5 Commits

Include renames

Author	SHA1	Message	Date
Wesley van TilburgandClaude Opus 5.5	86039eeb9d	fedora-intune: enforce Defender protection settings ... Defender's defaults left behavior monitoring off and every setting unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json: real-time protection, behavior monitoring, PUA blocking, cloud-delivered protection at the high block level, automatic definition updates and sample submission, and scheduled scans (daily quick at 12:00, weekly full on Wednesday 12:30, low priority). Users can't change managed settings. The build fails if the file isn't valid JSON. Network protection (Insiders channels only) and tamper protection (audit-only preview on Linux) are left out. The compliance script and rules now also check behavior monitoring and cloud-delivered protection. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 12:23:30 +00:00
Wesley van TilburgandClaude Opus 5.5	2b78113124	fedora-intune: install Defender from Microsoft's Fedora 44 repo ... The RHEL 10 repo was there for the Intune app, which only ships for RHEL; that app is gone and the repo now only provides mdatp. Use Microsoft's Fedora 44 repo instead: Fedora is a supported Defender distribution (servers and the Linux desktop preview), and it carries a newer build (101.26091.0003 vs 101.26081.0010 in the RHEL 10 repo). Same signing key and signed metadata. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-20 09:19:16 +00:00
MisthiosandClaude Opus 5.5	8e6fedc05e	fedora-intune: use Himmelblau instead of the Microsoft Intune app ... Go with Entra ID sign-in through Himmelblau for fedora-intune and drop the Microsoft Intune app (intune-portal, identity broker) variant. With a single image, the workstation, Edge and Defender manifests move back from images/shared into images/fedora-intune, and CI builds just that image again. The Microsoft repo is now limited to mdatp and Edge. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 11:07:54 +00:00
MisthiosandClaude Opus 5.5	4f71d350fa	fedora-intune: fix boot issues, add Himmelblau variant ... Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 11:06:50 +00:00
MisthiosandClaude Opus 5.5	809bdc3bcb	fedora-intune: minimal GNOME workstation with Intune and Defender ... New image for testing Microsoft Intune enrollment and Linux compliance policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis, Files) with the Intune app, the Microsoft identity broker, Edge and Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10 builds, limited to those packages with includepkgs). No Kanidm: the Intune app installs its own authselect profile with pam_intune for the password compliance checks. Its %post cannot select the profile or load the SELinux module during a compose, so both are redone in postprocess. build.sh now copies every *.yaml of an image, so manifests can be split into more files than manifest.yaml and custom.yaml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 09:50:01 +00:00