# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
# microsoft-fedora44 repo (repos/microsoft.repo).
#
# mdatp's %post does the real install: units, SELinux module, and per-machine
# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
# logs). In a compose /var is read-only, and that state must not be shared
# between machines anyway, so the %post is saved into the image and run once on
# first boot by mdatp-firstboot.service. mdatp.service waits for it.
#
# Onboarding is per tenant and not part of the image: run the onboarding script
# from the Defender portal on the device.

repo-packages:
  - repo: microsoft-fedora44
    packages:
      - mdatp

packages:
  # The %post is a bash script; Defender's inventory scripts and the
  # onboarding script are Python.
  - bash
  - python3

add-files:
  - ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
  - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
  - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
  # Defender health for the Intune compliance script, which can't query
  # Defender itself from inside himmelblaud-tasks; see the script.
  - ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
  - ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
  - ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
  # Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
  # changes are refused): real-time protection, behavior monitoring, PUA
  # blocking, cloud protection at the "high" block level, automatic updates
  # and sample submission, a daily quick scan at 12:00 and a weekly full scan
  # on Wednesday 12:30 (low priority, up to 2 h later at random). Settings
  # reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
  # Not set here: network protection (Insiders channels only) and tamper
  # protection (audit-only preview on Linux).
  - ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
  # Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
  # see the drop-in.
  - ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]

postprocess:
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    # The %post wrote the units during the compose; fail the build if a newer
    # mdatp stops doing that, rather than shipping a Defender that never starts.
    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
      test -f "/usr/lib/systemd/system/${unit}"
    done
    # rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
    for root in /usr/lib/opt /opt; do
      pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
      [[ -f "${pp}" ]] && break
    done
    semodule -n -i "${pp}"
    # Fail the build on a typo rather than ship a config Defender can't read.
    python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
    rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot