fedora-intune: fix boot issues, add Himmelblau variant

Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-19 11:06:50 +00:00
1 parent 6f27bfb4dc
commit 4f71d350fa
@@ -1,55 +0,0 @@
-# Minimal GNOME workstation.
-
-packages:
-  # Fedora integration normally provided by the upstream fedora.yaml (which we
-  # opt out of to avoid the Firefox RPM).
-  - fedora-release
-  - fedora-release-ostree-desktop
-  - fedora-flathub-remote
-
-  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
-  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
-  # the first local user on first boot.
-  - gdm
-  - gnome-shell
-  - gnome-control-center
-  - gnome-initial-setup
-  - nautilus
-  - ptyxis
-  - pipewire
-  - pipewire-pulseaudio
-  - wireplumber
-  - xdg-desktop-portal-gnome
-  - xdg-user-dirs-gtk
-  - flatpak
-
-  # Session infrastructure base-atomic lacks with recommends off; see
-  # fedora-remote/custom.yaml.
-  - dbus-daemon
-  - systemd-pam
-  - mesa-dri-drivers
-  - mesa-libEGL
-
-  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
-  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
-  - tpm2-tools
-
-  # Proxmox guest integration (agent, console clipboard and resizing).
-  - qemu-guest-agent
-  - spice-vdagent
-
-# Microsoft Edge is the browser (Conditional Access needs it).
-exclude-packages:
-  - firefox
-
-add-files:
-  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
-  # Key-only SSH for local accounts.
-  - ["10-intune-sshd.conf", "/etc/ssh/sshd_config.d/10-intune-sshd.conf"]
-
-postprocess:
-  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    ln -sf /dev/null /etc/systemd/system/uresourced.service
@@ -1,39 +0,0 @@
-# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build.
-#
-# mdatp's %post does the real install: it writes mdatp.service and the
-# mde_netfilter_v2 units, loads its SELinux module and creates a machine GUID
-# and state under /var/opt/microsoft/mdatp. In a compose the daemon cannot
-# start and /var is not shipped, so the units and SELinux module are handled
-# here and the per-machine state is left to the first start on the device.
-#
-# Onboarding is per tenant and not part of the image: run the onboarding script
-# from the Defender portal on the device (see the Intune test doc).
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - mdatp
-
-packages:
-  # Used by the Defender TVM/inventory scripts and the onboarding script.
-  - python3
-
-add-files:
-  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
-
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    conf=/opt/microsoft/mdatp/conf
-    # Units the %post copies into place; install them if it did not get there.
-    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
-      if [[ ! -f "/usr/lib/systemd/system/${unit}" ]]; then
-        install -m 0644 "${conf}/${unit}" "/usr/lib/systemd/system/${unit}"
-      fi
-    done
-    semodule -n -i "${conf}/selinux_policies/out/mdatp_service.pp"
-    # Never ship a machine GUID or onboarding state baked in at build time.
-    ls -laR /etc/opt/microsoft /var/opt/microsoft 2>/dev/null || true
-    rm -rf /var/opt/microsoft/mdatp
-    rm -f /etc/opt/microsoft/mdatp/mdatp_onboard.json
@@ -1,6 +0,0 @@
-# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
-PubkeyAuthentication yes
-PermitRootLogin no
-PasswordAuthentication no
-PermitEmptyPasswords no
-KbdInteractiveAuthentication no
@@ -1,3 +0,0 @@
-# Defender daemon and its network filter (socket-activated).
-enable mdatp.service
-enable mde_netfilter_v2.socket
@@ -1,3 +0,0 @@
-enable gdm.service
-enable qemu-guest-agent.service
-enable sshd.service
@@ -1,23 +1,14 @@
-# Microsoft Intune app for Linux (intune-portal), the Microsoft identity broker
-# and Microsoft Edge (needed for Conditional Access to Microsoft 365 web apps).
+# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
+# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
 #
 # Fedora is not a supported Intune distribution. The RHEL 10 builds are used
-# because they link against the same library generation as Fedora 44. The
-# repos are limited to these packages with includepkgs (repos/microsoft.repo),
-# so nothing else from the RHEL repo can replace a Fedora package.
-
-repos:
-  - microsoft-rhel10
-  - microsoft-edge
+# because they link against the same library generation as Fedora 44.

 repo-packages:
  - repo: microsoft-rhel10
    packages:
      - intune-portal
      - microsoft-identity-broker
-  - repo: microsoft-edge
-    packages:
-      - microsoft-edge-stable

 packages:
  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
@@ -26,6 +17,7 @@ packages:
  - checkpolicy
  - policycoreutils
  - sssd-client
+  - nss-altfiles
  # Secret storage for the identity broker tokens.
  - gnome-keyring
  - libsecret
@@ -57,7 +49,10 @@ postprocess:
        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
        "${profile}/${f}"
    done
-    authselect select custom/intune-profile --force --nobackup
+    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
+    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
+    authselect select custom/intune-profile with-altfiles --force --nobackup
+    getent passwd gdm >/dev/null

  - |
    #!/usr/bin/env bash
@@ -18,8 +18,21 @@ default_target: graphical.target

 ref: fedora-intune/${releasever_ref}/${basearch}/intune

+# Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
+# Defender installs to /opt/microsoft/mdatp and keeps its state in
+# /var/opt/microsoft/mdatp; with the default symlink those are the same,
+# read-only directory. Needs composefs, which upstream enables.
+opt-usrlocal: root
+
+repos:
+  - microsoft-rhel10
+  - microsoft-edge
+
 include:
  - base-atomic.yaml
-  - custom.yaml
-  - intune.yaml
+  # Shared with fedora-intune-himmelblau (images/shared).
+  - workstation.yaml
+  - microsoft-edge.yaml
  - defender.yaml
+  # Microsoft Intune app.
+  - intune.yaml
@@ -1,16 +0,0 @@
-[microsoft-rhel10]
-name=Microsoft Production (RHEL 10)
-baseurl=https://packages.microsoft.com/rhel/10/prod/
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
-includepkgs=intune-portal microsoft-identity-broker mdatp
-
-[microsoft-edge]
-name=Microsoft Edge
-baseurl=https://packages.microsoft.com/yumrepos/edge/
-enabled=1
-gpgcheck=1
-gpgkey=https://packages.microsoft.com/keys/microsoft.asc
-includepkgs=microsoft-edge-stable