps -ef shows multiple processes (duplicates) running

  /Applications/VMware Carbon Black Cloud/VMware CBCloud.app/Contents/MacOS/VMware CBCloud -d

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• macOS: All Supported Versions

Cause

Issue is being investigated in CRE-23766

Resolution

See Steps 7-13 in the installation guide to approve the system extension and grant Full Disk Access (FDA).