5 Commits

Include renames

Author	SHA1	Message	Date
Wesley van TilburgandClaude Opus 5.5	ca115922bd	fedora-intune: query Defender through systemd-run instead of a snapshot ... The health snapshot's temp directory, chmod and mv in /run every 5 minutes showed up in Defender's timeline as "Data Staged" and "Executable permissions were added". Drop the snapshot service and timer. The compliance script now runs `mdatp health` through systemd-run, so systemd starts mdatp and Defender answers it even when the script runs inside himmelblaud-tasks. Without systemd-run access it asks mdatp directly, as before. No image support needed, so the script works on other distros as is. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 14:12:59 +00:00
Wesley van TilburgandClaude Opus 5.5	111d3bea66	fedora-intune: give the Intune compliance check a Defender health snapshot ... Himmelblau runs the custom compliance script inside himmelblaud-tasks, and Defender refuses to answer `mdatp health` there: the daemon can't read /proc/<himmelblaud_tasks>/cmdline while checking the caller ("Permission denied" in microsoft_defender_err.log). The script saw no daemon, and every Defender rule failed although Defender was healthy. Add mdatp-health-snapshot.timer, which saves the health fields to /run/mdatp-health every 5 minutes as root, outside that service. The compliance script reads the snapshot when it's under 20 minutes old and otherwise asks mdatp directly, so it still works on other distros. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 13:23:17 +00:00
MisthiosandClaude Opus 5.5	8e6fedc05e	fedora-intune: use Himmelblau instead of the Microsoft Intune app ... Go with Entra ID sign-in through Himmelblau for fedora-intune and drop the Microsoft Intune app (intune-portal, identity broker) variant. With a single image, the workstation, Edge and Defender manifests move back from images/shared into images/fedora-intune, and CI builds just that image again. The Microsoft repo is now limited to mdatp and Edge. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 11:07:54 +00:00
MisthiosandClaude Opus 5.5	4f71d350fa	fedora-intune: fix boot issues, add Himmelblau variant ... Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 11:06:50 +00:00
MisthiosandClaude Opus 5.5	809bdc3bcb	fedora-intune: minimal GNOME workstation with Intune and Defender ... New image for testing Microsoft Intune enrollment and Linux compliance policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis, Files) with the Intune app, the Microsoft identity broker, Edge and Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10 builds, limited to those packages with includepkgs). No Kanidm: the Intune app installs its own authselect profile with pam_intune for the password compliance checks. Its %post cannot select the profile or load the SELinux module during a compose, so both are redone in postprocess. build.sh now copies every *.yaml of an image, so manifests can be split into more files than manifest.yaml and custom.yaml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 09:50:01 +00:00