Skip to content

Instantly share code, notes, and snippets.

@spinus

spinus/falcon.nix

Created June 15, 2022 10:47
Show Gist options
  • Save spinus/be0ca03def0c856ada86b16d1727d09d to your computer and use it in GitHub Desktop.
Save spinus/be0ca03def0c856ada86b16d1727d09d to your computer and use it in GitHub Desktop.
Download ZIP
crowdstrike falcon
Raw
falcon.nix
{pkgs?import <nixpkgs> {}}:
with pkgs;
stdenv.mkDerivation {
name = "falcon-sensor";
version = "4.18.0-6402";
arch = "amd64";
src = ./falcon-sensor_6.34.0-13108_amd64.deb;
nativeBuildInputs = [ dpkg autoPatchelfHook zlib pkgs.libnl pkgs.openssl ];
propagateBuildInputs = [pkgs.libnl pkgs.openssl];
sourceRoot = ".";
unpackCmd = ''
dpkg-deb -x "$src" .
'';
installPhase = ''
cp -r ./ $out/
realpath $out
'';
meta = {
description = "Crowdstrike Falcon Sensor";
homepage = "https://www.crowdstrike.com/";
#license = licenses.unfree;
#platforms = platforms.linux;
};
}
@wpcarro
Copy link

wpcarro commented Jul 11, 2022

Also FYI, I'm seeing the following error logs when I run journalctl -lu falcon-sensor:

Jul 11 11:28:46 ava falconctl[194917]: Unable to open falconctl log file /var/log/falconctl.log, errno = 6

Do you have the same?

@wpcarro
Copy link

wpcarro commented Jul 12, 2022

Also seeing complaints about the PID file:

Jul 12 14:33:13 ava systemd[1]: falcon-sensor.service: Can't open PID file /run/falcond.pid (yet?) after start: Operation not permitted

@wpcarro
Copy link

wpcarro commented Jul 13, 2022

I manually created /var/log/falconctl.log, but it's complaining about a missing falconstore.

$ tail -f /var/log/falconctl.log
Tue Jul 12 17:17:26 2022 Invalid file /opt/CrowdStrike/falconstore length: 0    (372889) [619]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment