Linux Patch Notes for CTE v7.5.0.104

Resolved Issues

• AGT-54692 [CS1533748]: Unable to access GuardPoint intermittently due to failure to fetch group

  The CTE driver periodically (every 5 minutes) revalidated its user cache. Usually, this requires a single upcall to the user agent (secfsd). However, if a user is a member of a large number of groups, then the revalidation requires two upcalls. An access check on a GuardPoint in the middle of the two upcalls is currently denied because of missing group information that would have been provided by the second upcall. This has been fixed.

• AGT-54846: After guarding an LDT NFS GuardPoint on 7.6.0, when trying to guard from a 7.5.0 VM, it triggers an error: "Failed to load LDT GuardPoint xatt"

  With new capabilities introduced in CTE 7.6, CTE 7.5 may be unable to enable LDT protected GuardPoints on NAS shares which have already been guarded with CTE 7.6. This patch detects and reports potential incompatibilities at the GuardPoint level.

• AGT-54917: Teradata IDT: upgrade failed from 7.4.0.144 to 7.5.0.93

  Guard operation executed immediately after CTE startup may fail to get the encryption key of the target SecVM device at the time of guard operations. Now, CTE retries the guard operation when the encryption key becomes available on the CTE host.

• AGT-54976: YCSB Mongo crashes with local LDT/ext4

  The truncate operations, on files undergoing rekey on a local GuardPoint, may cause other processes accessing the same files to hang indefinitely. This has been fixed.

• AGT-55012: Guarding IDT device when it's offline, or in read-only mode behavior, changed in 7.5.0.99

  Attempts to guard an offline, or read-only raw device, may fail without retry. The failure sets the reason as "Specified policy disagrees with metadata set on the Guard Path" on the device after failed guard operation. The solution was to retry the guard operation, which will succeed when the device becomes available.

Known Issues

• AGT-48862: LDT GuardPoint Group Stopping secfsd service does not unguard CIFS GuardPoint

  Work-around

  Manually disable the GuardPoint in CipherTrust Manager.