Kernel Modules mfe_fileaccess and mfe_aac are untrustworthy

[RussN]

Greetings,

The ePO server has pushed unsigned kernel modules to my shiny new RH EL 9 host.

This host is secured ... and will NOT load unsigned kernel modules.

I do not understand why the kernel modules have not been signed by the author, i.e., Trellix.

Worse still, I have been unable to locate anyone that can even provide hashes for the kernel modules.

Mind you, I am NOT trying to find instructions on how to sign kernel modules myself.

I am trying to find any reason that I should trust that the file files that have been pushed to the machine by the ePO server have not been tampered with.

Can anyone point me to anything that can serve as a basis of trust for the kernel modules?

[Pravas]

Hi @RussN ,

Could you please confirm if there are any deployment task assigned to the system in question?

Thanks

[RussN]

Sorry.  I have no idea.

[ueno]

Hi @RussN,

As you know, the currently released ENSL kernel modules are not signed.

ENSL does not have the function to check the integrity of installed kernel modules. Therefore, if you want to check the integrity of installed kernel modules, I think it is necessary to build another stand-alone system with the same configuration and check the hash value of each kernel module to see if there are any differences.

The kernel modules used in ENSL are listed under the following directories for each kernel used in LinuxOS.

/var/McAfee/ens/esp/aac/kernel
/var/McAfee/ens/esp/fileaccess/kernel

For reference, for stand-alone installations, the rpm files which will be installed integrity can be checked before installation using the method described in the following guide.

[Verify the signature on RPM-based systems]
https://docs.trellix.com/bundle/endpoint-security-v10-7-13-installation-guide-linux/page/GUID-979445...

[RussN]

it strikes me as odd, no, more than odd---ALARMING---that a company whose business is computer *security* does not only fail to sign the kernel modules they sell to their customers, but not even provide a "primitive" solution like a web page posting the sha256 hashes of said modules.

Ya'll should be ashamed of yourselves!

Bad show!   <SMH>

   Where can I get the RPMs for a stand-alone install?  At least the RPM's can be validated.

Oh ... and while creating an entirely separate machine with all the necessary stuff to compile a kernel module sounds like an excellent way for me to spend a day ... you can't even vouch for the integrity of the source code that has been installed---which invalidates the suggestion.

(By the way, I suspect that the compiler or linker will stuff version info and/or a timestamp into the resulting .ko file, and if so, result in a different checksum).

[RussN]

I see that the kernel modules are now signed by "Musarubra US LLC"

This is great news!

Unfortunately I am unable to locate the corresponding public key.

Can you provide a link to the public key (or the public key itself)?

[RussN · Accepted solution]

https://kcm.trellix.com/corporate/index?page=content&id=KB91697