fedora-intune: minimal GNOME workstation with Intune and Defender #1

Merged

Misthios merged 6 commits from misthios/fedora-intune AGit into main 2026-10-19 11:58:29 +00:00

Conversation 0 Commits 6 Files Changed 23

+403 -8

Misthios commented 2026-10-19 09:49:44 +00:00

Owner

Copy link

Copy source

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com

New image for testing Microsoft Intune enrollment and Linux compliance policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis, Files) with the Intune app, the Microsoft identity broker, Edge and Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10 builds, limited to those packages with includepkgs). No Kanidm: the Intune app installs its own authselect profile with pam_intune for the password compliance checks. Its %post cannot select the profile or load the SELinux module during a compose, so both are redone in postprocess. build.sh now copies every *.yaml of an image, so manifests can be split into more files than manifest.yaml and custom.yaml. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios added 1 commit 2026-10-19 09:49:54 +00:00

fedora-intune: minimal GNOME workstation with Intune and Defender ... 809bdc3bcb

New image for testing Microsoft Intune enrollment and Linux compliance
policies: a minimal GNOME workstation (gnome-initial-setup, Ptyxis,
Files) with the Intune app, the Microsoft identity broker, Edge and
Defender for Endpoint (mdatp) from packages.microsoft.com (RHEL 10
builds, limited to those packages with includepkgs).

No Kanidm: the Intune app installs its own authselect profile with
pam_intune for the password compliance checks. Its %post cannot select
the profile or load the SELinux module during a compose, so both are
redone in postprocess.

build.sh now copies every *.yaml of an image, so manifests can be split
into more files than manifest.yaml and custom.yaml.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios force-pushed misthios/fedora-intune from fadf549b5d to 809bdc3bcb 2026-10-19 09:49:54 +00:00 Compare

Misthios added 1 commit 2026-10-19 09:51:48 +00:00

ci: skip registry login for pull requests ... 591ccd342e

PR builds never push, and Gitea gives them no secrets, so the login with
an empty token failed every PR build before it started.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios added 1 commit 2026-10-19 09:55:13 +00:00

fedora-intune: drop no-op preset for the D-Bus activated device broker ... 6f27bfb4dc

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios added 1 commit 2026-10-19 11:06:44 +00:00

fedora-intune: fix boot issues, add Himmelblau variant ... 4f71d350fa

Fixes found by building and inspecting the image:

- Select the Intune authselect profile with-altfiles. Without it system
  users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the
  login screen never starts. The build now fails if gdm does not resolve.
- Ship /opt as a plain directory (opt-usrlocal: root). Defender installs
  to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp;
  with the default /opt -> /var/opt symlink those were the same
  read-only directory. rpm-ostree still relocates /opt content to
  /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images
  where /opt is a directory; fedora-cosmic/remote are unaffected).
- Run Defender's %post on first boot (mdatp-firstboot.service): in a
  compose /var is read-only and the machine GUID/state must not be
  shared. mdatp.service waits for it.

New image fedora-intune-himmelblau: the same workstation with Entra ID
sign-in through Himmelblau (Community Nightly packages), which joins the
device at the first sign-in and enrolls it in Intune (apply_policy)
instead of the Microsoft Intune app. Workstation, Edge and Defender
manifests move to images/shared so both images use them; build.sh copies
images/shared/*.yaml and CI builds both images in one matrix job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios added 1 commit 2026-10-19 11:07:48 +00:00

fedora-intune: use Himmelblau instead of the Microsoft Intune app ... 8e6fedc05e

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios added 1 commit 2026-10-19 11:19:39 +00:00

fedora-intune: Entra SSO in Microsoft Edge ... ad58569968

himmelblau-sso registers its native messaging host and force-installs
the Linux Entra SSO extension only for Chrome, Chromium and Firefox.
Edge reads /etc/opt/edge, so ship the same two files there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Misthios merged commit 350b381200 into main 2026-10-19 11:58:29 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Misthios (Wesley)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Misthios/bootc-images#1