The managed config shipped in /etc never reached updated devices:
mdatp-firstboot creates /etc/opt/microsoft/mdatp on the device, so ostree's
/etc merge treats that directory as local and doesn't add new image files
under it. VM 123 had the file in /usr/etc but not in /etc, and Defender
kept its defaults.
Ship it in /usr/share/mdatp-managed/ and install it into
/etc/opt/microsoft/mdatp/managed/ from an ExecStartPre in mdatp.service.
This also applies changes from newer images and undoes local edits.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.
Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.
The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The RHEL 10 repo was there for the Intune app, which only ships for RHEL;
that app is gone and the repo now only provides mdatp. Use Microsoft's
Fedora 44 repo instead: Fedora is a supported Defender distribution
(servers and the Linux desktop preview), and it carries a newer build
(101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key
and signed metadata.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Fixes found by building and inspecting the image:
- Select the Intune authselect profile with-altfiles. Without it system
users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
with the default /opt -> /var/opt symlink those were the same
read-only directory. rpm-ostree still relocates /opt content to
/usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
compose /var is read-only and the machine GUID/state must not be
shared. mdatp.service waits for it.
New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).
No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.
build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Wesley van TilburgandClaude Opus 5.5