Misthios/bootc-images
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

fedora-intune: give the Intune compliance check a Defender health snapshot #6

Merged
Misthios merged 1 commits from misthios/defender-health-snapshot into main 2026-10-20 13:25:03 +00:00
Conversation 0 Commits 1 Files Changed 6
+75 -2
Misthios commented 2026-10-20 13:24:59 +00:00
Owner
Copy link
Copy source

Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer mdatp health there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com

Himmelblau runs the custom compliance script inside himmelblaud-tasks, and Defender refuses to answer `mdatp health` there: the daemon can't read /proc/<himmelblaud_tasks>/cmdline while checking the caller ("Permission denied" in microsoft_defender_err.log). The script saw no daemon, and every Defender rule failed although Defender was healthy. Add mdatp-health-snapshot.timer, which saves the health fields to /run/mdatp-health every 5 minutes as root, outside that service. The compliance script reads the snapshot when it's under 20 minutes old and otherwise asks mdatp directly, so it still works on other distros. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Misthios added 1 commit 2026-10-20 13:24:59 +00:00
fedora-intune: give the Intune compliance check a Defender health snapshot
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Details
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Details
Build containers / Compute changes (pull_request) Canceled after 9s
Details
Build containers / Prune old releases and tags (pull_request) Skipped
Details
111d3bea66 
Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.

Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Misthios merged commit 811025773e into main 2026-10-20 13:25:03 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Misthios (Wesley)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Misthios/bootc-images#6