# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build.
#
# mdatp's %post does the real install: it writes mdatp.service and the
# mde_netfilter_v2 units, loads its SELinux module and creates a machine GUID
# and state under /var/opt/microsoft/mdatp. In a compose the daemon cannot
# start and /var is not shipped, so the units and SELinux module are handled
# here and the per-machine state is left to the first start on the device.
#
# Onboarding is per tenant and not part of the image: run the onboarding script
# from the Defender portal on the device (see the Intune test doc).

repo-packages:
  - repo: microsoft-rhel10
    packages:
      - mdatp

packages:
  # Used by the Defender TVM/inventory scripts and the onboarding script.
  - python3

add-files:
  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]

postprocess:
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    conf=/opt/microsoft/mdatp/conf
    # Units the %post copies into place; install them if it did not get there.
    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
      if [[ ! -f "/usr/lib/systemd/system/${unit}" ]]; then
        install -m 0644 "${conf}/${unit}" "/usr/lib/systemd/system/${unit}"
      fi
    done
    semodule -n -i "${conf}/selinux_policies/out/mdatp_service.pp"
    # Never ship a machine GUID or onboarding state baked in at build time.
    ls -laR /etc/opt/microsoft /var/opt/microsoft 2>/dev/null || true
    rm -rf /var/opt/microsoft/mdatp
    rm -f /etc/opt/microsoft/mdatp/mdatp_onboard.json