This article provides a solution for correcting an IDP signature install error during the policy unpack.
When the signature DB is being downloaded, the IDP policy is not being unpacked nor applied and it is taking the last good policy.
In the debugs, the compilation is succeeding, but when it tries to unpack the sc_policy_unpack, it fails as follows:
Dec 29 11:43:44 idpd_policy_load: sc_policy_unpack failed File : idpd_err: [20:38:33] Error: sc_kmalloc: do_malloc(100485954) failed [20:38:33] Error: sc_file_read_bytes: sc_malloc(100485954) failed[20:38:33] Error: gzip_decompress_data: sc_file_read(/var/db/idpd/__in_buffer) failed [20:38:33] Error: sc_file_unpack: gzip_decompress_data() failed
It is clear from below logs that, allocation of ~100MB failed.
If is observed that a lot of attack groups are configured (they did not load the IDP policy template).
Removing the following attack groups allowed for a successful install status. It is not recommended to have the "All Attack" group configured as this can be very taxing on resources.
"All Attacks" - includes all attacks which will make policy very heavy "FTP - All" - "[Recommended]FTP - All" covers all recommended FTP attacks "SCAN - All" - "[Recommended]Critical - SCAN" "[Recommended]Major - SCAN" "[Recommended]SCAN - Critical" "[Recommended]SCAN - Info" " [Recommended]SCAN - Major" "[Recommended]SCAN - Minor" covers all SCAN attacks "DB - Critical" - "DB - All" covers DB critical
After removing the suggested attack groups we received the following successful commit status.
root# run show security idp policy-commit-status IDP policy[/var/db/idpd/bins//IPS-Policy.bin.gz.v] and detector[/var/db/idpd/sec-repository/installed-detector/libidp-detector.so.tgz.v] loaded successfully. The loaded policy size is:43464352 Bytes