From 5504f4e7aacb8e5f2b9229a96cfee5b970e57f0a Mon Sep 17 00:00:00 2001 From: Wesley van Tilburg Date: Tue, 20 Oct 2026 12:44:12 +0000 Subject: [PATCH 1/2] fedora-intune: install the Defender managed config when Defender starts The managed config shipped in /etc never reached updated devices: mdatp-firstboot creates /etc/opt/microsoft/mdatp on the device, so ostree's /etc merge treats that directory as local and doesn't add new image files under it. VM 123 had the file in /usr/etc but not in /etc, and Defender kept its defaults. Ship it in /usr/share/mdatp-managed/ and install it into /etc/opt/microsoft/mdatp/managed/ from an ExecStartPre in mdatp.service. This also applies changes from newer images and undoes local edits. Co-Authored-By: Claude Opus 5.5 (1M context) --- images/fedora-intune/defender.yaml | 7 +++++-- images/fedora-intune/files/mdatp-managed-config.conf | 7 +++++++ 2 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 images/fedora-intune/files/mdatp-managed-config.conf diff --git a/images/fedora-intune/defender.yaml b/images/fedora-intune/defender.yaml index 9c7d37b..73561d3 100644 --- a/images/fedora-intune/defender.yaml +++ b/images/fedora-intune/defender.yaml @@ -34,7 +34,10 @@ add-files: # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences # Not set here: network protection (Insiders channels only) and tamper # protection (audit-only preview on Linux). - - ["mdatp_managed.json", "/etc/opt/microsoft/mdatp/managed/mdatp_managed.json"] + - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"] + # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts; + # see the drop-in. + - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"] postprocess: - | @@ -52,6 +55,6 @@ postprocess: done semodule -n -i "${pp}" # Fail the build on a typo rather than ship a config Defender can't read. - python3 -m json.tool /etc/opt/microsoft/mdatp/managed/mdatp_managed.json > /dev/null + python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst diff --git a/images/fedora-intune/files/mdatp-managed-config.conf b/images/fedora-intune/files/mdatp-managed-config.conf new file mode 100644 index 0000000..48364b7 --- /dev/null +++ b/images/fedora-intune/files/mdatp-managed-config.conf @@ -0,0 +1,7 @@ +# Install the image's enforced Defender settings each time Defender starts. +# The image can't ship them in /etc directly: mdatp-firstboot creates +# /etc/opt/microsoft/mdatp on the device, so on updates that directory counts +# as local and ostree's /etc merge never adds new files under it. Copying on +# every start also picks up changes from newer images and undoes local edits. +[Service] +ExecStartPre=+/usr/bin/install -D -Z -m 0644 /usr/share/mdatp-managed/mdatp_managed.json /etc/opt/microsoft/mdatp/managed/mdatp_managed.json -- 2.54.0 From e8cfa8d4cf30f07eebc18efc81c682c588ece4ac Mon Sep 17 00:00:00 2001 From: Wesley van Tilburg Date: Tue, 20 Oct 2026 12:45:36 +0000 Subject: [PATCH 2/2] fedora-intune: don't repeat the version in the reported OS version libhimmelblau reports "PRETTY_NAME VERSION_ID" as the OS version, and Fedora's PRETTY_NAME already contains the version, so Entra showed "Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0". In the os-release the Himmelblau daemons see, set PRETTY_NAME to NAME, giving "Fedora Linux 44.20261020.0". Nothing else in Himmelblau reads PRETTY_NAME. Co-Authored-By: Claude Opus 5.5 (1M context) --- images/fedora-intune/files/himmelblau-os-release | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/images/fedora-intune/files/himmelblau-os-release b/images/fedora-intune/files/himmelblau-os-release index 06d015b..ae13aaf 100644 --- a/images/fedora-intune/files/himmelblau-os-release +++ b/images/fedora-intune/files/himmelblau-os-release @@ -5,16 +5,23 @@ # "44". Himmelblau reports VERSION_ID as the device's OS version and has no # setting for it. The rest of the system keeps the stock VERSION_ID, which # toolbox, flatpak and dnf expect to be the plain release. +# +# PRETTY_NAME becomes just NAME: libhimmelblau reports "PRETTY_NAME VERSION_ID" +# as the OS version string, and Fedora's PRETTY_NAME already contains the +# version ("Fedora Linux 44.20261020.0 (Forty Four) 44.20261020.0"). Nothing +# else in Himmelblau reads PRETTY_NAME. set -euo pipefail SRC=/usr/lib/os-release DEST=/run/himmelblau-os-release version="$(. "${SRC}" && echo "${OSTREE_VERSION:-${IMAGE_VERSION:-}}")" +name="$(. "${SRC}" && echo "${NAME:-Linux}")" tmp="$(mktemp "${DEST}.XXXXXX")" if [[ -n "${version}" ]]; then - sed "s/^VERSION_ID=.*/VERSION_ID=${version}/" "${SRC}" > "${tmp}" + sed -e "s/^VERSION_ID=.*/VERSION_ID=${version}/" \ + -e "s/^PRETTY_NAME=.*/PRETTY_NAME=\"${name}\"/" "${SRC}" > "${tmp}" else # No image version (not an ostree/bootc deployment): pass it through as-is. cat "${SRC}" > "${tmp}" -- 2.54.0