Given that Arch isn't an officially supported distribution (by Falcon), installing this does next to nothing. The sensor will detect the kernel as an unsupported kernel and then run in "Reduced Functionality Mode" (RFM) which is basically a health check and that's it.
This MAY be due to secure boot and I would like to poke at that a bit and see if I can get it working but I don't hold out hope that it will. I am also going to play around with LTS versions of the kernel but I think to get this to work, I'd have to go all the way back to the LTS 5.4 kernel given that appears to be the most recent kernel that Falcon supports (due to Ubuntu 20.04 LTS). Even then, given that it's not an officially supported kernel, I'm willing to bet without some serious mucking (or official support), I won't ever get anything more than RFM.
Pinned Comments
frealgagu commented on 2023-02-02 00:17 (UTC)
@ZetaRevan downloading from CrowdStrike portal is the only allowed method to get the required binaries as stated here: https://www.crowdstrike.com/blog/tech-center/install-falcon-sensor/
If you need the binary you need to have a valid license and download the package from the portal using your credentials.
Verification sums may differ from the source you obtain (with the valid license) so I'm leaving the checksum SKIPPED in order to allow you install the sensor without modification.
https://github.com/frealgagu/archlinux.falcon-sensor won't be available again and I recommend to not upload CrowdStrike binaries (even the ones generated for ArchLinux) publicly to avoid legal issues.
You can put your binary directly in the same folder of PKGBUILD and run makepkg (or extra-x86_64-build if you want a clean chroot environment), this way the command will recognize your binary and it will use it to make the ArchLinux package properly (avoiding the unknown manual:// protocol)