fix(falcon): preserve CrowdStrike OTA updates across reboots

Merged
SH
5mo ago
+29-10

Summary

  • CrowdStrike cloud pushed OTA update (18410 -> 19004) but falcon-init.sh rsync'd old binaries back on boot, causing CS_PREVENTION_MISSING
  • Init script now compares build numbers and skips rsync when installed version is newer
  • Reverts kernel pin from 6.17 back to 6.18 (#1898 was a misdiagnosis - the kernel was never the issue)

Root cause

Audit logs showed falcon-sensor-bpf19004 failing to exec /opt/CrowdStrike/falcon-fxpredict (ENOENT) because the rsync restored 18410-versioned symlinks over the OTA-updated 19004 binaries.

Test plan

  • sudo nixos-rebuild switch
  • sudo systemctl restart falcon-sensor
  • Verify CS_PREVENTION_MISSING resolves in Drata/Falcon console

Summary by cubic

Prevents CrowdStrike Falcon OTA updates from being overwritten on reboot by skipping rsync when a newer build is already installed. Also reverts the kernel pin to 6.18 for sensor compatibility and resolves CS_PREVENTION_MISSING.

  • Bug Fixes
    • falcon-init.sh: compare installed vs packaged build numbers via falconctl and skip rsync when installed is newer, preserving OTA updates (e.g., 19004).
    • Kernel pin set to 6.18 (6.19 remains RFM) to align with Falcon sensor support.