Wesley van TilburgandClaude Opus 5.5
6afa1d21e6
Himmelblau installs Intune Linux custom configuration scripts as /etc/cron.d jobs, and the image had no cron, so a script policy failed to apply. Add cronie and enable crond. Add a custom configuration script that repairs Microsoft Defender on its schedule: finishes first-boot setup, restarts a stopped daemon, onboards with the tenant's mdatp_onboard.json (pasted into the script in Intune), and re-enables real-time protection and updates definitions when needed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
78 lines
2.8 KiB
YAML
78 lines
2.8 KiB
YAML
# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
|
|
# enrollment and compliance, and browser SSO.
|
|
|
|
repo-packages:
|
|
- repo: himmelblau
|
|
packages:
|
|
- himmelblau
|
|
- pam-himmelblau
|
|
- nss-himmelblau
|
|
- himmelblau-selinux
|
|
# Shows a QR code on the login screen for the MFA/device-code prompts.
|
|
- himmelblau-qr-greeter
|
|
# Entra SSO in Edge (native messaging host) via the Himmelblau broker.
|
|
- himmelblau-broker
|
|
- himmelblau-sso
|
|
|
|
packages:
|
|
- authselect
|
|
- nss-altfiles
|
|
# himmelblau-selinux compiles its policy module at install time.
|
|
- make
|
|
- selinux-policy-devel
|
|
# Intune custom configuration scripts are installed as /etc/cron.d jobs.
|
|
- cronie
|
|
|
|
add-files:
|
|
- ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
|
|
- ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
|
|
- ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
|
|
# Report the full image version (44.20261019.0) as the OS version in Intune.
|
|
- ["himmelblau-os-release", "/usr/libexec/himmelblau-os-release"]
|
|
- ["himmelblau-os-release.service", "/usr/lib/systemd/system/himmelblau-os-release.service"]
|
|
- ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud.service.d/10-os-release.conf"]
|
|
- ["10-himmelblau-os-release.conf", "/usr/lib/systemd/system/himmelblaud-tasks.service.d/10-os-release.conf"]
|
|
|
|
postprocess:
|
|
# The package's %post selects its authselect vendor profile but drops
|
|
# with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
|
|
# /usr/lib/passwd do not resolve and the login screen never starts.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
|
|
for user in gdm mdatp; do
|
|
getent passwd "${user}" >/dev/null
|
|
done
|
|
grep -q pam_himmelblau.so /etc/pam.d/system-auth
|
|
chmod 0755 /usr/libexec/himmelblau-os-release
|
|
test -d /etc/cron.d
|
|
|
|
# himmelblau-selinux builds and loads its module in %posttrans, which does
|
|
# nothing in a compose; do it here.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
tmp="$(mktemp -d)"
|
|
cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
|
|
make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
|
|
semodule -n -i "${tmp}/himmelblaud.pp"
|
|
rm -rf "${tmp}"
|
|
|
|
# Show the QR greeter on the GDM login screen, not only in user sessions.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
install -d /etc/dconf/db/gdm.d
|
|
cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
|
|
[org/gnome/shell]
|
|
enabled-extensions=['qr-greeter@himmelblau-idm.org']
|
|
CONF
|
|
dconf update
|
|
|
|
# Compliance check (user timer) and broker for every user.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
systemctl --user --global preset-all
|