Environment
- Carbon Black Cloud Sensor: All versions
- Apple macOS: All supported versions
Symptoms
- A user running as root can stop the Carbon Black Cloud macOS sensor UI process with the "kill -STOP" command
- The Sensor UI process does not attempt to restart without intervention
Cause
The sensor UI process does not immediately attempt to restart when the "kill -STOP" command is used in place of the "kill" command
Resolution
The sensor UI process can be restarted manually via the command line or by restarting the sensor
Additional Notes
- Stopping the Sensor UI process does not impact other sensor processes
- Detection and prevention are not impacted
- An enhancement may be added in the future to block -STOP command options against the UI process
