fedora-intune: give the Intune compliance check a Defender health snapshot

Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -2,6 +2,12 @@ name: Build containers
 
 on:
   workflow_dispatch:
+    inputs:
+      image:
+        description: Image to build
+        type: choice
+        options: [all, fedora-cosmic, fedora-remote, fedora-intune]
+        default: all
   pull_request:
     branches: ["main"]
   push:
@@ -15,10 +21,17 @@ jobs:
   changes:
     name: Compute changes
     runs-on: job-v2
+    # The runner has no git: without it actions/checkout falls back to a
+    # tarball with no history, `git diff` fails and every image is rebuilt.
+    container:
+      image: "quay.io/fedora-ostree-desktops/buildroot:44"
     outputs:
       cosmic: ${{ steps.changes.outputs.cosmic }}
       remote: ${{ steps.changes.outputs.remote }}
+      intune: ${{ steps.changes.outputs.intune }}
     steps:
+      - name: Install tools
+        run: dnf install -y nodejs git
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -26,20 +39,57 @@ jobs:
       - name: Detect changed images
         id: changes
         shell: bash
+        env:
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
+          SHA: ${{ github.sha }}
+          BASE_REF: ${{ github.base_ref }}
+          DISPATCH_IMAGE: ${{ inputs.image }}
         run: |
           set -euo pipefail
-          if [[ "${{ github.event_name }}" == "push" \
-                && -n "${{ github.event.before }}" \
-                && "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
-            changed="$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" || true)"
-          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            changed="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" || true)"
+          # Diff the event's commits; any failure rebuilds everything, but
+          # say so instead of hiding it.
+          diff_or_all() {
+            if ! changed="$(git diff --name-only "$@")"; then
+              echo "::warning::git diff $* failed; rebuilding every image"
+              changed=""
+            elif [[ -z "${changed}" ]]; then
+              # Nothing changed (e.g. an empty merge): build nothing rather
+              # than everything.
+              changed="(none)"
+            fi
+          }
+          case "${EVENT}" in
+            push)
+              if [[ -n "${BEFORE}" && "${BEFORE}" != 0000000000000000000000000000000000000000 ]]; then
+                diff_or_all "${BEFORE}" "${SHA}"
+              else
+                echo "::warning::push without a previous commit; rebuilding every image"
+                changed=""
+              fi
+              ;;
+            pull_request)
+              diff_or_all "origin/${BASE_REF}...HEAD"
+              ;;
+            workflow_dispatch)
+              # Pretend the chosen image's directory changed; "all" (or no
+              # input) rebuilds everything.
+              if [[ -n "${DISPATCH_IMAGE}" && "${DISPATCH_IMAGE}" != all ]]; then
+                changed="images/${DISPATCH_IMAGE}/"
               else
                 changed=""
               fi
+              ;;
+            *)
+              # schedule: the weekly rebuild picks up package updates for all.
+              changed=""
+              ;;
+          esac
+          printf 'Changed paths:\n%s\n' "${changed:-(all)}"
           eval "$(printf '%s\n' "${changed}" | ./ci-changes.sh)"
           echo "cosmic=${cosmic}" >> "$GITHUB_OUTPUT"
           echo "remote=${remote}" >> "$GITHUB_OUTPUT"
+          echo "intune=${intune}" >> "$GITHUB_OUTPUT"
 
   build-cosmic:
     name: ${{ matrix.image }} (${{ matrix.distro }})
@@ -102,6 +152,8 @@ jobs:
           fetch-depth: 0
 
       - name: Log in to registry
+        # Only the push step needs it, and PR builds get no secrets.
+        if: github.event_name != 'pull_request'
         env:
           REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
@@ -170,10 +222,30 @@ jobs:
 
     steps: *build_steps
 
+  build-intune:
+    name: fedora-intune (44)
+    needs: changes
+    if: needs.changes.outputs.intune == 'true'
+    runs-on: job-v2
+
+    container:
+      image: "quay.io/fedora-ostree-desktops/buildroot:44"
+      options: "--security-opt=label=disable --privileged --user 0:0 --device=/dev/fuse --volume /:/run/host:rw"
+
+    env:
+      IMAGE: fedora-intune
+      DISTRO: "44"
+      ARCH: x86_64
+      REGISTRY: git.plabble.org/misthios
+      GITEA_URL: https://git.plabble.org
+      GITEA_REPO: Misthios/bootc-images
+
+    steps: *build_steps
+
   prune:
     name: Prune old releases and tags
     runs-on: job-v2
-    needs: [changes, build-cosmic, build-remote]
+    needs: [changes, build-cosmic, build-remote, build-intune]
     # Run even if some builds were skipped or failed.
     if: ${{ always() && github.event_name != 'pull_request' }}
     container:
@@ -191,7 +263,7 @@ jobs:
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
-          for image in fedora-cosmic fedora-remote; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             ./prune-releases.sh "${image}"
           done
       - name: Prune old registry tags
@@ -203,6 +275,6 @@ jobs:
           authfile=/tmp/prune-auth.json
           echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
             --password-stdin --authfile "${authfile}" git.plabble.org
-          for image in fedora-cosmic fedora-remote; do
+          for image in fedora-cosmic fedora-remote fedora-intune; do
             AUTHFILE="${authfile}" ./prune-registry.sh "${image}" Misthios 44 rawhide
           done

