Auto-Containment and Windows Subsystem for Linux

Products ITarian Endpoint Manager
1

Hello,

I have just started working with the Comodo/ITarian Security Client 11.

Can anyone point me in the right direction for documentation or tutorial regarding the Auto-Containment?

I am having trouble with Windows Subsystem for Linux and Linux commands most (all) being blocked.

Eg:
C:\Users\ben\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\bin ar

Does anyone have any suggestions regarding a way to allow the WSL to function without completely disabling Auto-Containment?

Thanks,
Ben

(I hope I posted this in the right forum)

2

Hi @octavalent
The suggested ‘whitelisting / exclusion’ method below is meant for any software.
How to whitelist files based on file group

  • This method can be utilized not just to exclude your new app but also to accommodate any new software in the future.
  • Of important note, any changes you make in the ‘whitelist file group’ will NOT propagate automatically to the profiles that include it. You will need to ‘re-deploy’ the Profile. Re-deploy here entails making a simple change on the Profile and saving it. Then undoing the previous change and saving it again.
  • As a friendly reminder, any excluded ‘folders/path’ becomes a potential malware entry point as, understandably, they are excluded in the selected CCS security section.
3

I am struggling to get this working. I am using the Debian WSL. I do have a Whitelist setup.

I have used both methods of the absolute path… and a wild card. For example “C:\Users\marky\AppData\Local\Packages\TheDebianProject.DebianGNULinux_76v4gfsz19hv4” and “C:\Users\marky\AppData\Local\Packages\TheDebianProject.DebianGNULinux_76v4gfsz19hv4*”.

I am unable to get WSL to work properly without being picked up by HIPS, AV and Auto-Containment. In my profile I do have the whitelist on top in the containment rules, Top of the HIPS Rules, the only one under Antivirus - Excluded Groups, and the top item under Firewall - Application Rules.

Any suggestions?

4

Hi @itnv ,

Good day!
As mentioned by @Rick_C , did you redeploy the profile after making changes?

“Of important note, any changes you make in the ‘whitelist file group’ will NOT propagate automatically to the profiles that include it. You will need to ‘re-deploy’ the Profile. Re-deploy here entails making a simple change on the Profile and saving it. Then undoing the previous change and saving it again.”