diff --git a/bash/install/falcon-linux-uninstall.sh b/bash/install/falcon-linux-uninstall.sh index e60dd03..52cb7ba 100755 --- a/bash/install/falcon-linux-uninstall.sh +++ b/bash/install/falcon-linux-uninstall.sh @@ -157,7 +157,15 @@ cs_sensor_remove() { # Check for package manager lock prior to uninstallation check_package_manager_lock + # Temporarily disable exit-on-error to capture package removal exit code + set +e remove_package "falcon-sensor" + removal_exit_code=$? + set -e + + if [ "$removal_exit_code" -ne 0 ]; then + die "Failed to remove falcon-sensor package (exit code $removal_exit_code). This may indicate that tamper protection is enabled on the sensor. Please provide FALCON_MAINTENANCE_TOKEN or set FALCON_CLIENT_ID and FALCON_CLIENT_SECRET to retrieve a maintenance token via the API." + fi } cs_remove_host_from_console() { diff --git a/bash/migrate/falcon-linux-migrate.sh b/bash/migrate/falcon-linux-migrate.sh index e95d1bb..65835da 100755 --- a/bash/migrate/falcon-linux-migrate.sh +++ b/bash/migrate/falcon-linux-migrate.sh @@ -427,7 +427,15 @@ cs_sensor_remove() { # Check for package manager lock prior to uninstallation check_package_manager_lock + # Temporarily disable exit-on-error to capture package removal exit code + set +e remove_package "falcon-sensor" + removal_exit_code=$? + set -e + + if [ "$removal_exit_code" -ne 0 ]; then + die "Failed to remove falcon-sensor package (exit code $removal_exit_code). This may indicate that tamper protection is enabled on the sensor. Please provide FALCON_MAINTENANCE_TOKEN or set FALCON_CLIENT_ID and FALCON_CLIENT_SECRET to retrieve a maintenance token via the API." + fi } cs_remove_host_from_console() { @@ -1312,7 +1320,7 @@ main() { # Start of migration touch "$log_file" echo "Migration file created at: $log_file" - echo "Migration started at $(date)" >> "$log_file" + echo "Migration started at $(date)" >>"$log_file" # auth with old credentials log "INFO" "Authenticating to old CID..."