build.sh

@@ -191,8 +191,7 @@ case "${BUILD_MODE}" in
 
     # Overlay our manifests/support files into the upstream tree so that
     # relative includes and *.repo discovery keep working.
-    cp "${IMAGE_DIR}/manifest.yaml" "${BUILD_DIR}/upstream/"
-    cp "${IMAGE_DIR}/custom.yaml" "${BUILD_DIR}/upstream/"
+    cp "${IMAGE_DIR}"/*.yaml "${BUILD_DIR}/upstream/"
     if compgen -G "${IMAGE_DIR}/repos/*.repo" >/dev/null; then
       cp "${IMAGE_DIR}"/repos/*.repo "${BUILD_DIR}/upstream/"
     fi

ci-changes.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
-# Given changed paths on stdin, print `cosmic=<bool>` and `remote=<bool>` so the
-# workflow can skip images that didn't change. Shared files or build tooling
-# changes rebuild everything; empty input (schedule/manual) rebuilds everything.
+# Given changed paths on stdin, print `cosmic=<bool>`, `remote=<bool>` and
+# `intune=<bool>` so the workflow can skip images that didn't change. Shared
+# files or build tooling changes rebuild everything; empty input
+# (schedule/manual) rebuilds everything.
 set -euo pipefail
 
 changed="$(cat || true)"
@@ -13,12 +14,16 @@ grep -qE '^images/shared/' <<< "${changed}" && all=1
 
 cosmic=false
 remote=false
+intune=false
 if [[ "${all}" == 1 ]]; then
   cosmic=true
   remote=true
+  intune=true
 fi
 grep -qE '^images/fedora-cosmic/' <<< "${changed}" && cosmic=true
 grep -qE '^images/fedora-remote/' <<< "${changed}" && remote=true
+grep -qE '^images/fedora-intune/' <<< "${changed}" && intune=true
 
 echo "cosmic=${cosmic}"
 echo "remote=${remote}"
+echo "intune=${intune}"

images/fedora-intune/build.conf

@@ -0,0 +1,10 @@
+# Build configuration for images/fedora-intune. Sourced by build.sh.
+
+BUILD_MODE=upstream
+
+UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
+
+# Stable only; Microsoft's Defender repo (fedora/44) has no rawhide build.
+declare -A UPSTREAM_REFS=(
+  [44]=f44
+)

images/fedora-intune/custom.yaml

@@ -0,0 +1,55 @@
+# Minimal GNOME workstation.
+
+packages:
+  # Fedora integration normally provided by the upstream fedora.yaml (which we
+  # opt out of to avoid the Firefox RPM).
+  - fedora-release
+  - fedora-release-ostree-desktop
+  - fedora-flathub-remote
+
+  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
+  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
+  # the first local user on first boot.
+  - gdm
+  - gnome-shell
+  - gnome-control-center
+  - gnome-initial-setup
+  - nautilus
+  - ptyxis
+  - pipewire
+  - pipewire-pulseaudio
+  - wireplumber
+  - xdg-desktop-portal-gnome
+  - xdg-user-dirs-gtk
+  - flatpak
+
+  # Session infrastructure base-atomic lacks with recommends off; see
+  # fedora-remote/custom.yaml.
+  - dbus-daemon
+  - systemd-pam
+  - mesa-dri-drivers
+  - mesa-libEGL
+
+  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
+  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
+  - tpm2-tools
+
+  # Proxmox guest integration (agent, console clipboard and resizing).
+  - qemu-guest-agent
+  - spice-vdagent
+
+# Microsoft Edge is the browser (Conditional Access needs it).
+exclude-packages:
+  - firefox
+
+add-files:
+  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
+  # Key-only SSH for local accounts.
+  - ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]
+
+postprocess:
+  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ln -sf /dev/null /etc/systemd/system/uresourced.service

