Misthios/bootc-images
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

fedora-intune: query Defender through systemd-run instead of a snapshot
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Details
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Details
Build containers / Compute changes (pull_request) Canceled after 14s
Details
Build containers / Prune old releases and tags (pull_request) Skipped
Details

Browse Source 
The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs `mdatp health` through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Wesley van TilburgandClaude Opus 5.5 committed 2026-10-20 14:12:59 +00:00
1 parent 082ae219b1
commit ca115922bd
6 files changed
+16 -92
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

images/fedora-intune/files/50-defender.preset
-2
View File
@@ -2,5 +2,3 @@
enable mdatp-firstboot.service
enable mdatp.service
enable mde_netfilter_v2.socket
# Health snapshot for the Intune compliance script.
enable mdatp-health-snapshot.timer