Wesley van TilburgandClaude Opus 5.5
111d3bea66
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 9s
Build containers / Prune old releases and tags (pull_request) Skipped
Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.
Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
41 lines
1.2 KiB
Bash
41 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
|
|
# custom compliance script (intune/defender-compliance.sh).
|
|
#
|
|
# That script runs inside himmelblaud-tasks.service, and Defender refuses to
|
|
# answer it there: the daemon checks the calling process tree, can't read
|
|
# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
|
|
# microsoft_defender_err.log), and the script sees no daemon. This runs from a
|
|
# timer outside that service instead. Each file holds the raw
|
|
# `mdatp health --field` output; the directory is replaced as a whole.
|
|
set -euo pipefail
|
|
|
|
MDATP=/usr/bin/mdatp
|
|
DEST=/run/mdatp-health
|
|
FIELDS=(
|
|
healthy
|
|
licensed
|
|
org_id
|
|
real_time_protection_enabled
|
|
behavior_monitoring
|
|
cloud_enabled
|
|
definitions_status
|
|
definitions_updated_minutes_ago
|
|
app_version
|
|
)
|
|
|
|
tmp="$(mktemp -d "${DEST}.XXXXXX")"
|
|
trap 'rm -rf "${tmp}"' EXIT
|
|
for field in "${FIELDS[@]}"; do
|
|
"${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
|
|
done
|
|
chmod 0755 "${tmp}"
|
|
chmod 0644 "${tmp}"/*
|
|
|
|
# Swap in the new snapshot; readers see either the old or the new one.
|
|
rm -rf "${DEST}.old"
|
|
[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
|
|
mv "${tmp}" "${DEST}"
|
|
rm -rf "${DEST}.old"
|
|
trap - EXIT
|