Skip to content

Tamper protected endpoint-security should be able to continue operating normally when it rejects an attempt uninstall #11547

@cmacknz

Description

@cmacknz

When Elastic Agent attempts to stop endpoint-security (which is not always the correct thing to do - see #11266), it will tear down the connection information server and ignore errors from the stop call which invokes endpoint-security uninstall.

// Stop connection info
s.log.Debugf("stop connection info for %s service", s.name())
cisStop()
// Stop service
s.stop(ctx, comm, lastCheckin, am == actionTeardown)

This does not consider that endpoint-security uninstall may return exit code 28/284 indicating it is refusing uninstall because it is tamper protected.

When endpoint refuses uninstall, we should leave the system in a state where endpoint can continue to communicate with agent.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions