fedora-intune: give the Intune compliance check a Defender health snapshot

Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/defender.yaml

@@ -26,6 +26,11 @@ add-files:
   - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
   - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
   - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
+  # Defender health for the Intune compliance script, which can't query
+  # Defender itself from inside himmelblaud-tasks; see the script.
+  - ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
+  - ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
+  - ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
   # Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
   # changes are refused): real-time protection, behavior monitoring, PUA
   # blocking, cloud protection at the "high" block level, automatic updates
@@ -34,7 +39,10 @@ add-files:
   # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
   # Not set here: network protection (Insiders channels only) and tamper
   # protection (audit-only preview on Linux).
-  - ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"]
+  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
+  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
+  # see the drop-in.
+  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
 
 postprocess:
   - |
@@ -52,6 +60,6 @@ postprocess:
     done
     semodule -n -i "${pp}"
     # Fail the build on a typo rather than ship a config Defender can't read.
-    python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null
+    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
     rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
-    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/50-defender.preset

@@ -2,3 +2,5 @@
 enable mdatp-firstboot.service
 enable mdatp.service
 enable mde_netfilter_v2.socket
+# Health snapshot for the Intune compliance script.
+enable mdatp-health-snapshot.timer

images/fedora-intune/files/himmelblau-os-release

@@ -5,16 +5,23 @@
 # "44". Himmelblau reports VERSION_ID as the device's OS version and has no
 # setting for it. The rest of the system keeps the stock VERSION_ID, which
 # toolbox, flatpak and dnf expect to be the plain release.
+#
+# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID"
+# as the OS version string, and Fedora's PRETTY_NAME already contains the
+# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing
+# else in Himmelblau reads PRETTY_NAME.
 set -euo pipefail
 
 SRC=/usr/lib/os-release
 DEST=/run/himmelblau-os-release
 
 version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")"
+name="$(. "${SRC}" && echo "${NAME:-Linux}")"
 
 tmp="$(mktemp "${DEST}.XXXXXX")"
 if [[ -n "${version}" ]]; then
-  sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}"
+  sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \
+      -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}"
 else
   # No image version (not an ostree/bootc deployment): pass it through as-is.
   cat "${SRC}" > "${tmp}"

images/fedora-intune/files/himmelblau.conf

@@ -11,6 +11,9 @@ apply_policy = true
 # Fedora's admin group; members of sudo_groups (Entra group object IDs) are
 # added to it.
 local_sudo_group = wheel
+# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
+# local_groups_reconcile_interval after leaving the group.
+sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
 # Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
 home_attr = CN
 home_alias = SPN

images/fedora-intune/files/mdatp-health-snapshot

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
+# custom compliance script (intune/defender-compliance.sh).
+#
+# That script runs inside himmelblaud-tasks.service, and Defender refuses to
+# answer it there: the daemon checks the calling process tree, can't read
+# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
+# microsoft_defender_err.log), and the script sees no daemon. This runs from a
+# timer outside that service instead. Each file holds the raw
+# `mdatp health --field` output; the directory is replaced as a whole.
+set -euo pipefail
+
+MDATP=/usr/bin/mdatp
+DEST=/run/mdatp-health
+FIELDS=(
+  healthy
+  licensed
+  org_id
+  real_time_protection_enabled
+  behavior_monitoring
+  cloud_enabled
+  definitions_status
+  definitions_updated_minutes_ago
+  app_version
+)
+
+tmp="$(mktemp -d "${DEST}.XXXXXX")"
+trap 'rm -rf "${tmp}"' EXIT
+for field in "${FIELDS[@]}"; do
+  "${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
+done
+chmod 0755 "${tmp}"
+chmod 0644 "${tmp}"/*
+
+# Swap in the new snapshot; readers see either the old or the new one.
+rm -rf "${DEST}.old"
+[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
+mv "${tmp}" "${DEST}"
+rm -rf "${DEST}.old"
+trap - EXIT

images/fedora-intune/files/mdatp-health-snapshot.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Save Microsoft Defender health for the Intune compliance check
+After=mdatp.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/mdatp-health-snapshot

images/fedora-intune/files/mdatp-health-snapshot.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Save Microsoft Defender health every 5 minutes
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=timers.target

images/fedora-intune/files/mdatp-managed-config.conf

@@ -0,0 +1,7 @@
+# Install the image's enforced Defender settings each time Defender starts.
+# The image can't ship them in /etc directly: mdatp-firstboot creates
+# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts
+# as local and ostree's /etc merge never adds new files under it. Copying on
+# every start also picks up changes from newer images and undoes local edits.
+[Service]
+ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json

images/fedora-intune/intune/defender-compliance.sh

@@ -10,11 +10,21 @@
 # instead of as a script error.
 
 MDATP=/usr/bin/mdatp
+# Under Himmelblau, Defender won't answer `mdatp health` from this script, so
+# a root timer may save the fields in /run/mdatp-health (the fedora-intune
+# image does). Used when under 20 minutes old, otherwise mdatp is asked.
+SNAPSHOT=/run/mdatp-health
+
+if [[ -n "$(find "${SNAPSHOT}/healthy" -mmin -20 2>/dev/null)" ]]; then
+  raw_field() { cat "${SNAPSHOT}/$1" 2>/dev/null; }
+else
+  raw_field() { "${MDATP}" health --field "$1" 2>/dev/null; }
+fi
 
 # Print one `mdatp health` field without quotes or a trailing " [managed]".
 # Unlicensed or unonboarded, mdatp prints "ATTENTION: ..." lines first.
 field() {
-  "${MDATP}" health --field "$1" 2>/dev/null | grep -v '^ATTENTION' | tail -n1 \
+  raw_field "$1" | grep -v '^ATTENTION' | tail -n1 \
     | sed -e 's/ \[managed\]$//' -e 's/^"//' -e 's/"$//'
 }