fedora-intune: minimal GNOME workstation with Intune and Defender

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/intune.yaml

@@ -0,0 +1,76 @@
+# Microsoft Intune app for Linux (intune-portal), the Microsoft identity broker
+# and Microsoft Edge (needed for Conditional Access to Microsoft 365 web apps).
+#
+# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
+# because they link against the same library generation as Fedora 44. The
+# repos are limited to these packages with includepkgs (repos/microsoft.repo),
+# so nothing else from the RHEL repo can replace a Fedora package.
+
+repos:
+  - microsoft-rhel10
+  - microsoft-edge
+
+repo-packages:
+  - repo: microsoft-rhel10
+    packages:
+      - intune-portal
+      - microsoft-identity-broker
+  - repo: microsoft-edge
+    packages:
+      - microsoft-edge-stable
+
+packages:
+  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
+  # and the sssd base its authselect profile is derived from.
+  - authselect
+  - checkpolicy
+  - policycoreutils
+  - sssd-client
+  # Secret storage for the identity broker tokens.
+  - gnome-keyring
+  - libsecret
+
+add-files:
+  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]
+
+postprocess:
+  # The intune-portal %post builds an authselect profile with pam_intune.so and
+  # an SELinux module, but neither reliably survives a compose (no running
+  # SELinux, authselect state under /etc). Redo both here so the image is
+  # deterministic either way.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    profile=/etc/authselect/custom/intune-profile
+    if [[ ! -d "${profile}" ]]; then
+      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
+    fi
+    for f in system-auth password-auth; do
+      grep -q pam_intune.so "${profile}/${f}" && continue
+      sed -i \
+        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
+        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
+        "${profile}/${f}"
+      sed -i \
+        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
+        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
+        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
+        "${profile}/${f}"
+    done
+    authselect select custom/intune-profile --force --nobackup
+
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    cd /usr/share/selinux/packages/intune
+    tmp="$(mktemp -d)"
+    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
+    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
+    semodule -n -i "${tmp}/intune.pp"
+    rm -rf "${tmp}"
+
+  # intune-agent (user timer) reports compliance; enable it for every user.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    systemctl --user --global preset-all