# Microsoft Intune app for Linux (intune-portal), the Microsoft identity broker
# and Microsoft Edge (needed for Conditional Access to Microsoft 365 web apps).
#
# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
# because they link against the same library generation as Fedora 44. The
# repos are limited to these packages with includepkgs (repos/microsoft.repo),
# so nothing else from the RHEL repo can replace a Fedora package.

repos:
  - microsoft-rhel10
  - microsoft-edge

repo-packages:
  - repo: microsoft-rhel10
    packages:
      - intune-portal
      - microsoft-identity-broker
  - repo: microsoft-edge
    packages:
      - microsoft-edge-stable

packages:
  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
  # and the sssd base its authselect profile is derived from.
  - authselect
  - checkpolicy
  - policycoreutils
  - sssd-client
  # Secret storage for the identity broker tokens.
  - gnome-keyring
  - libsecret

add-files:
  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]

postprocess:
  # The intune-portal %post builds an authselect profile with pam_intune.so and
  # an SELinux module, but neither reliably survives a compose (no running
  # SELinux, authselect state under /etc). Redo both here so the image is
  # deterministic either way.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    profile=/etc/authselect/custom/intune-profile
    if [[ ! -d "${profile}" ]]; then
      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
    fi
    for f in system-auth password-auth; do
      grep -q pam_intune.so "${profile}/${f}" && continue
      sed -i \
        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
        "${profile}/${f}"
      sed -i \
        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
        "${profile}/${f}"
    done
    authselect select custom/intune-profile --force --nobackup

  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    cd /usr/share/selinux/packages/intune
    tmp="$(mktemp -d)"
    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
    semodule -n -i "${tmp}/intune.pp"
    rm -rf "${tmp}"

  # intune-agent (user timer) reports compliance; enable it for every user.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    systemctl --user --global preset-all