# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
#
# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
# because they link against the same library generation as Fedora 44.

repo-packages:
  - repo: microsoft-rhel10
    packages:
      - intune-portal
      - microsoft-identity-broker

packages:
  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
  # and the sssd base its authselect profile is derived from.
  - authselect
  - checkpolicy
  - policycoreutils
  - sssd-client
  - nss-altfiles
  # Secret storage for the identity broker tokens.
  - gnome-keyring
  - libsecret

add-files:
  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]

postprocess:
  # The intune-portal %post builds an authselect profile with pam_intune.so and
  # an SELinux module, but neither reliably survives a compose (no running
  # SELinux, authselect state under /etc). Redo both here so the image is
  # deterministic either way.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    profile=/etc/authselect/custom/intune-profile
    if [[ ! -d "${profile}" ]]; then
      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
    fi
    for f in system-auth password-auth; do
      grep -q pam_intune.so "${profile}/${f}" && continue
      sed -i \
        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
        "${profile}/${f}"
      sed -i \
        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
        "${profile}/${f}"
    done
    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
    authselect select custom/intune-profile with-altfiles --force --nobackup
    getent passwd gdm >/dev/null

  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    cd /usr/share/selinux/packages/intune
    tmp="$(mktemp -d)"
    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
    semodule -n -i "${tmp}/intune.pp"
    rm -rf "${tmp}"

  # intune-agent (user timer) reports compliance; enable it for every user.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    systemctl --user --global preset-all