Using CTE with PowerTech Antivirus

When Powertech Antivirus is configured to use on-access scanning, CipherTrust Transparent Encryption Data Transformation may find files within the Data Transformation GuardPoint that are busy. These files are not processed by Data Transformation and are left unencrypted.

Issue

When Powertech uses on-access scanning, it opens a file and keeps it open. Before the Data Transformation program encrypts a file, it checks to see if the file is in use by another process. If the file is in use, Data Transformation does not encrypt the file but rather appends the path to the file in the dataxform_status_error-<guardpoint> file located in /var/log/vormetric/. This prevents any retry of Data Transformation from succeeding.

Resolving PowerTech/Data Transformation "in-use" Errors

For the following scenario, Powertech is configured with on_access scanning and both Powertech and the Thales CTE agent have been installed at default locations. The example assumes the Data Transformation GuardPoint is /test-dataxform.

Running Data Transformation with Powertech Antivirus code deactivated

1. Type the following to prevent the Powerteck package from starting on system boot.

   /opt/sgav/avsvcctl disable
   

2. Reboot the system.

3. After the system restarts, verify that Powertech is not running, type:

   /opt/sgav/avsvcctl status
   

   Response

   The following output indicates Powertech is not running:
   Subsystem Group PID Status
   avsvc powertech inoperative
   Device driver is not loaded
   

4. Perform a Data Transformation conversion on the Data Transformation GuardPoints.

   Example

   dataxform --rekey --gp /test-dataxform
   

5. Enable Powertech to start after system boot, type:

   /opt/sgav/avsvcctl enable
   

6. Start Powertech, type:

   /opt/sgav/avsvcctl start
   

   Response

   There is a delay before Powertech is completely loaded and active. The
   Powertech status may be found by the following command.
   

7. Verify the status, type:

   /opt/sgav/avsvcctl status
   

   Response

   The Powertech avsvc subsystem should be `active' and the device driver loaded:
   Subsystem Group PID Status
   avsvc powertech 5964286 active
   Device driver is loaded
   The avsvc subsystem is configured to run at boot
   

Recovering from Data Transformation/Powertech Antivirus code errors

A Data Transformation rekey performed while Powertech is active can result in failed file conversion due to "busy" faults. The following section describes how to recover from this type of error.

The following section illustrates the process using an example data transformation and describes the steps needed to recover. The Data Transformation GuardPoint /test-dataxform.

1. Run Data Transformation.

   dataxform --rekey --gp /test-dataxform
   

   Response

   Checking if /test-dataxform is a guardpoint with a rekey policy applied
   /test-dataxform is a guardpoint with a rekey policy applied
   About to perform the requested data transform operation
   – Be sure to back up your data
   – Please do not attempt to terminate the application
   Do you wish to continue (y/n)?y
   Scan found 19 files (14 MB) in 1 directories for guardpoint /test-dataxform
   File /test-dataxform/xab is busy
   File /test-dataxform/xaa is busy
   Transformed 17 files (13 MB) of 19 files (14 MB) for guardpoint /test-dataxform
   Data transform got errors on some files
   File /test-dataxform/xab is busy
   File /test-dataxform/xaa is busy
   Number of files in error due to file being busy: 2
   The data transform operation took 0 hours, 0 minutes and 3 seconds
   The data transform program ran from Thu Feb 16 10:58:12 2023 until Thu Feb 16
   10:58:15 2023
   Data transform for guardpoint /test-dataxform finished but 2 files were not
   processed due to errors
   

2. Inspect the error file (dataxform_status_error-_test-dataxform) for /test-dataxform. The file is located in /var/log/vormetric. The contents for the file contain the error messages generated by Data Transformation.

   Example

   Skipped, file is busy : /test-dataxform/xab
   Skipped, file is busy : /test-dataxform/xaa
   

   Note

   Other Data Transformation errors may be present besides those caused by the Powertech antivirus code.

3. Create a "todo" file. Using Data Transformation, extract the names of the files that need to be retried for conversion.

   dataxform --recovery --file_list my-output --gp /test-dataxform
   

   This generates two files in the local directory

   my-output_done
   my-output_todo
   

   The my-output_todo file contains the list of files to retry applying Data Transformation:

   /test-dataxform/xaa
   /test-dataxform/xab
   

   Note

   The my-output_todo file may need to be edited to remove entries not caused by the Skipped, file is busy error.

4. Turn off Powertech on boot, type:

   /opt/sgav/avsvcctl disable
   

5. Reboot the system.

6. Verify the status.

   /opt/sgav/avsvcctl status
   

   Response

   Subsystem Group PID Status
   avsvc powertech inoperative
   Device driver is not loaded
   

7. Re-issue Data Transformation to transform files listed in the my-output_todo file.

   dataxform --rekey_list --gp /test-dataxform --file_list ./my-output_todo
   

   Response

   Checking if /test-dataxform is a GuardPoint with a rekey policy applied
   /test-dataxform is a GuardPoint with a rekey policy applied
   Previous status information does not relate to a --rekey_file operation.
   Number of files previously in error due to file being busy: 2
   About to perform the requested data transform operation
   – Be sure to back up your data
   – Please do not attempt to terminate the application
   Do you wish to continue (y/n)?y
   Starting data transform of /test-dataxform for files listed in ./my-output_todo
   The data transform operation took 0 hours, 0 minutes and 2 seconds
   The data transform program ran from Thu Feb 16 12:33:47 2023 until Thu Feb 16
   12:33:49 2023
   

8. Re-enable Powertech on boot.

   /opt/sgav/avsvcctl enable
   

9. Start Powertech.

   /opt/sgav/avsvcctl start
   

   There is a delay before Powertech is completely loaded and active. The Powertech status may be found by the following command:

   /opt/sgav/avsvcctl status
   

   The Powertech avsvc subsystem should be `active' and the device driver loaded:

Response

    Subsystem Group PID Status
    avsvc powertech 5964286 active
    Device driver is loaded
    The avsvc subsystem is configured to run at boot