Arch Linux User Repository

@ZetaRevan downloading from CrowdStrike portal is the only allowed method to get the required binaries as stated here: https://www.crowdstrike.com/blog/tech-center/install-falcon-sensor/

If you need the binary you need to have a valid license and download the package from the portal using your credentials.

Verification sums may differ from the source you obtain (with the valid license) so I'm leaving the checksum SKIPPED in order to allow you install the sensor without modification.

https://github.com/frealgagu/archlinux.falcon-sensor won't be available again and I recommend to not upload CrowdStrike binaries (even the ones generated for ArchLinux) publicly to avoid legal issues.

You can put your binary directly in the same folder of PKGBUILD and run makepkg (or extra-x86_64-build if you want a clean chroot environment), this way the command will recognize your binary and it will use it to make the ArchLinux package properly (avoiding the unknown manual:// protocol)

@sipak I do not have this software, so I can't check myself. Could you please run namcap on existing software to check dependencies and/or other packaging issues?

Nope, first, that gets overwritten later by falcon-sensor, but most importantly, there's a KernelModuleArchive with a bunch of linux modules per linux version in the array kernels. So the linux version used must match one of the supported ones by falcon-sensor (being part of the array kernels).

This is so sad, :( Any hints how to make falcon-sensor work on arch/artix? Any way to download a more up to date version perhaps, from upstream, without registering (I'm using the one provided by the company I work for, and I doubt I can just simply register as a some company representative, whom I'm not)... Perhaps there's a newer version supporting at least the LTS...

I don't know, how sad to be forced to use proprietary and closed code, :(

OK, my patch, so that the linux (kernel) version doesn't fail:

diff -Naur falcon-sensor-old/PKGBUILD falcon-sensor/PKGBUILD
--- falcon-sensor-old/PKGBUILD   2023-08-14 18:46:39.000000000 -0600
+++ falcon-sensor/PKGBUILD 2024-05-14 21:26:14.411904645 -0600
@@ -1,7 +1,8 @@
 # Maintainer: Fredy García <frealgagu at gmail dot com>

 pkgname=falcon-sensor
-pkgver=7.01.0_15604
+pkgver=7.11.0_16404
+_pkg_patch=16404
 pkgrel=1
 pkgdesc="Crowdstrike Falcon Sensor daemon and kernel modules"
 arch=("x86_64")
@@ -11,11 +12,11 @@
 backup=("etc/logrotate.d/falcon-sensor")
 install="${pkgname}.install"
 source=(
-  "manual://${pkgname}_${pkgver/_/-}_amd64.deb"
+  "https://${pkgname}_${pkgver/_/-}_amd64.deb"
   "LICENSE"
 )
 sha256sums=(
-  "SKIP"
+  "19c70ecb57c71522e9e43142ff61152d1098832b712a30f9973ea38e9d26980e"
   "76dbcf8027846d9a8c2fbd9ca2a163c171bbc75161b46a24f59bf64dd44fc6e9"
 )

@@ -27,6 +28,13 @@

   # Remove unnecessary .deb related directory
   rm -rf "${srcdir}/${pkgname}/etc/init.d"
+
+  # Add support for the Arch/Artix linux version
+  sed -i "s|\(kernels=\".*\)\([ \t]*\"[ \t]*$\)|\1$(uname -r)\\\n\2|" "${srcdir}/${pkgname}/opt/CrowdStrike/falcon-kernel-check${_pkg_patch}"
 }

 package() {

Not sure if working, neither what it's doing, but:

% ps auxww | 'grep' falcon
root     12791  0.0  0.0   2620  1152 ?        Ss   21:16   0:00 /opt/CrowdStrike/falcond
root     12792  0.8  1.5 3454876 250120 ?      Sl   21:16   0:09 falcon-sensor-bpf

@micwoj92, I believe this package actually requires libnl1 from AUR, since the package is really a -bin one, since it's using a binary package for another distro, which might probably be not as up to date as Ach/derivatives are. That said, libnl1 doesn't conflict with libnl, so that's great..

Hi @frealgagu, I Haven't ever used falcon-sensor, and even less on Arch or derivatives. Is it still working on Arch? Should falcon-kernel-check be adjusted, to add the linux version and distro used? I'm forced to use it...

I'm asking because it's supposed to be tightly related to linux (kernel).

Is current Arch still able to use falcon-sensor? The installer provided by the company I work for comes with a deb package 7.11.0-16404 and a bunch rpm packages with the same version.

Looking at falcon-kernel-check16404 the latest linux version supported seems to be:

6.2.0-1021-gcp #23~22.04.1-Ubuntu SMP Sat Jan 20 00:57:09 UTC 2024\n

I don't see any linux version available that old, :( Current linux-lts I see is 6.6.30, way more recent than 6.2.0, and besides the checker might match for the whole string. The non ubuntu strings are even older... And this deb package is way newer than the one specified in the out of date flag.

There are some executables:

falcon-sensor16404
falcon-sensor-bpf16404

Though there are as well linux modules compressed on:

KernelModuleArchive16404

For example:

ubuntu22 6.2.0-26-generic@#26~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Jul 13 16:27:29 UTC

And it seems the linux version check is performed in both executables:

% grep -r falcon-kernel-check pkg/falcon-sensor/
grep: pkg/falcon-sensor/opt/CrowdStrike/falcon-sensor16404: binary file matches
pkg/falcon-sensor/opt/CrowdStrike/falcon-kernel-check16404:2:# @file      falcon-kernel-check
grep: pkg/falcon-sensor/opt/CrowdStrike/falcon-sensor-bpf16404: binary file matches

So it seems this newer falcon-sensor doesn't support even the older linux version supported by Arch, not even linux-lts. Starting for the fact the linux version checker should then need to be modified.

Is that what is been done by current users? Modifying the checker, so some code is actually tried by linux (perhaps some eBPF one)? Weird that the AUR package doesn't include any modification to the linux version checker...

Many thanks !

Hello, are you sure this needs libnl1 and not libnl?

Thanks for confirming. I ended up pulling a copy provided by my employer & ran my own checksum & changed that in the PKGBUILD & .SRCINFO files.

Note to other users: also make sure you're updating the version number in these files to whatever version you're getting from Crowdstrike.

@ZetaRevan downloading from CrowdStrike portal is the only allowed method to get the required binaries as stated here: https://www.crowdstrike.com/blog/tech-center/install-falcon-sensor/

If you need the binary you need to have a valid license and download the package from the portal using your credentials.

Verification sums may differ from the source you obtain (with the valid license) so I'm leaving the checksum SKIPPED in order to allow you install the sensor without modification.

https://github.com/frealgagu/archlinux.falcon-sensor won't be available again and I recommend to not upload CrowdStrike binaries (even the ones generated for ArchLinux) publicly to avoid legal issues.

You can put your binary directly in the same folder of PKGBUILD and run makepkg (or extra-x86_64-build if you want a clean chroot environment), this way the command will recognize your binary and it will use it to make the ArchLinux package properly (avoiding the unknown manual:// protocol)

https://github.com/frealgagu/archlinux.falcon-sensor/releases returns a 404. either the repo was removed or made private. I haven't found another source.

I created a new PR for 6.45.