images/fedora-intune/defender.yaml

@@ -0,0 +1,65 @@
+# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
+# microsoft-fedora44 repo (repos/microsoft.repo).
+#
+# mdatp's %post does the real install: units, SELinux module, and per-machine
+# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
+# logs). In a compose /var is read-only, and that state must not be shared
+# between machines anyway, so the %post is saved into the image and run once on
+# first boot by mdatp-firstboot.service. mdatp.service waits for it.
+#
+# Onboarding is per tenant and not part of the image: run the onboarding script
+# from the Defender portal on the device.
+
+repo-packages:
+  - repo: microsoft-fedora44
+    packages:
+      - mdatp
+
+packages:
+  # The %post is a bash script; Defender's inventory scripts and the
+  # onboarding script are Python.
+  - bash
+  - python3
+
+add-files:
+  - ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
+  - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
+  - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
+  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
+  # Defender health for the Intune compliance script, which can't query
+  # Defender itself from inside himmelblaud-tasks; see the script.
+  - ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
+  - ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
+  - ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
+  # Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
+  # changes are refused): real-time protection, behavior monitoring, PUA
+  # blocking, cloud protection at the "high" block level, automatic updates
+  # and sample submission, a daily quick scan at 12:00 and a weekly full scan
+  # on Wednesday 12:30 (low priority, up to 2 h later at random). Settings
+  # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
+  # Not set here: network protection (Insiders channels only) and tamper
+  # protection (audit-only preview on Linux).
+  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
+  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
+  # see the drop-in.
+  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    # The %post wrote the units during the compose; fail the build if a newer
+    # mdatp stops doing that, rather than shipping a Defender that never starts.
+    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
+      test -f "/usr/lib/systemd/system/${unit}"
+    done
+    # rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
+    for root in /usr/lib/opt /opt; do
+      pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
+      [[ -f "${pp}" ]] && break
+    done
+    semodule -n -i "${pp}"
+    # Fail the build on a typo rather than ship a config Defender can't read.
+    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
+    rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/10-himmelblau-os-release.conf

@@ -0,0 +1,9 @@
+# Report the full image version (VERSION_ID=44.20261019.0) to Entra ID and
+# Intune instead of "44"; see /usr/libexec/himmelblau-os-release. Only this
+# service's mount namespace sees the replacement os-release.
+[Unit]
+Requires=himmelblau-os-release.service
+After=himmelblau-os-release.service
+
+[Service]
+BindReadOnlyPaths=/run/himmelblau-os-release:/etc/os-release

images/fedora-intune/files/10-workstation-sshd.conf

@@ -0,0 +1,6 @@
+# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
+PubkeyAuthentication yes
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no

images/fedora-intune/files/50-defender.preset

@@ -0,0 +1,6 @@
+# Defender: first-boot setup, the daemon and its network filter.
+enable mdatp-firstboot.service
+enable mdatp.service
+enable mde_netfilter_v2.socket
+# Health snapshot for the Intune compliance script.
+enable mdatp-health-snapshot.timer

images/fedora-intune/files/50-himmelblau-user.preset

@@ -0,0 +1,3 @@
+# Intune compliance check at login and on a timer, for every user.
+enable himmelblau-compliance-check.service
+enable himmelblau-compliance-check.timer

images/fedora-intune/files/50-himmelblau.preset

@@ -0,0 +1,6 @@
+# Himmelblau daemons; they pull in their sockets with Requires=.
+enable himmelblaud.service
+enable himmelblaud-tasks.service
+enable himmelblau-hsm-pin-init.service
+# Runs the Intune custom configuration scripts Himmelblau puts in /etc/cron.d.
+enable crond.service

images/fedora-intune/files/50-workstation.preset

@@ -0,0 +1,3 @@
+enable gdm.service
+enable qemu-guest-agent.service
+enable sshd.service

images/fedora-intune/files/edge-himmelblau-policy.json

@@ -0,0 +1,5 @@
+{
+  "ExtensionInstallForcelist": [
+    "jlnfnnolkbjieggibinobhkjdfbpcohn;https://clients2.google.com/service/update2/crx"
+  ]
+}

images/fedora-intune/files/edge-linux_entra_sso.json

@@ -0,0 +1,9 @@
+{
+    "name": "linux_entra_sso",
+    "description": "Entra ID SSO via Microsoft Identity Broker",
+    "path": "/usr/bin/linux-entra-sso",
+    "type": "stdio",
+    "allowed_origins": [
+        "chrome-extension://jlnfnnolkbjieggibinobhkjdfbpcohn/"
+    ]
+}

images/fedora-intune/files/himmelblau-os-release

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Write the os-release that the Himmelblau daemons see (10-os-release.conf):
+# the image's /usr/lib/os-release with VERSION_ID set to the full image version
+# (OSTREE_VERSION, e.g. 44.20261019.0), so Intune shows the build and not just
+# "44". Himmelblau reports VERSION_ID as the device's OS version and has no
+# setting for it. The rest of the system keeps the stock VERSION_ID, which
+# toolbox, flatpak and dnf expect to be the plain release.
+#
+# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
+# as the OS version string, and Fedora's PRETTY_NAME already contains the
+# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
+# else in Himmelblau reads PRETTY_NAME.
+set -euo pipefail
+
+SRC=/usr/lib/os-release
+DEST=/run/himmelblau-os-release
+
+version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
+name="$(. "${SRC}" && echo "${NAME:-Linux}")"
+
+tmp="$(mktemp "${DEST}.XXXXXX")"
+if [[ -n "${version}" ]]; then
+  sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
+      -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
+else
+  # No image version (not an ostree/bootc deployment): pass it through as-is.
+  cat "${SRC}" > "${tmp}"
+fi
+chmod 0644 "${tmp}"
+mv -f "${tmp}" "${DEST}"

images/fedora-intune/files/himmelblau-os-release.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Generate the os-release reported by Himmelblau to Intune
+DefaultDependencies=no
+After=local-fs.target
+Before=himmelblaud.service himmelblaud-tasks.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/himmelblau-os-release
+RemainAfterExit=yes

images/fedora-intune/files/himmelblau.conf

@@ -0,0 +1,20 @@
+# Himmelblau configuration. See himmelblau.conf(5) and
+# https://himmelblau-idm.org/docs/reference/himmelblau-conf/
+#
+# No tenant settings are needed: `domain` defaults to the domain of the first
+# user who signs in, and that user joins the device to Entra ID. Restrict who
+# may sign in with pam_allow_groups (group object IDs or UPNs).
+
+[global]
+# Enroll the device in Intune and apply/report compliance policies.
+apply_policy = true
+# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
+# added to it.
+local_sudo_group = wheel
+# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
+# local_groups_reconcile_interval after leaving the group.
+sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
+# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
+home_attr = CN
+home_alias = SPN
+use_etc_skel = true

images/fedora-intune/files/mdatp-firstboot

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Finish the Defender (mdatp) install on first boot by running the package's
+# own %post, saved at build time: it creates the machine GUID, state, logs and
+# definitions database under /var and then enables and starts mdatp.service.
+set -euo pipefail
+
+MARKER=/var/lib/mdatp-firstboot.done
+
+[[ -f "${MARKER}" ]] && exit 0
+
+# mdatp.service only starts once the marker exists (10-firstboot.conf), and the
+# %post starts it, so create the marker first and drop it again on failure.
+touch "${MARKER}"
+if ! bash /usr/libexec/mdatp-postinst 1; then
+  rm -f "${MARKER}"
+  exit 1
+fi

images/fedora-intune/files/mdatp-firstboot.conf

@@ -0,0 +1,3 @@
+# Don't start Defender before mdatp-firstboot.service has created its state.
+[Unit]
+ConditionPathExists=/var/lib/mdatp-firstboot.done

images/fedora-intune/files/mdatp-firstboot.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Finish the Microsoft Defender for Endpoint install on first boot
+Documentation=https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=!/var/lib/mdatp-firstboot.done
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/mdatp-firstboot
+RemainAfterExit=yes
+TimeoutStartSec=15min
+
+[Install]
+WantedBy=multi-user.target

images/fedora-intune/files/mdatp-health-snapshot

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
+# custom compliance script (intune/defender-compliance.sh).
+#
+# That script runs inside himmelblaud-tasks.service, and Defender refuses to
+# answer it there: the daemon checks the calling process tree, can't read
+# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
+# microsoft_defender_err.log), and the script sees no daemon. This runs from a
+# timer outside that service instead. Each file holds the raw
+# `mdatp health --field` output; the directory is replaced as a whole.
+set -euo pipefail
+
+MDATP=/usr/bin/mdatp
+DEST=/run/mdatp-health
+FIELDS=(
+  healthy
+  licensed
+  org_id
+  real_time_protection_enabled
+  behavior_monitoring
+  cloud_enabled
+  definitions_status
+  definitions_updated_minutes_ago
+  app_version
+)
+
+tmp="$(mktemp -d "${DEST}.XXXXXX")"
+trap 'rm -rf "${tmp}"' EXIT
+for field in "${FIELDS[@]}"; do
+  "${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
+done
+chmod 0755 "${tmp}"
+chmod 0644 "${tmp}"/*
+
+# Swap in the new snapshot; readers see either the old or the new one.
+rm -rf "${DEST}.old"
+[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
+mv "${tmp}" "${DEST}"
+rm -rf "${DEST}.old"
+trap - EXIT

images/fedora-intune/files/mdatp-health-snapshot.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Save Microsoft Defender health for the Intune compliance check
+After=mdatp.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/mdatp-health-snapshot.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Save Microsoft Defender health every 5 minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=timers.target

images/fedora-intune/files/mdatp-managed-config.conf

@@ -0,0 +1,7 @@
+# Install the image's enforced Defender settings each time Defender starts.
+# The image can't ship them in /etc directly: mdatp-firstboot creates
+# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
+# as local and ostree's /etc merge never adds new files under it. Copying on
+# every start also picks up changes from newer images and undoes local edits.
+[Service]
+ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

images/fedora-intune/files/mdatp_managed.json

@@ -0,0 +1,29 @@
+{
+  "antivirusEngine": {
+    "enforcementLevel": "real_time",
+    "behaviorMonitoring": "enabled",
+    "scanAfterDefinitionUpdate": true,
+    "scanArchives": true,
+    "disallowedThreatActions": ["allow", "restore"],
+    "threatTypeSettingsMergePolicy": "admin_only",
+    "threatTypeSettings": [
+      { "key": "potentially_unwanted_application", "value": "block" },
+      { "key": "archive_bomb", "value": "audit" }
+    ],
+    "scheduledScan": "enabled"
+  },
+  "scheduledScan": {
+    "dailyConfiguration": { "timeOfDay": 720 },
+    "weeklyConfiguration": { "dayOfWeek": 4, "scanType": "full", "timeOfDay": 750 },
+    "lowPriorityScheduledScan": true,
+    "checkForDefinitionsUpdate": true,
+    "randomizeScanStartTime": 2
+  },
+  "cloudService": {
+    "enabled": true,
+    "diagnosticLevel": "required",
+    "automaticSampleSubmissionConsent": "safe",
+    "automaticDefinitionUpdateEnabled": true,
+    "cloudBlockLevel": "high"
+  }
+}

images/fedora-intune/himmelblau.yaml

@@ -0,0 +1,77 @@
+# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
+# enrollment and compliance, and browser SSO.
+
+repo-packages:
+  - repo: himmelblau
+    packages:
+      - himmelblau
+      - pam-himmelblau
+      - nss-himmelblau
+      - himmelblau-selinux
+      # Shows a QR code on the login screen for the MFA/device-code prompts.
+      - himmelblau-qr-greeter
+      # Entra SSO in Edge (native messaging host) via the Himmelblau broker.
+      - himmelblau-broker
+      - himmelblau-sso
+
+packages:
+  - authselect
+  - nss-altfiles
+  # himmelblau-selinux compiles its policy module at install time.
+  - make
+  - selinux-policy-devel
+  # Intune custom configuration scripts are installed as /etc/cron.d jobs.
+  - cronie
+
+add-files:
+  - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
+  - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
+  - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
+  # Report the full image version (44.20261019.0) as the OS version in Intune.
+  - ["himmelblau-os-release", "/usr/libexec/himmelblau-os-release"]
+  - ["himmelblau-os-release.service", "/usr/lib/systemd/system/himmelblau-os-release.service"]
+  - ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud.service.d/10-os-release.conf"]
+  - ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud-tasks.service.d/10-os-release.conf"]
+
+postprocess:
+  # The package's %post selects its authselect vendor profile but drops
+  # with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
+  # /usr/lib/passwd do not resolve and the login screen never starts.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
+    for user in gdm mdatp; do
+      getent passwd "${user}" >/dev/null
+    done
+    grep -q pam_himmelblau.so /etc/pam.d/system-auth
+    chmod 0755 /usr/libexec/himmelblau-os-release
+    test -d /etc/cron.d
+
+  # himmelblau-selinux builds and loads its module in %posttrans, which does
+  # nothing in a compose; do it here.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    tmp="$(mktemp -d)"
+    cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
+    make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
+    semodule -n -i "${tmp}/himmelblaud.pp"
+    rm -rf "${tmp}"
+
+  # Show the QR greeter on the GDM login screen, not only in user sessions.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    install -d /etc/dconf/db/gdm.d
+    cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
+    [org/gnome/shell]
+    enabled-extensions=['qr-greeter@himmelblau-idm.org']
+    CONF
+    dconf update
+
+  # Compliance check (user timer) and broker for every user.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    systemctl --user --global preset-all

images/fedora-intune/intune/defender-compliance.json

@@ -0,0 +1,130 @@
+{
+  "Rules": [
+    {
+      "SettingName": "DefenderInstalled",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender is not installed.",
+          "Description": "Microsoft Defender for Endpoint (mdatp) must be installed on this device."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderRunning",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender is not running.",
+          "Description": "The Microsoft Defender service (mdatp.service) is not responding. Restart the device or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderOnboarded",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender is not onboarded.",
+          "Description": "This device is not onboarded to your organization's Microsoft Defender tenant. Contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderLicensed",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender is not licensed.",
+          "Description": "Microsoft Defender has no valid license on this device. Contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderHealthy",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender reports a problem.",
+          "Description": "Run 'mdatp health' to see the reported issues, or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderRealTimeProtection",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Real-time protection is off.",
+          "Description": "Microsoft Defender real-time protection must be enabled."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderBehaviorMonitoring",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Behavior monitoring is off.",
+          "Description": "Microsoft Defender behavior monitoring must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderCloudProtection",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Cloud-delivered protection is off.",
+          "Description": "Microsoft Defender cloud-delivered protection must be enabled. Update the device to the latest image or contact IT."
+        }
+      ]
+    },
+    {
+      "SettingName": "DefenderDefinitionsUpToDate",
+      "Operator": "IsEquals",
+      "DataType": "Boolean",
+      "Operand": true,
+      "MoreInfoUrl": "https://learn.microsoft.com/en-us/defender-endpoint/linux-install-manually",
+      "RemediationStrings": [
+        {
+          "Language": "en_US",
+          "Title": "Microsoft Defender definitions are out of date.",
+          "Description": "Connect the device to the network so Microsoft Defender can update its security intelligence."
+        }
+      ]
+    }
+  ]
+}

images/fedora-intune/intune/defender-compliance.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+# Intune custom compliance discovery script for Linux: is Microsoft Defender
+# for Endpoint (mdatp) installed, onboarded, licensed and protecting?
+#
+# Upload in Intune > Devices > Compliance > Scripts (Linux), and pair it with
+# defender-compliance.json in a Linux compliance policy (Custom compliance).
+# Himmelblau runs it as root inside himmelblaud-tasks.service and sends the
+# JSON on stdout to Intune, which evaluates it against the rules. Every setting
+# is always emitted, so a missing or stopped Defender reads as non-compliant
+# instead of as a script error.
+
+MDATP=/usr/bin/mdatp
+# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
+# a root timer may save the fields in /run/mdatp-health (the fedora-intune
+# image does). Used when under 20 minutes old, otherwise mdatp is asked.
+SNAPSHOT=/run/mdatp-health
+
+if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
+  raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
+else
+  raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
+fi
+
+# Print one `mdatp health` field without quotes or a trailing " [managed]".
+# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
+field() {
+  raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
+    | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
+}
+
+bool() {
+  [[ "$1" == true ]] && echo true || echo false
+}
+
+installed=false
+running=false
+healthy=false
+licensed=false
+onboarded=false
+rtp=false
+behavior_monitoring=false
+cloud_protection=false
+definitions_ok=false
+definitions_age=-1
+version=""
+
+if [[ -x "${MDATP}" ]]; then
+  installed=true
+  if [[ "$(field healthy)" =~ ^(true|false)$ ]]; then
+    # The daemon answered.
+    running=true
+    healthy="$(bool "$(field healthy)")"
+    licensed="$(bool "$(field licensed)")"
+    rtp="$(bool "$(field real_time_protection_enabled)")"
+    [[ "$(field behavior_monitoring)" == enabled ]] && behavior_monitoring=true
+    cloud_protection="$(bool "$(field cloud_enabled)")"
+    [[ -n "$(field org_id)" ]] && onboarded=true
+    [[ "$(field definitions_status)" == up_to_date ]] && definitions_ok=true
+    age="$(field definitions_updated_minutes_ago)"
+    [[ "${age}" =~ ^[0-9]+$ ]] && definitions_age=$(( age / 1440 ))
+    version="$(field app_version)"
+    version="${version//[^0-9A-Za-z._-]/}"
+  fi
+fi
+
+cat <<EOF
+{
+  "DefenderInstalled": ${installed},
+  "DefenderRunning": ${running},
+  "DefenderHealthy": ${healthy},
+  "DefenderLicensed": ${licensed},
+  "DefenderOnboarded": ${onboarded},
+  "DefenderRealTimeProtection": ${rtp},
+  "DefenderBehaviorMonitoring": ${behavior_monitoring},
+  "DefenderCloudProtection": ${cloud_protection},
+  "DefenderDefinitionsUpToDate": ${definitions_ok},
+  "DefenderDefinitionsAgeDays": ${definitions_age},
+  "DefenderVersion": "${version}"
+}
+EOF

images/fedora-intune/intune/defender-remediation.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+# Intune custom configuration script for Linux: bring Microsoft Defender for
+# Endpoint (mdatp) back to the state defender-compliance.sh checks for.
+#
+# Intune has no "run only when non-compliant" trigger for Linux, so this runs
+# on the policy's schedule and only acts on what is wrong; on a healthy device
+# it only reads `mdatp health`. Himmelblau installs it as an /etc/cron.d job.
+#
+# Intune > Devices > Configuration > Create > Linux > Settings catalog >
+# Custom Configuration:
+#   Execution context:   root
+#   Execution frequency: every 1 hour (or 15 minutes while rolling out)
+#   Execution retries:   1
+#   Script:              this file, with ONBOARDING_JSON filled in
+#
+# Exit status is non-zero when Defender is still not healthy afterwards.
+
+# Contents of mdatp_onboard.json from the Defender portal: Settings > Endpoints
+# > Onboarding > Linux Server > "Local Script (Python)". The downloaded
+# MicrosoftDefenderATPOnboardingLinuxServer.py writes this file to
+# /etc/opt/microsoft/mdatp/ on the machine it runs on; paste that file's
+# contents here. Leave the placeholder to skip onboarding.
+ONBOARDING_JSON=$(cat <<'JSON'
+REPLACE_WITH_MDATP_ONBOARD_JSON
+JSON
+)
+
+MDATP=/usr/bin/mdatp
+ONBOARD_FILE=/etc/opt/microsoft/mdatp/mdatp_onboard.json
+
+log() {
+  logger -t defender-remediation -- "$*"
+  echo "$*"
+}
+
+# Print one `mdatp health` field without quotes, a trailing " [managed]" or
+# the "ATTENTION: ..." lines mdatp prints while unlicensed.
+field() {
+  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
+    | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
+}
+
+# Wait up to 2 minutes for the daemon to answer.
+wait_for_daemon() {
+  local i
+  for i in $(seq 1 24); do
+    [[ "$(field healthy)" =~ ^(true|false)$ ]] && return 0
+    sleep 5
+  done
+  return 1
+}
+
+if [[ ! -x "${MDATP}" ]]; then
+  log "mdatp is not installed; it ships in the image, so update or rebase the device."
+  exit 1
+fi
+
+# The image finishes the Defender install on first boot (mdatp-firstboot).
+if [[ ! -f /var/lib/mdatp-firstboot.done ]]; then
+  log "Defender first-boot setup has not completed; starting it."
+  systemctl start mdatp-firstboot.service
+fi
+
+if ! systemctl is-active --quiet mdatp.service; then
+  log "mdatp.service is not running; restarting it."
+  systemctl restart mdatp.service
+fi
+if ! wait_for_daemon; then
+  log "The Defender daemon does not respond."
+  exit 1
+fi
+
+if [[ -z "$(field org_id)" ]]; then
+  # Prefix match, so the placeholder appears only once in this file and a
+  # find-and-replace of it can't hit this line.
+  if [[ "${ONBOARDING_JSON}" == REPLACE_WITH_* ]]; then
+    log "Defender is not onboarded and this script has no onboarding JSON."
+  elif ! printf '%s\n' "${ONBOARDING_JSON}" \
+      | python3 -c 'import json, sys; assert "onboardingInfo" in json.load(sys.stdin)' 2>/dev/null; then
+    # A paste that lost the first "{" or last "}" line would otherwise leave
+    # Defender with an unreadable onboarding file ("No license found").
+    log "The onboarding JSON in this script is not valid; paste mdatp_onboard.json again, including its first '{' and last '}' lines."
+    exit 1
+  else
+    log "Defender is not onboarded; writing ${ONBOARD_FILE}."
+    install -d -m 0755 "$(dirname "${ONBOARD_FILE}")"
+    printf '%s\n' "${ONBOARDING_JSON}" > "${ONBOARD_FILE}.tmp"
+    chown root:mdatp "${ONBOARD_FILE}.tmp"
+    chmod 0600 "${ONBOARD_FILE}.tmp"
+    mv -f "${ONBOARD_FILE}.tmp" "${ONBOARD_FILE}"
+    systemctl restart mdatp.service
+    wait_for_daemon || { log "The Defender daemon does not respond after onboarding."; exit 1; }
+  fi
+fi
+
+# Settings Defender's own policy manages show " [managed]" and can't be
+# changed locally; this only fixes a locally disabled real-time protection.
+if [[ "$(field real_time_protection_enabled)" != true ]]; then
+  log "Real-time protection is off; enabling it."
+  "${MDATP}" config real-time-protection --value enabled
+fi
+
+if [[ "$(field definitions_status)" != up_to_date ]]; then
+  log "Definitions are not up to date; updating them."
+  "${MDATP}" definitions update
+fi
+
+healthy="$(field healthy)"
+log "healthy=${healthy} licensed=$(field licensed) org_id=$(field org_id) rtp=$(field real_time_protection_enabled) definitions=$(field definitions_status)"
+[[ "${healthy}" == true ]]

