Wesley van TilburgandClaude Opus 5.5
ca115922bd
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 14s
Build containers / Prune old releases and tags (pull_request) Skipped
The health snapshot's temp directory, chmod and mv in /run every 5 minutes showed up in Defender's timeline as "Data Staged" and "Executable permissions were added". Drop the snapshot service and timer. The compliance script now runs `mdatp health` through systemd-run, so systemd starts mdatp and Defender answers it even when the script runs inside himmelblaud-tasks. Without systemd-run access it asks mdatp directly, as before. No image support needed, so the script works on other distros as is. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
61 lines
2.9 KiB
YAML
61 lines
2.9 KiB
YAML
# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
|
|
# microsoft-fedora44 repo (repos/microsoft.repo).
|
|
#
|
|
# mdatp's %post does the real install: units, SELinux module, and per-machine
|
|
# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
|
|
# logs). In a compose /var is read-only, and that state must not be shared
|
|
# between machines anyway, so the %post is saved into the image and run once on
|
|
# first boot by mdatp-firstboot.service. mdatp.service waits for it.
|
|
#
|
|
# Onboarding is per tenant and not part of the image: run the onboarding script
|
|
# from the Defender portal on the device.
|
|
|
|
repo-packages:
|
|
- repo: microsoft-fedora44
|
|
packages:
|
|
- mdatp
|
|
|
|
packages:
|
|
# The %post is a bash script; Defender's inventory scripts and the
|
|
# onboarding script are Python.
|
|
- bash
|
|
- python3
|
|
|
|
add-files:
|
|
- ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
|
|
- ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
|
|
- ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
|
|
- ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
|
|
# Enforced Defender settings (shown as "[managed]" in `mdatp health`; local
|
|
# changes are refused): real-time protection, behavior monitoring, PUA
|
|
# blocking, cloud protection at the "high" block level, automatic updates
|
|
# and sample submission, a daily quick scan at 12:00 and a weekly full scan
|
|
# on Wednesday 12:30 (low priority, up to 2 h later at random). Settings
|
|
# reference: https://learn.microsoft.com/defender-endpoint/linux-preferences
|
|
# Not set here: network protection (Insiders channels only) and tamper
|
|
# protection (audit-only preview on Linux).
|
|
- ["mdatp_managed.json", "/usr/share/mdatp-managed/mdatp_managed.json"]
|
|
# Installed into /etc/opt/microsoft/mdatp/managed/ whenever Defender starts;
|
|
# see the drop-in.
|
|
- ["mdatp-managed-config.conf", "/usr/lib/systemd/system/mdatp.service.d/20-managed-config.conf"]
|
|
|
|
postprocess:
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
# The %post wrote the units during the compose; fail the build if a newer
|
|
# mdatp stops doing that, rather than shipping a Defender that never starts.
|
|
for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
|
|
test -f "/usr/lib/systemd/system/${unit}"
|
|
done
|
|
# rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
|
|
for root in /usr/lib/opt /opt; do
|
|
pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
|
|
[[ -f "${pp}" ]] && break
|
|
done
|
|
semodule -n -i "${pp}"
|
|
# Fail the build on a typo rather than ship a config Defender can't read.
|
|
python3 -m json.tool /usr/share/mdatp-managed/mdatp_managed.json > /dev/null
|
|
rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
|
|
chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst
|