fedora-intune: enforce Defender protection settings

Defender's defaults left behavior monitoring off and every setting
unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json:
real-time protection, behavior monitoring, PUA blocking, cloud-delivered
protection at the high block level, automatic definition updates and
sample submission, and scheduled scans (daily quick at 12:00, weekly full
on Wednesday 12:30, low priority). Users can't change managed settings.
The build fails if the file isn't valid JSON.

Network protection (Insiders channels only) and tamper protection
(audit-only preview on Linux) are left out.

The compliance script and rules now also check behavior monitoring and
cloud-delivered protection.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -26,11 +26,6 @@ add-files:
   - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
   - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
   - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
-  # Defender health for the Intune compliance script, which can't query
-  # Defender itself from inside himmelblaud-tasks; see the script.
-  - ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
-  - ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
-  - ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
   # Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
   # changes are refused): real-time protection, behavior monitoring, PUA
   # blocking, cloud protection at the "high" block level, automatic updates
@@ -39,10 +34,7 @@ add-files:
   # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
   # Not set here: network protection (Insiders channels only) and tamper
   # protection (audit-only preview on Linux).
-  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
+  - ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"]
-  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
-  # see the drop-in.
-  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
 
 postprocess:
   - |
@@ -60,6 +52,6 @@ postprocess:
     done
     semodule -n -i "${pp}"
     # Fail the build on a typo rather than ship a config Defender can't read.
-    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
+    python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null
     rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
-    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst

images/fedora-intune/files/50-defender.preset

@@ -2,5 +2,3 @@
 enable mdatp-firstboot.service
 enable mdatp.service
 enable mde_netfilter_v2.socket
-# Health snapshot for the Intune compliance script.
-enable mdatp-health-snapshot.timer

images/fedora-intune/files/himmelblau-os-release

@@ -5,23 +5,16 @@
 # "44". Himmelblau reports VERSION_ID as the device's OS version and has no
 # setting for it. The rest of the system keeps the stock VERSION_ID, which
 # toolbox, flatpak and dnf expect to be the plain release.
-#
-# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
-# as the OS version string, and Fedora's PRETTY_NAME already contains the
-# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
-# else in Himmelblau reads PRETTY_NAME.
 set -euo pipefail
 
 SRC=/usr/lib/os-release
 DEST=/run/himmelblau-os-release
 
 version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
-name="$(. "${SRC}" && echo "${NAME:-Linux}")"
 
 tmp="$(mktemp "${DEST}.XXXXXX")"
 if [[ -n "${version}" ]]; then
-  sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
+  sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
-      -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
 else
   # No image version (not an ostree/bootc deployment): pass it through as-is.
   cat "${SRC}" > "${tmp}"

images/fedora-intune/files/himmelblau.conf

@@ -11,9 +11,6 @@ apply_policy = true
 # Fedora's admin group; members of sudo_groups (Entra group object IDs) are
 # added to it.
 local_sudo_group = wheel
-# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
-# local_groups_reconcile_interval after leaving the group.
-sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
 # Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
 home_attr = CN
 home_alias = SPN

images/fedora-intune/files/mdatp-health-snapshot

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
-# custom compliance script (intune/defender-compliance.sh).
-#
-# That script runs inside himmelblaud-tasks.service, and Defender refuses to
-# answer it there: the daemon checks the calling process tree, can't read
-# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
-# microsoft_defender_err.log), and the script sees no daemon. This runs from a
-# timer outside that service instead. Each file holds the raw
-# `mdatp health --field` output; the directory is replaced as a whole.
-set -euo pipefail
-
-MDATP=/usr/bin/mdatp
-DEST=/run/mdatp-health
-FIELDS=(
-  healthy
-  licensed
-  org_id
-  real_time_protection_enabled
-  behavior_monitoring
-  cloud_enabled
-  definitions_status
-  definitions_updated_minutes_ago
-  app_version
-)
-
-tmp="$(mktemp -d "${DEST}.XXXXXX")"
-trap 'rm -rf "${tmp}"' EXIT
-for field in "${FIELDS[@]}"; do
-  "${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
-done
-chmod 0755 "${tmp}"
-chmod 0644 "${tmp}"/*
-
-# Swap in the new snapshot; readers see either the old or the new one.
-rm -rf "${DEST}.old"
-[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
-mv "${tmp}" "${DEST}"
-rm -rf "${DEST}.old"
-trap - EXIT

images/fedora-intune/files/mdatp-health-snapshot.service

@@ -1,7 +0,0 @@
-[Unit]
-Description=Save Microsoft Defender health for the Intune compliance check
-After=mdatp.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/mdatp-health-snapshot.timer

@@ -1,9 +0,0 @@
-[Unit]
-Description=Save Microsoft Defender health every 5 minutes
-
-[Timer]
-OnBootSec=2min
-OnUnitActiveSec=5min
-
-[Install]
-WantedBy=timers.target

images/fedora-intune/files/mdatp-managed-config.conf

@@ -1,7 +0,0 @@
-# Install the image's enforced Defender settings each time Defender starts.
-# The image can't ship them in /etc directly: mdatp-firstboot creates
-# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
-# as local and ostree's /etc merge never adds new files under it. Copying on
-# every start also picks up changes from newer images and undoes local edits.
-[Service]
-ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

images/fedora-intune/intune/defender-compliance.sh

@@ -10,21 +10,11 @@
 # instead of as a script error.
 
 MDATP=/usr/bin/mdatp
-# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
-# a root timer may save the fields in /run/mdatp-health (the fedora-intune
-# image does). Used when under 20 minutes old, otherwise mdatp is asked.
-SNAPSHOT=/run/mdatp-health
-
-if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
-  raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
-else
-  raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
-fi
 
 # Print one `mdatp health` field without quotes or a trailing " [managed]".
 # Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
 field() {
-  raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
+  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
     | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
 }