images/fedora-intune/manifest.yaml

@@ -0,0 +1,39 @@
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance.
+
+metadata:
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune
+
+variables:
+  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
+  distro: "fedora-intune"
+  variant: "intune"
+
+# Keep it small: no weak/optional dependencies.
+recommends: false
+
+default_target: graphical.target
+
+ref: fedora-intune/${releasever_ref}/${basearch}/intune
+
+# Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
+# Defender installs to /opt/microsoft/mdatp and keeps its state in
+# /var/opt/microsoft/mdatp; with the default symlink those are the same,
+# read-only directory. Needs composefs, which upstream enables. The vendor
+# directories are linked into /opt by finalize.d/60-opt-links.
+opt-usrlocal: root
+
+repos:
+  - himmelblau
+  - microsoft-fedora44
+  - microsoft-edge
+
+include:
+  - base-atomic.yaml
+  - custom.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml
+  - microsoft-edge.yaml
+  - defender.yaml

images/fedora-intune/microsoft-edge.yaml

@@ -0,0 +1,15 @@
+# Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo).
+# Conditional Access to Microsoft 365 web apps on Linux requires Edge.
+#
+# Entra SSO in Edge: himmelblau-sso only registers its native messaging host
+# and force-installs the Linux Entra SSO extension for Chrome, Chromium and
+# Firefox. Edge reads /etc/opt/edge, so add the same two files there.
+
+repo-packages:
+  - repo: microsoft-edge
+    packages:
+      - microsoft-edge-stable
+
+add-files:
+  - ["edge-linux_entra_sso.json", "/etc/opt/edge/native-messaging-hosts/linux_entra_sso.json"]
+  - ["edge-himmelblau-policy.json", "/etc/opt/edge/policies/managed/himmelblau.json"]

images/fedora-intune/repos/himmelblau.repo

@@ -0,0 +1,9 @@
+# Himmelblau Community Nightly packages (free development builds). The
+# maintained Stable repositories need a subscription entitlement token:
+# https://himmelblau-idm.org/stable-repositories/
+[himmelblau]
+name=Himmelblau Community Nightly (Fedora 44)
+baseurl=https://packages.himmelblau-idm.org/nightly/latest/rpm/fedora44
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.himmelblau-idm.org/himmelblau.asc

images/fedora-intune/repos/microsoft.repo

@@ -0,0 +1,23 @@
+# packages.microsoft.com, limited with includepkgs to the packages the image
+# uses, so nothing else from the Microsoft repo can replace a Fedora package.
+#
+# Fedora 44 build of Defender (mdatp): Fedora is a supported Defender
+# distribution, servers and desktops. Pinned to 44 rather than $releasever so a
+# new Fedora release doesn't fail the build before Microsoft publishes its repo.
+
+[microsoft-fedora44]
+name=Microsoft Production (Fedora 44)
+baseurl=https://packages.microsoft.com/fedora/44/prod/
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
+includepkgs=mdatp
+
+[microsoft-edge]
+name=Microsoft Edge
+baseurl=https://packages.microsoft.com/yumrepos/edge/
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.microsoft.com/keys/microsoft.asc
+includepkgs=microsoft-edge-stable

images/shared/files/finalize.d/60-opt-links

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Runs in the target root during `rpm-ostree compose image` (edition 2024
+# finalize.d hook). rpm-ostree relocates RPM content under /opt to
+# /usr/lib/opt. With `opt-usrlocal: root` /opt is a plain directory in the
+# image and nothing links it back, so link each vendor directory. Images on the
+# default (/opt -> /var/opt, linked by tmpfiles.d) are left alone.
+set -euo pipefail
+
+root="${PWD}"
+
+[[ -d "${root}/usr/lib/opt" ]] || exit 0
+if [[ -L "${root}/opt" || ! -d "${root}/opt" ]]; then
+  exit 0
+fi
+
+for dir in "${root}"/usr/lib/opt/*; do
+  name="$(basename "${dir}")"
+  ln -sfn "../usr/lib/opt/${name}" "${root}/opt/${name}"
+  echo "Linked /opt/${name} -> /usr/lib/opt/${name}"
+done