crowdstrike falcon

falcon.nix

{pkgs?import <nixpkgs> {}}:
with pkgs;

stdenv.mkDerivation {
  name = "falcon-sensor";
  version = "4.18.0-6402";
  arch = "amd64";
  src = ./falcon-sensor_6.34.0-13108_amd64.deb;

  nativeBuildInputs = [ dpkg autoPatchelfHook zlib pkgs.libnl pkgs.openssl ];
  propagateBuildInputs = [pkgs.libnl pkgs.openssl];

  sourceRoot = ".";

  unpackCmd = ''
      dpkg-deb -x "$src" .
  '';

  installPhase = ''
      cp -r ./ $out/
      realpath $out
  '';

  meta = {
    description = "Crowdstrike Falcon Sensor";
    homepage    = "https://www.crowdstrike.com/";
    #license     = licenses.unfree;
    #platforms   = platforms.linux;
  };
}

{config, pkgs, ...}:

let
  falcon = import ./../packages/crowdstrike/default.nix { inherit pkgs;};
  falcon-env = pkgs.buildFHSUserEnv {
    name = "falcon-sensor";
    targetPkgs = pkgs: [ pkgs.libnl pkgs.openssl ];
    runScript = "bash";
  };
    in
  {
    environment.systemPackages = [falcon];
    systemd.services.falcon-sensor = {
      enable = false;
      description = "CrowdStrike Falcon Sensor";
      after = [ "local-fs.target" ];
      conflicts = [ "shutdown.target" ];
      before = [ "shutdown.target" ];
      serviceConfig = {
        WorkingDirectory = "/opt/CrowdStrike";
        ExecStartPre = [
          (pkgs.writeScript "falcon-init" ''
            #!${pkgs.bash}/bin/bash
            set -euo
            rm -rf /opt/CrowdStrike && mkdir -p /opt/CrowdStrike && cp -r ${falcon}/opt/CrowdStrike/* /opt/CrowdStrike/
          '')
          "/opt/CrowdStrike/falconctl -s -f --cid=XXXXXXXXXXXXXXXXXXXXXXXX"
        ];
        ExecStart = "${falcon-env}/bin/falcon-sensor -c /opt/CrowdStrike/falcond";
        Type = "forking";
        PIDFile = "/run/falcond.pid";
        Restart = "no";
        TimeoutStopSec="60s";
        KillMode="control-group";
        KillSignal="SIGTERM";
      };
      wantedBy = [ "multi-user.target" ];
    };
  }

What's the reason for setting systemd.services.falcon-sensor.enable = false?

Also FYI, I'm seeing the following error logs when I run journalctl -lu falcon-sensor:

Jul 11 11:28:46 ava falconctl[194917]: Unable to open falconctl log file /var/log/falconctl.log, errno = 6

Do you have the same?

Also seeing complaints about the PID file:

Jul 12 14:33:13 ava systemd[1]: falcon-sensor.service: Can't open PID file /run/falcond.pid (yet?) after start: Operation not permitted

I manually created /var/log/falconctl.log, but it's complaining about a missing falconstore.

$ tail -f /var/log/falconctl.log
Tue Jul 12 17:17:26 2022 Invalid file /opt/CrowdStrike/falconstore length: 0    (372889) [619]