Skip to content

Instantly share code, notes, and snippets.

@ravloony

ravloony/falcon-default.nix

Last active July 21, 2023 14:12
Show Gist options
  • Save ravloony/2f5682fad481168dfb5778e911f47bee to your computer and use it in GitHub Desktop.
Save ravloony/2f5682fad481168dfb5778e911f47bee to your computer and use it in GitHub Desktop.
Download ZIP
Falcon package
Raw
falcon-default.nix
{ stdenv, dpkg, fetchurl, openssl, libnl, buildFHSUserEnv,... }:
stdenv.mkDerivation {
name = "falcon-sensor";
version = "4.18.0-6402";
arch = "amd64";
src = fetchurl {
url = "https://storage.googleapis.com/company-tools/falcon-sensor/falcon-sensor_4.18.0-6402_amd64.deb";
sha512 = "dc41cfe0232124480abdcf456df9a3bd6cab62716bc5beea089fbf99ac2e29bf1e1a44676591a71eeb35afe7f25e495b53ede007cfc15dcbf47df7ec0a016098";
};
buildInputs = [ dpkg ];
sourceRoot = ".";
unpackCmd = ''
dpkg-deb -x "$src" .
'';
installPhase = ''
cp -r ./ $out/
realpath $out
'';
meta = with stdenv.lib; {
description = "Crowdstrike Falcon Sensor";
homepage = "https://www.crowdstrike.com/";
license = licenses.unfree;
platforms = platforms.linux;
maintainers = with maintainers; [ ravloony ];
};
}
Raw
falcon.nix
{ pkgs, ... }:
let
falcon = pkgs.callPackage ./falcon { };
falcon-env = pkgs.buildFHSUserEnv {
name = "falcon-sensor";
targetPkgs = pkgs: [ pkgs.libnl pkgs.openssl ];
runScript = "bash";
};
script = pkgs.writeScript "init-falcon" ''
#! ${pkgs.bash}/bin/sh
${falcon-env}/bin/falcon-sensor ${falcon}/opt/CrowdStrike/falconctl -g --cid
'';
in
{
systemd.services.falcon-sensor = {
enable = true;
description = "CrowdStrike Falcon Sensor";
after = [ "local-fs.target" ];
conflicts = [ "shutdown.target" ];
before = [ "shutdown.target" ];
serviceConfig = {
ExecStartPre = "${script}";
ExecStart = "${falcon-env}/bin/falcon-sensor ${falcon}/opt/CrowdStrike/falcond";
Type = "forking";
PIDFile = "/var/run/falcond.pid";
Restart = "no";
};
wantedBy = [ "multi-user.target" ];
};
}
@ivankovnatsky
Copy link

ivankovnatsky commented Jul 21, 2023 •
edited
Loading

@thall Thanks for sharing! Though for me it still does not start, not sure why:

Jul 21 16:00:26 <redacted-host-name> falcon-sensor[1219494]: Running /opt/CrowdStrike/falcon-sensor-bpf
Jul 21 16:00:26 <redacted-host-name> falcon-sensor-bpf[1219494]: No traceLevel set via falconctl defaulting to none
Jul 21 16:00:26 <redacted-host-name> falcon-sensor-bpf[1219494]: LogLevelUpdate: none = trace level 0.
Jul 21 16:00:26 <redacted-host-name> falcon-sensor-bpf[1219494]: CrowdStrike(11): Error loading config  1: c0000001
Jul 21 16:00:26 <redacted-host-name> falcon-sensor-bpf[1219494]: CrowdStrike(11): Initilize Configuration failed. c0000001
Jul 21 16:00:26 <redacted-host-name> falcond[1219493]: falcon-sensor[1219494] exited with status 1
Jul 21 16:00:26 <redacted-host-name> falcond[1219493]: exiting
Jul 21 16:00:26 <redacted-host-name> systemd[1]: falcon-sensor.service: Deactivated successfully.

References:

But, yeah, probably since they don't support NixOS, not sure if that is worth it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment