For Linux endpoints, you install the Carbon Black App Control agent by running a script after extracting the appropriate TGZ archive. Carbon Black App Control server supports agents on Linux endpoints that are running Red Hat and CentOS versions, both of which use the same installation file.

Make sure your Linux endpoint is compatible with the Carbon Black App Control agent; see Carbon Black App Control Linux Agent Operating Environment Requirements.

See also the Release Notes at Carbon Black App Control Documentation for your version of Carbon Black App Control for any special considerations.

Linux agent installation files are tarballs named by policy and operating system, such as policyname-redhat.tgz.

Carbon Black recommends disabling Prelinking on RedHat and CentOS computers before installing agents. Prelinking has negative impacts on performance and Carbon Black App Control features (see the Release Notes at Carbon Black App Control Documentation). However, if you must enable Prelinking on your RedHat and CentOS systems, enable the RedHat Prelinking updater before installing agents. See "Approving by Updater" in the Carbon Black App Control User Guide for instructions on enabling updaters.

Note: Although not required for the initial agent installation, gawk and unzip are required for Linux agent upgrades that are initiated by the Carbon Black App Control server. If necessary, update the Linux distribution to include them before installing the agent.

The agent is normally installed with a GUI-based blocked file notifier. This notifier appears when a user attempts to take an action that is either totally blocked by the agent or that requires a user decision about allowing it to proceed. For Linux endpoints that are not running a graphic interface package, or if you prefer to eliminate user interaction for some other reason, the agent for Linux can be installed without the notifier. You can add the -n option as a flag on the installation script command for the agent, as shown in Install Linux Agents on Endpoints.

On an endpoint that you run without the notifier, install an agent with a Low or High Enforcement policy. Agents in Medium Enforcement policies prompt users to allow or block many actions, and this prompt is not available without a notifier.