crowdstrike falcon

falcon.nix

{pkgs?import <nixpkgs> {}}:
with pkgs;

stdenv.mkDerivation {
  name = "falcon-sensor";
  version = "4.18.0-6402";
  arch = "amd64";
  src = ./falcon-sensor_6.34.0-13108_amd64.deb;

  nativeBuildInputs = [ dpkg autoPatchelfHook zlib pkgs.libnl pkgs.openssl ];
  propagateBuildInputs = [pkgs.libnl pkgs.openssl];

  sourceRoot = ".";

  unpackCmd = ''
      dpkg-deb -x "$src" .
  '';

  installPhase = ''
      cp -r ./ $out/
      realpath $out
  '';

  meta = {
    description = "Crowdstrike Falcon Sensor";
    homepage    = "https://www.crowdstrike.com/";
    #license     = licenses.unfree;
    #platforms   = platforms.linux;
  };
}

What's the reason for setting systemd.services.falcon-sensor.enable = false?

Also FYI, I'm seeing the following error logs when I run journalctl -lu falcon-sensor:

Jul 11 11:28:46 ava falconctl[194917]: Unable to open falconctl log file /var/log/falconctl.log, errno = 6

Do you have the same?

Also seeing complaints about the PID file:

Jul 12 14:33:13 ava systemd[1]: falcon-sensor.service: Can't open PID file /run/falcond.pid (yet?) after start: Operation not permitted

I manually created /var/log/falconctl.log, but it's complaining about a missing falconstore.

$ tail -f /var/log/falconctl.log
Tue Jul 12 17:17:26 2022 Invalid file /opt/CrowdStrike/falconstore length: 0    (372889) [619]