Skip to content

feat(matic): enable PAM fingerprint auth and fix falcon init #743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Feb 5, 2026
Merged

feat(matic): enable PAM fingerprint auth and fix falcon init #743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions named-hosts/matic/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,9 @@ inputs.nixpkgs.lib.nixosSystem {

# Fingerprint authentication
services.fprintd.enable = true;
security.pam.services.login.fprintAuth = true;
security.pam.services.gdm.fprintAuth = true;
security.pam.services.sudo.fprintAuth = true;

Copilot AI Feb 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The security.pam.services.sudo.fprintAuth = true setting is redundant given that security.sudo.wheelNeedsPassword = false (line 70) already allows passwordless sudo for wheel group members. While this doesn't cause any functional issues, it may create confusion about the actual authentication mechanism being used for sudo.

Consider either:

  1. Removing the fprintAuth setting for sudo since it's not needed with passwordless sudo, or
  2. Adding a comment explaining that this is for future-proofing in case the wheelNeedsPassword setting changes, or
  3. Changing wheelNeedsPassword to true if you want to require either password or fingerprint for sudo.

If the intent is to require authentication (via fingerprint or password) for sudo, you should set security.sudo.wheelNeedsPassword = true.

Copilot uses AI. Check for mistakes.

# Firmware updates
services.fwupd.enable = true;
Expand Down
16 changes: 5 additions & 11 deletions named-hosts/matic/falcon.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,19 +17,13 @@ let
#!${pkgs.bash}/bin/sh
set -euo pipefail

# Remove immutable attributes set by CrowdStrike (security feature)
if [ -d /opt/CrowdStrike ]; then
${pkgs.e2fsprogs}/bin/chattr -i -R /opt/CrowdStrike 2>/dev/null || true
# Only initialize if not already set up (CrowdStrike protects its files)
if [ ! -f /opt/CrowdStrike/falcond ]; then

@cubic-dev-ai cubic-dev-ai Bot Feb 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: The current initialization logic completely skips the copy step if falcond exists, which prevents the sensor from being updated. If you update the falcon-sensor package in Nix, the system will continue running the old binary from /opt/CrowdStrike instead of the new one from the store.

Using cmp allows you to skip initialization when the binary hasn't changed (fixing the restart crash loop) while still attempting to update when the version changes.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At named-hosts/matic/falcon.nix, line 21:

<comment>The current initialization logic completely skips the copy step if `falcond` exists, which prevents the sensor from being updated. If you update the `falcon-sensor` package in Nix, the system will continue running the old binary from `/opt/CrowdStrike` instead of the new one from the store.

Using `cmp` allows you to skip initialization when the binary hasn't changed (fixing the restart crash loop) while still attempting to update when the version changes.</comment>

<file context>
@@ -17,19 +17,13 @@ let
-    if [ -d /opt/CrowdStrike ]; then
-      ${pkgs.e2fsprogs}/bin/chattr -i -R /opt/CrowdStrike 2>/dev/null || true
+    # Only initialize if not already set up (CrowdStrike protects its files)
+    if [ ! -f /opt/CrowdStrike/falcond ]; then
+      install -d -m 0770 /opt/CrowdStrike
+      cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
</file context>
Fix with Cubic

install -d -m 0770 /opt/CrowdStrike
cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
chown -R root:root /opt/CrowdStrike
fi
Comment on lines +20 to 25

@gemini-code-assist gemini-code-assist Bot Feb 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The current logic with if [ ! -f /opt/CrowdStrike/falcond ] prevents the CrowdStrike agent from being updated when the underlying Nix package is changed. This is because the script will skip the installation steps if falcond already exists.

According to the PR description, the agent's files are protected from removal, but cp -a should still be able to overwrite them to perform an upgrade. By removing the conditional, we ensure that the files are always synchronized from the Nix store on startup, which handles both initial installation and upgrades.

    # Always copy files to handle initial install and upgrades.
    # The agent's files are protected from removal, but can be overwritten.
    install -d -m 0770 /opt/CrowdStrike
    cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/
    chown -R root:root /opt/CrowdStrike


rm -rf /opt/CrowdStrike
install -d -m 0770 /opt/CrowdStrike

# Copy real files so Falcon can write falconstore/CsConfig
cp -a ${falcon}/opt/CrowdStrike/. /opt/CrowdStrike/

chown -R root:root /opt/CrowdStrike

# load CID from /etc/falcon-sensor.env (root-only)
. /etc/falcon-sensor.env

Expand Down
Loading