Environment
- Carbon Black Mac Sensor: 3.8.0.58 and Lower
- MAC OS: All Supported Version
Symptoms
Folder Permissions are set to 777 which allows any user to access:
0 drwxrwxrwx 4 root admin 128 Feb 19 17:07 /System/Volumes/Data/Library/Application Support/com.vmware.carbonblack.cloud/Data/Content
0 drwxrwxrwx 6 root admin 192 Feb 8 15:05 /System/Volumes/Data/Library/Application Support/com.vmware.carbonblack.cloud/Data/Content/Rules
0 drwxrwxrwx 3 root admin 96 Feb 19 17:11 /System/Volumes/Data/Library/Application Support/com.vmware.carbonblack.cloud/Data/Events
Cause
Working as per design
Resolution
- Modifying the permissions of these folders to 770 will work as intended.
/Library/Application Support/com.vmware.carbonblack.cloud/Data/
/Library/Application Support/com.vmware.carbonblack.cloud/Data/Events
/Library/Application Support/com.vmware.carbonblack.cloud/Data/Content
/Library/Application Support/com.vmware.carbonblack.cloud/Data/Content/Rules
- User must disable the sensor to make these changes.
NOTE:
Do not perform a recursive chmod
- Uninstall and Reinstall of Sensor, will reset these folder permissions to default.
- Default directory permission will be fixed in upcoming CBC Mac 3.8.1 release.
Related Content
