Patch Notes for CTE-U

Resolved Issues

• AGT-41588: Amazon linux2: CTE-U secfs not starting automatically after CTE-U installed and registered

  CTE-U is not starting automatically after CTE-U installation and registration. This has been fixed.

• AGT-41819: Upgrade on Reboot version is not showing from CipherTrust Manager

  Mismatch occurred between CTE-U and VMD on the location of a file with information on the Upgrade on Reboot state. Now it is in-sync so the status is correctly reported to CipherTrust Manager.

• AGT-41837: GuardPoint is not activating on SLES15.2 after applying a Standard Policy

  Issue caused by the GuardPoint being forked while a system lock is held. Results in a freeze later if the GuardPoint process attempts to acquire the lock. The solution was to ensure that the lock is not held when forking the GuardPoint process.

• AGT-41841: CTE-U bad error messages

  The messages are not indications of errors. They have been removed.

• AGT-42124: Inherit permission of physical device for loop device

  If the administrator had set up Udev rules to allow access for someone other than root, to a block device, and then guards the block device with CTE-U, the new device does not reflect those extra permissions and applications so it could fail when accessing the device. The solution is to mirror the permissions of the underlying device in the CTE-U encrypted device.

• AGT-42138|AGT-41850: Performance issue over SSH | Exec call not caching the correct binary name

  Race condition where when a process executes, ${cte-u} did not delete the old process table entry, and therefore, it could look up permissions for an incorrect process name.

• AGT-42253: CTE-U deadlock on PCACHE list lock

  It was possible for a GuardPoint process to inherit a lock in a locked state, resulting in a deadlock when it tried to lock it. The solution was to ensure that the lock is not held when the GuardPoint process is forked.

Known Issues

• AGT-41769: UID not changing after installation but before a host settings update

  work-around

  The UID is changed, it just does not display properly until the function updates.