Wesley van TilburgandClaude Opus 5.5
111d3bea66
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 9s
Build containers / Prune old releases and tags (pull_request) Skipped
Himmelblau runs the custom compliance script inside himmelblaud-tasks,
and Defender refuses to answer `mdatp health` there: the daemon can't
read /proc/<himmelblaud_tasks>/cmdline while checking the caller
("Permission denied" in microsoft_defender_err.log). The script saw no
daemon, and every Defender rule failed although Defender was healthy.
Add mdatp-health-snapshot.timer, which saves the health fields to
/run/mdatp-health every 5 minutes as root, outside that service. The
compliance script reads the snapshot when it's under 20 minutes old and
otherwise asks mdatp directly, so it still works on other distros.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
66 lines
3.3 KiB
YAML
66 lines
3.3 KiB
YAML
# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
|
|
# microsoft-fedora44 repo (repos/microsoft.repo).
|
|
#
|
|
# mdatp's %post does the real install: units, SELinux module, and per-machine
|
|
# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
|
|
# logs). In a compose /var is read-only, and that state must not be shared
|
|
# between machines anyway, so the %post is saved into the image and run once on
|
|
# first boot by mdatp-firstboot.service. mdatp.service waits for it.
|
|
#
|
|
# Onboarding is per tenant and not part of the image: run the onboarding script
|
|
# from the Defender portal on the device.
|
|
|
|
repo-packages:
|
|
- repo: microsoft-fedora44
|
|
packages:
|
|
- mdatp
|
|
|
|
packages:
|
|
# The %post is a bash script; Defender's inventory scripts and the
|
|
# onboarding script are Python.
|
|
- bash
|
|
- python3
|
|
|
|
add-files:
|
|
- ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
|
|
- ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
|
|
- ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
|
|
- ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
|
|
# Defender health for the Intune compliance script, which can't query
|
|
# Defender itself from inside himmelblaud-tasks; see the script.
|
|
- ["mdatp-health-snapshot", "/usr/libexec/mdatp-health-snapshot"]
|
|
- ["mdatp-health-snapshot.service", "/usr/lib/systemd/system/mdatp-health-snapshot.service"]
|
|
- ["mdatp-health-snapshot.timer", "/usr/lib/systemd/system/mdatp-health-snapshot.timer"]
|
|
# Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
|
|
# changes are refused): real-time protection, behavior monitoring, PUA
|
|
# blocking, cloud protection at the "high" block level, automatic updates
|
|
# and sample submission, a daily quick scan at 12:00 and a weekly full scan
|
|
# on Wednesday 12:30 (low priority, up to 2 h later at random). Settings
|
|
# reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
|
|
# Not set here: network protection (Insiders channels only) and tamper
|
|
# protection (audit-only preview on Linux).
|
|
- ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
|
|
# Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
|
|
# see the drop-in.
|
|
- ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
|
|
|
|
postprocess:
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
# The %post wrote the units during the compose; fail the build if a newer
|
|
# mdatp stops doing that, rather than shipping a Defender that never starts.
|
|
for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
|
|
test -f "/usr/lib/systemd/system/${unit}"
|
|
done
|
|
# rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
|
|
for root in /usr/lib/opt /opt; do
|
|
pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
|
|
[[ -f "${pp}" ]] && break
|
|
done
|
|
semodule -n -i "${pp}"
|
|
# Fail the build on a typo rather than ship a config Defender can't read.
|
|
python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
|
|
rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
|
|
chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst /usr/libexec/mdatp-health-snapshot
|