Test Agent processes running in SELinux confinement mode

Prev Next

Check if Trellix Agent SELinux policy modules are loaded and Trellix Agent processes are running in SELinux confinement.

  1. Verify the SELinux policy modules are loaded appropriately.

    # semodule -l | grep -i mfe

    The sample output on applying this command is:

    # # semodule -l | grep mfe_ma
    mfe_ma
    mfe_ma_rt
    
  2. Verify whether Trellix Agent processes are running in SELinux confinement.

    # ps -eZf | grep self_start

    The sample output on applying this command is:

    # ps -eZf | grep self_start
    system_u:system_r:mfe_ma_masvc_t:s0 root 32010 1 1 05:14 ? 00:00:00 /opt/McAfee/agent/bin/masvc self_start
    system_u:system_r:mfe_ma_macmnsvc_t:s0 mfe 32049 1 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macmnsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32175 1 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32177 32175 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32178 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32179 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32180 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32181 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32182 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    system_u:system_r:mfe_ma_macompatsvc_t:s0 root 32183 32177 0 05:14 ? 00:00:00 /opt/McAfee/agent/bin/macompatsvc self_start
    
    Failed dependencies:
    selinux-policy >= 3.14.1-61 is needed by MFEma-selinux-5.8.x-10.el8.noarch
    This is corrected by verifying the rpm is supported by linux os.