Endpoint Protection services running as 'unconfined' on Linux

Products

• Endpoint Protection

Issue/Introduction

After installing Symantec Endpoint Protection (SEP) on a Linux system, you notice that it's services/daemons are running as "unconfined".
You would like to know the reason for it and if it can be set to confined.

Environment

SEP Linux Agent 14.3 RU1 and higher

Resolution

By design, the SEP Linux agent services (cafservicemain, sisamddaemon, sisidsdaemon, sisevtd & sisipsdaemon) run as "unconfined".
It is not recommended for the services to run in confined mode since the daemon processes require high privileges.