Misthios/bootc-images
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

fedora-intune: query Defender through systemd-run instead of a snapshot #8

Merged
Misthios merged 1 commits from misthios/defender-query-via-systemd-run into main 2026-10-20 14:16:28 +00:00
Conversation 0 Commits 1 Files Changed 6
+16 -92
Misthios commented 2026-10-20 14:16:23 +00:00
Owner
Copy link
Copy source

The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs mdatp health through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

The health snapshot's temp directory, chmod and mv in /run every 5 minutes showed up in Defender's timeline as "Data Staged" and "Executable permissions were added". Drop the snapshot service and timer. The compliance script now runs `mdatp health` through systemd-run, so systemd starts mdatp and Defender answers it even when the script runs inside himmelblaud-tasks. Without systemd-run access it asks mdatp directly, as before. No image support needed, so the script works on other distros as is.
Misthios added 1 commit 2026-10-20 14:16:23 +00:00
fedora-intune: query Defender through systemd-run instead of a snapshot
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Details
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Details
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Details
Build containers / Compute changes (pull_request) Canceled after 14s
Details
Build containers / Prune old releases and tags (pull_request) Skipped
Details
ca115922bd 
The health snapshot's temp directory, chmod and mv in /run every 5
minutes showed up in Defender's timeline as "Data Staged" and
"Executable permissions were added". Drop the snapshot service and
timer. The compliance script now runs `mdatp health` through
systemd-run, so systemd starts mdatp and Defender answers it even when
the script runs inside himmelblaud-tasks. Without systemd-run access it
asks mdatp directly, as before. No image support needed, so the script
works on other distros as is.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Misthios merged commit 99400fb03e into main 2026-10-20 14:16:28 +00:00
Misthios deleted branch misthios/defender-query-via-systemd-run 2026-10-20 14:16:28 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Misthios (Wesley)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Misthios/bootc-images#8