I managed to install the version by: - Downloading the .deb file from Crowdstrike Admin Panel (version 7.29).
-
Downloading the package locally with
yay -G falcon-sensor. -
Placing the .deb file into the build dir that was created by yay.
-
Updating the PKGBUILD file to expect this version (you can see the content of PKGBUILD below.
-
Run
makepkg -siinside the dir.
I am new to Arch so if someone knows a better way to do it pls tell me.
# Maintainer: Jan Muixi <janmuixi7@gmail.com>
# This script is not official and it is provided as a helper. You are solely responsible for the use of this installer.
# By using CrowdStrike, you are bound by CrowdStrike license terms that may change without notice.
# Terms of Use: https://www.crowdstrike.com/software-terms-of-use/
# Privacy Notice: https://www.crowdstrike.com/privacy-notice/
pkgname=falcon-sensor
pkgver=7.29.0
_pkgver=7.29.0
pkgrel=18202
pkgdesc="Crowdstrike Falcon Sensor daemon and kernel modules"
arch=("x86_64")
url="https://crowdstrike.com"
license=("custom")
depends=("openssl" "libnl1")
backup=("etc/logrotate.d/falcon-sensor")
source=(
"manual://${pkgname}_${pkgver}-${pkgrel}_amd64.deb"
"LICENSE"
)
sha256sums=(
"SKIP"
"SKIP"
)
prepare() {
mkdir "${srcdir}/${pkgname}"
cd "${srcdir}/${pkgname}"
bsdtar -xf "${srcdir}/data.tar.xz" -C .
# Remove unnecessary .deb related directory
rm -rf "${srcdir}/${pkgname}/etc/init.d"
}
package() {
warning "You may need to uninstall the package first and remove the folder /opt/CrowdStrike"
cd "${srcdir}/${pkgname}"
cp -r "${srcdir}/${pkgname}/"* "${pkgdir}"
install -dm755 "${pkgdir}/usr"
mv "${pkgdir}/lib" "${pkgdir}/usr/lib"
install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
chmod a+x "${pkgdir}/opt/CrowdStrike"
chmod -R a+r "${pkgdir}/opt/CrowdStrike"
#/opt/CrowdStrike/falconctl -s --cid=<your CID here>
}
Pinned Comments
sipak commented on 2024-12-04 08:32 (UTC) (edited on 2024-12-04 08:36 (UTC) by sipak)
The installer was updated and proven to be working on Arch as of a month now. I no longer have access to a licensed product to test it anymore, so feel free to update/adopt.
By using CrowdStrike, you are bound by CrowdStrike license terms that may change without notice.
Terms of Use: https://www.crowdstrike.com/software-terms-of-use/ Privacy Notice: https://www.crowdstrike.com/privacy-notice/ License: https://www.crowdstrike.com/en-us/crowdstrike-sensor-licensing-faq/ Documentation: https://www.crowdstrike.com/tech-hub/endpoint-security/installing-falcon-sensor-for-linux/
frealgagu commented on 2023-02-02 00:17 (UTC)
@ZetaRevan downloading from CrowdStrike portal is the only allowed method to get the required binaries as stated here: https://www.crowdstrike.com/blog/tech-center/install-falcon-sensor/
If you need the binary you need to have a valid license and download the package from the portal using your credentials.
Verification sums may differ from the source you obtain (with the valid license) so I'm leaving the checksum SKIPPED in order to allow you install the sensor without modification.
https://github.com/frealgagu/archlinux.falcon-sensor won't be available again and I recommend to not upload CrowdStrike binaries (even the ones generated for ArchLinux) publicly to avoid legal issues.
You can put your binary directly in the same folder of PKGBUILD and run makepkg (or extra-x86_64-build if you want a clean chroot environment), this way the command will recognize your binary and it will use it to make the ArchLinux package properly (avoiding the unknown manual:// protocol)