Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
  Wesley van TilburgandClaude Opus 5.5
|
ebe1d80f80 | ||
|
Wesley van TilburgandClaude Opus 5.5
|
4213575206 |
No files matched your search
@@ -26,11 +26,6 @@ add-files:
|
||||
- ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
|
||||
- ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
|
||||
- ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
|
||||
# Defender health for the Intune compliance script, which can't query
|
||||
# Defender itself from inside himmelblaud-tasks; see the script.
|
||||
- ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
|
||||
- ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
|
||||
- ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
|
||||
# Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
|
||||
# changes are refused): real-time protection, behavior monitoring, PUA
|
||||
# blocking, cloud protection at the "high" block level, automatic updates
|
||||
@@ -39,10 +34,7 @@ add-files:
|
||||
# reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
|
||||
# Not set here: network protection (Insiders channels only) and tamper
|
||||
# protection (audit-only preview on Linux).
|
||||
- ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
|
||||
# Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
|
||||
# see the drop-in.
|
||||
- ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
|
||||
- ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"]
|
||||
|
||||
postprocess:
|
||||
- |
|
||||
@@ -60,6 +52,6 @@ postprocess:
|
||||
done
|
||||
semodule -n -i "${pp}"
|
||||
# Fail the build on a typo rather than ship a config Defender can't read.
|
||||
python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
|
||||
python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null
|
||||
rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
|
||||
chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot
|
||||
chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst
|
||||
@@ -2,5 +2,3 @@
|
||||
enable mdatp-firstboot.service
|
||||
enable mdatp.service
|
||||
enable mde_netfilter_v2.socket
|
||||
# Health snapshot for the Intune compliance script.
|
||||
enable mdatp-health-snapshot.timer
|
||||
@@ -5,23 +5,16 @@
|
||||
# "44". Himmelblau reports VERSION_ID as the device's OS version and has no
|
||||
# setting for it. The rest of the system keeps the stock VERSION_ID, which
|
||||
# toolbox, flatpak and dnf expect to be the plain release.
|
||||
#
|
||||
# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
|
||||
# as the OS version string, and Fedora's PRETTY_NAME already contains the
|
||||
# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
|
||||
# else in Himmelblau reads PRETTY_NAME.
|
||||
set -euo pipefail
|
||||
|
||||
SRC=/usr/lib/os-release
|
||||
DEST=/run/himmelblau-os-release
|
||||
|
||||
version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
|
||||
name="$(. "${SRC}" && echo "${NAME:-Linux}")"
|
||||
|
||||
tmp="$(mktemp "${DEST}.XXXXXX")"
|
||||
if [[ -n "${version}" ]]; then
|
||||
sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
|
||||
-e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
|
||||
sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
|
||||
else
|
||||
# No image version (not an ostree/bootc deployment): pass it through as-is.
|
||||
cat "${SRC}" > "${tmp}"
|
||||
|
||||
@@ -11,9 +11,6 @@ apply_policy = true
|
||||
# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
|
||||
# added to it.
|
||||
local_sudo_group = wheel
|
||||
# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
|
||||
# local_groups_reconcile_interval after leaving the group.
|
||||
sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
|
||||
# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
|
||||
home_attr = CN
|
||||
home_alias = SPN
|
||||
|
||||
@@ -1,40 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
|
||||
# custom compliance script (intune/defender-compliance.sh).
|
||||
#
|
||||
# That script runs inside himmelblaud-tasks.service, and Defender refuses to
|
||||
# answer it there: the daemon checks the calling process tree, can't read
|
||||
# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
|
||||
# microsoft_defender_err.log), and the script sees no daemon. This runs from a
|
||||
# timer outside that service instead. Each file holds the raw
|
||||
# `mdatp health --field` output; the directory is replaced as a whole.
|
||||
set -euo pipefail
|
||||
|
||||
MDATP=/usr/bin/mdatp
|
||||
DEST=/run/mdatp-health
|
||||
FIELDS=(
|
||||
healthy
|
||||
licensed
|
||||
org_id
|
||||
real_time_protection_enabled
|
||||
behavior_monitoring
|
||||
cloud_enabled
|
||||
definitions_status
|
||||
definitions_updated_minutes_ago
|
||||
app_version
|
||||
)
|
||||
|
||||
tmp="$(mktemp -d "${DEST}.XXXXXX")"
|
||||
trap 'rm -rf "${tmp}"' EXIT
|
||||
for field in "${FIELDS[@]}"; do
|
||||
"${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
|
||||
done
|
||||
chmod 0755 "${tmp}"
|
||||
chmod 0644 "${tmp}"/*
|
||||
|
||||
# Swap in the new snapshot; readers see either the old or the new one.
|
||||
rm -rf "${DEST}.old"
|
||||
[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
|
||||
mv "${tmp}" "${DEST}"
|
||||
rm -rf "${DEST}.old"
|
||||
trap - EXIT
|
||||
@@ -1,7 +0,0 @@
|
||||
[Unit]
|
||||
Description=Save Microsoft Defender health for the Intune compliance check
|
||||
After=mdatp.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/libexec/mdatp-health-snapshot
|
||||
@@ -1,9 +0,0 @@
|
||||
[Unit]
|
||||
Description=Save Microsoft Defender health every 5 minutes
|
||||
|
||||
[Timer]
|
||||
OnBootSec=2min
|
||||
OnUnitActiveSec=5min
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -1,7 +0,0 @@
|
||||
# Install the image's enforced Defender settings each time Defender starts.
|
||||
# The image can't ship them in /etc directly: mdatp-firstboot creates
|
||||
# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
|
||||
# as local and ostree's /etc merge never adds new files under it. Copying on
|
||||
# every start also picks up changes from newer images and undoes local edits.
|
||||
[Service]
|
||||
ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
|
||||
@@ -10,21 +10,11 @@
|
||||
# instead of as a script error.
|
||||
|
||||
MDATP=/usr/bin/mdatp
|
||||
# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
|
||||
# a root timer may save the fields in /run/mdatp-health (the fedora-intune
|
||||
# image does). Used when under 20 minutes old, otherwise mdatp is asked.
|
||||
SNAPSHOT=/run/mdatp-health
|
||||
|
||||
if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
|
||||
raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
|
||||
else
|
||||
raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
|
||||
fi
|
||||
|
||||
# Print one `mdatp health` field without quotes or a trailing " [managed]".
|
||||
# Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
|
||||
field() {
|
||||
raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
|
||||
"${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
|
||||
| sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user