The normal installation and upgrade procedures are contained in the Endpoint Security for Linux Threat Prevention Installation Guide. This article describes how to update an existing build package with support for more kernel modules.

The kernel module update package (McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO) provides support for new kernel updates without requiring you to upgrade the ENSL product.
 

Scenarios	Pathways
ENSL 10.7.5.x (or later) is deployed and a new kernel module update package is available for that version	Kernel module update
ENSL 10.7.5.x (or later) is checked-in and a new kernel module update package is available for that version	Install ENSL with the newer kernel module package
ENSL 10.7.4.x (or earlier) is checked-in and deployed	Upgrade ENSL with the newer kernel module package

The following sections contain instructions for each of these pathways.

Kernel Module Update:
Follow the relevant instructions for an ePolicy Orchestrator (ePO) managed system or standalone system.

• ePO kernel module update:
  Requirement – A 10.7.5.x or later version of the McafeeTP and McAfeeESP-KernelModule packages is checked-in to ePO and ENSL is deployed.
  1. Check in the package McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO to ePO in the same branch as McAfeeTP-10.7.X.xxx-Release-ePO. A message for overwriting the package is shown. Click Save to check in the package.
  2. Select the systems where the kernel module update has to be done.
  3. Click Actions, Agent, Edit Tasks on Single System. A new page opens.
  4. Click New Client Task Assignment.
  5. Click McAfee Agent under Product, Product Update under Task Type, and click Create New Task.
  6. Enter a task name.
  7. Select McAfee Endpoint Security Kernel Modules for Linux 10.7.X under package types and deselect all other boxes. Click Save.
  8. Select the Schedule type as Run immediately and click Save. The new task appears under the tasks list.
  9. Select the systems where the update has to run, and click Wake Up Agents.
  10. Wait until the task is completed.
  11. Run the following command on the system. The command should show the latest kernel module version 10070Xxxx:
      
      lsmod | grep -i mfe
       
• Standalone kernel module update on a Red Hat Package Manager (RPM) system:
  Requirement – A 10.7.5.x or later version of McAfee TP is installed and running.
  1. Copy McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO.zip on to your system.
  2. Unzip the package with the following command:
     
     unzip McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO.Zip -d kernel_module
      
  3. Run the following commands in the order listed:
     
     cd kernel_module
     mkdir aac_fileaccess
     tar -zxvf McAfeeESP-KernelModule-10.7.X-xxx-Full.linux.tar.gz -C aac_fileaccess
     mkdir /tmp/ens_pkg/
     mkdir /tmp/ens_pkg/install/
     cd aac_fileaccess
     cp McAfeeESPAac-10.7.X-xxx.x86_64.rpm McAfeeESPFileAccess-10.7.X-xxx.x86_64.rpm /tmp/ens_pkg/install/
     yum -y --nogpgcheck --noplugins --disablerepo=* install /tmp/ens_pkg/install/*.rpm
     /opt/McAfee/ens/tp/init/mfetpd-control.sh stop
     /opt/McAfee/ens/tp/init/mfetpd-control.sh start
     lsmod | grep -i mfe
     
     NOTE: This command should show the 100705xxx version of the kernel module.
     
     rpm -qa | grep -i mcafee
     
     NOTE: This command should show that the aac and fileaccess version is 10.7.X.xxx.
      
• Standalone kernel module update on a Debian system:
  Requirement – A 10.7.5.x or later version of McAfee TP is installed and running.
  1. Copy McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO on to your system.
  2. Unzip the package with the following command:
     
     unzip McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO.Zip -d kernel_module
      
  3. Run the following commands in the order listed:
     
     cd kernel_module
     mkdir aac_fileaccess
     tar -zxvf McAfeeESP-KernelModule-10.7.X-xxx-Full.linux.tar.gz -C aac_fileaccess
     cd aac_fileaccess
     dpkg --install McAfeeESPAac-10.7.X-xxx.deb
     dpkg --install McAfeeESPFileAccess-10.7.X-xxx.deb
     /opt/McAfee/ens/tp/init/mfetpd-control.sh stop
     /opt/McAfee/ens/tp/init/mfetpd-control.sh start
     lsmod | grep -i mfe
     
     NOTE: This command should show the 100705xxx version of the kernel module.
     
     dpkg-query -l | grep -i mcafee
     
     NOTE: This command should show that the aac and fileaccess version is 10.7.X-xxx.

Install ENSL with the Newer Kernel Module Package:
Requirement – A 10.7.5.x or later version of the McafeeTP and McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO packages is checked-in to ePO. Make sure that both the kernel module and installation packages are in the same branch.

1. Trigger the installation task from ePO.
2. Wait until the status is completed.
3. Click Wake Up Agents.
4. Run the following command on the system. The command should show the latest kernel module version 10070Xxxx:
   
   lsmod | grep -i mfe

Upgrade ENSL with the Newer Kernel Module Package:
Requirement – A 10.7.5.x or later version of the McafeeTP and McAfeeESP-KernelModule-10.7.X-xxx-Release-ePO packages is checked-in to ePO. Make sure that both the kernel module and installation packages are in the same branch.

1. Trigger the installation task from ePO.
2. Wait until the status is completed.
3. Click Wake Up Agents.
4. Run the following command on the system. The command should show the latest kernel module version 10070Xxxx:
   
   lsmod | grep -i mfe