Installer_Linux.sh

#!/bin/bash

LOGFILE="./falcon_install.log"
INSTALLER_PATH="/tmp/falcon-sensor"

CID=""
PROVISIONING_TOKEN=""        # Optional
SENSOR_TAGS=""               # Example: "Tag1,Tag2". Leave empty for none.

CLOUD="eu-1"
CS_DOMAIN="falcon.eu-1.crowdstrike.com"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOGFILE"
}

log "===== Starting Falcon Sensor Linux Installation Script ====="

# ---------------------------------------------------------------------------
# 1) Detect Linux distribution
# ---------------------------------------------------------------------------
get_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        echo "$ID"
    else
        echo "unknown"
    fi
}

DISTRO=$(get_distro)
log "Detected distribution: $DISTRO"

case "$DISTRO" in
    ubuntu|debian)
        PKG_CMD="dpkg -i"
        PKG_TYPE="deb"
        ;;
    rhel|centos|rocky|almalinux|ol|amazon)
        PKG_CMD="rpm -i"
        PKG_TYPE="rpm"
        ;;
    sles|opensuse*)
        PKG_CMD="rpm -i"
        PKG_TYPE="rpm"
        ;;
    *)
        log "Unsupported Linux distribution."
        exit 1
        ;;
esac

# ---------------------------------------------------------------------------
# 2) Connectivity test
# ---------------------------------------------------------------------------
log "Checking connectivity to CrowdStrike Cloud ($CS_DOMAIN:443)..."

if nc -zw3 "$CS_DOMAIN" 443; then
    log "Connectivity OK."
else
    log "ERROR: Cannot reach $CS_DOMAIN on port 443."
    exit 1
fi

# ---------------------------------------------------------------------------
# 3) Kernel compatibility check (User Mode / RFM)
# ---------------------------------------------------------------------------
log "Checking kernel version and User Mode requirements..."

KERNEL_VERSION=$(uname -r | cut -d'.' -f1-2)
KERNEL_FULL=$(uname -r)
CONFIG_FILE="/boot/config-$(uname -r)"

log "Detected kernel: $KERNEL_FULL"

# Extract major and minor kernel version numbers correctly
K_MAJOR=$(uname -r | cut -d'.' -f1)
K_MINOR=$(uname -r | cut -d'.' -f2)

log "Detected kernel major: $K_MAJOR, minor: $K_MINOR"

kernel_meets_version=false

if [ "$K_MAJOR" -gt 5 ]; then
    kernel_meets_version=true
elif [ "$K_MAJOR" -eq 5 ] && [ "$K_MINOR" -ge 8 ]; then
    kernel_meets_version=true
fi

if [ "$kernel_meets_version" = true ]; then
    log "Kernel is >= 5.8, meets User Mode minimum requirement."
else
    log "Kernel is < 5.8, does not meet User Mode requirement."
fi

required_options=(
"CONFIG_BPF"
"CONFIG_BPF_SYSCALL"
"CONFIG_DEBUG_INFO_BTF"
"CONFIG_TRACING"
"CONFIG_KPROBE_EVENTS"
"CONFIG_UPROBE_EVENTS"
"CONFIG_BPF_JIT"
"CONFIG_SECURITY"
"CONFIG_KALLSYMS_ALL"
"CONFIG_PROC_FS"
"CONFIG_BSD_PROCESS_ACCT"
"CONFIG_CGROUPS"
"CONFIG_CGROUP_BPF"
)

missing_options=()

if [ -f "$CONFIG_FILE" ]; then
    for opt in "${required_options[@]}"; do
        if ! grep -q "^$opt=" "$CONFIG_FILE"; then
            missing_options+=("$opt")
        fi
    done
else
    log "WARNING: Kernel config file $CONFIG_FILE not found. Cannot verify kernel capabilities."
fi

USER_MODE_OK=false
if [ "$kernel_meets_version" = true ] && [ ${#missing_options[@]} -eq 0 ]; then
    USER_MODE_OK=true
    log "Kernel meets User Mode requirements."
else
    log "Kernel does not meet all User Mode requirements."
    log "Missing options: ${missing_options[*]}"
fi

if [ "$USER_MODE_OK" = true ]; then
    log "If kernel mode is unsupported, the sensor will automatically enter USER MODE."
else
    log "Sensor will likely enter Reduced Functionality Mode (RFM)."
fi

# ---------------------------------------------------------------------------
# 4) Verify installer exists
# ---------------------------------------------------------------------------
if [ ! -f "$INSTALLER_PATH" ]; then
    log "ERROR: Falcon installer not found at $INSTALLER_PATH"
    exit 1
fi

log "Installer found: $INSTALLER_PATH"

# ---------------------------------------------------------------------------
# 5) Install Falcon Sensor package
# ---------------------------------------------------------------------------
log "Installing Falcon Sensor package..."

$PKG_CMD "$INSTALLER_PATH"
if [ $? -ne 0 ]; then
    log "ERROR: Installation failed."
    exit 1
fi

log "Installation completed."

# ---------------------------------------------------------------------------
# 6) Configure sensor (CID + token)
# ---------------------------------------------------------------------------
if [ -z "$CID" ]; then
    log "ERROR: CID variable is empty. Aborting configuration."
    exit 1
fi

CMD="/opt/CrowdStrike/falconctl -s --cid=$CID"
[ -n "$PROVISIONING_TOKEN" ] && CMD="$CMD --provisioning-token=$PROVISIONING_TOKEN"

log "Configuring sensor: $CMD"
eval sudo $CMD

# ---------------------------------------------------------------------------
# 7) Apply sensor tags (optional)
# ---------------------------------------------------------------------------
if [ -n "$SENSOR_TAGS" ]; then
    log "Applying sensor tags: $SENSOR_TAGS"
    sudo /opt/CrowdStrike/falconctl -s --tags="$SENSOR_TAGS"
else
    log "No SENSOR_TAGS defined. Skipping tag assignment."
fi

# ---------------------------------------------------------------------------
# 8) Start Falcon sensor service
# ---------------------------------------------------------------------------
if systemctl &>/dev/null; then
    log "Starting Falcon sensor service (systemd)..."
    systemctl start falcon-sensor
else
    log "Starting Falcon sensor service (SysVinit)..."
    service falcon-sensor start
fi

# ---------------------------------------------------------------------------
# 9) Verify service and AID
# ---------------------------------------------------------------------------
log "Checking Falcon sensor service status..."
if systemctl is-active --quiet falcon-sensor; then
    log "falcon-sensor service is active."
else
    log "ERROR: falcon-sensor service is not active."
fi

log "===== Falcon Sensor installation finished ====="
exit 0