4 Commits

Include renames

Author	SHA1	Message	Date
Wesley van TilburgandClaude Opus 5.5	ca115922bd	fedora-intune: query Defender through systemd-run instead of a snapshot ... The health snapshot's temp directory, chmod and mv in /run every 5 minutes showed up in Defender's timeline as "Data Staged" and "Executable permissions were added". Drop the snapshot service and timer. The compliance script now runs `mdatp health` through systemd-run, so systemd starts mdatp and Defender answers it even when the script runs inside himmelblaud-tasks. Without systemd-run access it asks mdatp directly, as before. No image support needed, so the script works on other distros as is. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 14:12:59 +00:00
Wesley van TilburgandClaude Opus 5.5	111d3bea66	fedora-intune: give the Intune compliance check a Defender health snapshot ... Himmelblau runs the custom compliance script inside himmelblaud-tasks, and Defender refuses to answer `mdatp health` there: the daemon can't read /proc/<himmelblaud_tasks>/cmdline while checking the caller ("Permission denied" in microsoft_defender_err.log). The script saw no daemon, and every Defender rule failed although Defender was healthy. Add mdatp-health-snapshot.timer, which saves the health fields to /run/mdatp-health every 5 minutes as root, outside that service. The compliance script reads the snapshot when it's under 20 minutes old and otherwise asks mdatp directly, so it still works on other distros. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 13:23:17 +00:00
Wesley van TilburgandClaude Opus 5.5	86039eeb9d	fedora-intune: enforce Defender protection settings ... Defender's defaults left behavior monitoring off and every setting unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json: real-time protection, behavior monitoring, PUA blocking, cloud-delivered protection at the high block level, automatic definition updates and sample submission, and scheduled scans (daily quick at 12:00, weekly full on Wednesday 12:30, low priority). Users can't change managed settings. The build fails if the file isn't valid JSON. Network protection (Insiders channels only) and tamper protection (audit-only preview on Linux) are left out. The compliance script and rules now also check behavior monitoring and cloud-delivered protection. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 12:23:30 +00:00
Wesley van TilburgandClaude Opus 5.5	75c3b502d7	fedora-intune: report full image version to Intune, Defender compliance script ... Himmelblau reports VERSION_ID from /etc/os-release as the device OS version, so Intune showed "44". Give himmelblaud and himmelblaud-tasks their own os-release (bind-mounted in their mount namespace only) with VERSION_ID set to OSTREE_VERSION, e.g. 44.20261019.0. The rest of the system keeps the stock VERSION_ID that toolbox, flatpak and dnf expect. Add an Intune custom compliance discovery script and rules for Microsoft Defender for Endpoint (installed, running, onboarded, licensed, healthy, real-time protection, definitions up to date). These are uploaded to Intune, not shipped in the image. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 09:13:03 +00:00