Pstack command of DAM tool is not working if sisips driver loaded

Products

• Data Center Security Server Advanced

Issue/Introduction

Pstack command of DAM tool is not working if Symantec Data Center (DCS) sisips driver loaded.

Environment

OEL 9.x or UEK

Cause

For kernels where ftrace is being used, sisevt (Event Module) intercepts the syscall via ftrace and calls the registered SISIPS callback. So, sisips runs it and in the callback of sisevt there is a second attempt to do a ptrace.

Resolution

This issue is resolved in KMOD -10.0.8-2795.

Download link - https://linux-repo.us.securitycloud.symantec.com/SAL/1.2/rhel8/x86_64/sdcss-kmod-10.0.8.2795.el8.x86_64.rpm