Elastic Defend arm64 is not supported on Windows yet

docs/component-specs.md

@@ -87,6 +87,7 @@ The variables that can be accessed by a condition are:
 
 - `runtime.os`: the operating system, either `"windows"`, `"darwin"`, `"linux"`, or `"container"`.
 - `runtime.arch`: the CPU architecture, either `"amd64"` or `"arm64"`.
+- `runtime.native_arch`: the machine CPU architecture, either `"amd64"` or `"arm64"`.
 - `runtime.platform`: a string combining the OS and architecture, e.g. `"windows/amd64"`, `"darwin/arm64"`.
 - `runtime.family`: OS family, e.g. `"debian"`, `"redhat"`, `"windows"`, `"darwin"`
 - `runtime.major`, `runtime.minor`: the operating system version. Note that these are strings not integers, so they must be converted in order to use numeric comparison. For example to check if the OS major version is at most 12, use `number(runtime.major) <= 12`.

internal/pkg/agent/application/info/inject_config.go

@@ -47,6 +47,7 @@ func agentGlobalConfig() (map[string]interface{}, error) {
 		},
 		"runtime.os":             runtime.GOOS,
 		"runtime.arch":           runtime.GOARCH,
+		"runtime.native_arch":    nativeArchitecture(),
 		"runtime.osinfo.type":    hostInfo.Info().OS.Type,
 		"runtime.osinfo.family":  hostInfo.Info().OS.Family,
 		"runtime.osinfo.version": hostInfo.Info().OS.Version,

internal/pkg/agent/application/info/svc_unix.go

@@ -13,3 +13,8 @@ import "os"
 func RunningUnderSupervisor() bool {
 	return os.Getppid() == 1
 }
+
+func nativeArchitecture() string {
+	// unknown native architecture
+	return ""
+}

internal/pkg/agent/application/info/svc_windows.go

@@ -7,6 +7,8 @@
 package info
 
 import (
+	"fmt"
+
 	"golang.org/x/sys/windows"
 )
 
@@ -21,9 +23,10 @@ func RunningUnderSupervisor() bool {
 	if err != nil {
 		return false
 	}
-	defer windows.FreeSid(serviceSid)
+	defer func() { _ = windows.FreeSid(serviceSid) }()
 
-	t, err := windows.OpenCurrentProcessToken()
+	var t windows.Token
+	err = windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &t)
 	if err != nil {
 		return false
 	}
@@ -51,3 +54,35 @@ func allocSid(subAuth0 uint32) (*windows.SID, error) {
 	}
 	return sid, nil
 }
+
+func nativeArchitecture() string {
+	var processMachine, nativeMachine uint16
+	// the pseudo handle doesn't need to be closed
+	var currentProcessHandle = windows.CurrentProcess()
+
+	err := windows.IsWow64Process2(currentProcessHandle, &processMachine, &nativeMachine)
+	if err != nil {
+		// unknown native architecture
+		return ""
+	}
+
+	// https://learn.microsoft.com/en-us/windows/win32/sysinfo/image-file-machine-constants
+	const (
+		IMAGE_FILE_MACHINE_AMD64 = 0x8664
+		IMAGE_FILE_MACHINE_ARM64 = 0xAA64
+	)
+
+	var nativeMachineStr string
+
+	switch nativeMachine {
+	case IMAGE_FILE_MACHINE_AMD64:
+		nativeMachineStr = "amd64"
+	case IMAGE_FILE_MACHINE_ARM64:
+		nativeMachineStr = "arm64"
+	default:
+		// other unknown or unsupported by Elastic architectures
+		nativeMachineStr = fmt.Sprintf("0x%x", nativeMachine)
+	}
+
+	return nativeMachineStr
+}

pkg/component/component_test.go

@@ -1980,12 +1980,13 @@ func TestPreventionsAreValid(t *testing.T) {
 			"in_default": true,
 		},
 		"runtime": map[string]interface{}{
-			"platform": "platform",
-			"os":       "os",
-			"arch":     "arch",
-			"family":   "family",
-			"major":    "major",
-			"minor":    "minor",
+			"platform":    "platform",
+			"os":          "os",
+			"arch":        "arch",
+			"native_arch": "native_arch",
+			"family":      "family",
+			"major":       "major",
+			"minor":       "minor",
 		},
 		"user": map[string]interface{}{
 			"root": false,

specs/endpoint-security.spec.yml

@@ -77,6 +77,8 @@ inputs:
           message: "Elastic Defend requires Elastic Agent be running as Administrator or SYSTEM"
         - condition: ${install.in_default} == false
           message: "Elastic Defend requires Elastic Agent be installed at the default installation path"
+        - condition: ${runtime.native_arch} != 'amd64'
+          message: "Elastic Defend cannot be installed on Windows running on non-AMD64 CPU"
     service:
       cport: 6788
       log: