Wesley van TilburgandClaude Opus 5.5
49b360dffa
Build containers / fedora-cosmic (44) (pull_request) Canceled after 0s
Build containers / fedora-cosmic (rawhide) (pull_request) Canceled after 0s
Build containers / fedora-remote (44) (pull_request) Canceled after 0s
Build containers / fedora-intune (44) (pull_request) Canceled after 0s
Build containers / Compute changes (pull_request) Canceled after 12s
Build containers / Prune old releases and tags (pull_request) Skipped
The first snapshot came 2 minutes after boot, so the compliance check at the first sign-in found none, fell back to mdatp (which won't answer it) and reported Defender as not running. Himmelblau then doesn't check again for 8 hours. Start the timer 20 seconds after boot, and wait up to 2 minutes for the daemon to answer so that snapshot isn't a false "not running". The timer runs it in the background, so boot isn't held up. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
48 lines
1.5 KiB
Bash
48 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Save `mdatp health` fields to /run/mdatp-health/<field> for the Intune
|
|
# custom compliance script (intune/defender-compliance.sh).
|
|
#
|
|
# That script runs inside himmelblaud-tasks.service, and Defender refuses to
|
|
# answer it there: the daemon checks the calling process tree, can't read
|
|
# /proc/<himmelblaud_tasks pid>/cmdline ("Permission denied" in
|
|
# microsoft_defender_err.log), and the script sees no daemon. This runs from a
|
|
# timer outside that service instead. Each file holds the raw
|
|
# `mdatp health --field` output; the directory is replaced as a whole.
|
|
set -euo pipefail
|
|
|
|
MDATP=/usr/bin/mdatp
|
|
DEST=/run/mdatp-health
|
|
FIELDS=(
|
|
healthy
|
|
licensed
|
|
org_id
|
|
real_time_protection_enabled
|
|
behavior_monitoring
|
|
cloud_enabled
|
|
definitions_status
|
|
definitions_updated_minutes_ago
|
|
app_version
|
|
)
|
|
|
|
# Right after boot the daemon may not answer yet; give it up to 2 minutes so
|
|
# the first snapshot isn't a false "not running".
|
|
for _ in $(seq 1 24); do
|
|
[[ "$("${MDATP}" health --field healthy 2>/dev/null | tail -n1)" =~ ^(true|false)$ ]] && break
|
|
sleep 5
|
|
done
|
|
|
|
tmp="$(mktemp -d "${DEST}.XXXXXX")"
|
|
trap 'rm -rf "${tmp}"' EXIT
|
|
for field in "${FIELDS[@]}"; do
|
|
"${MDATP}" health --field "${field}" > "${tmp}/${field}" 2>/dev/null || true
|
|
done
|
|
chmod 0755 "${tmp}"
|
|
chmod 0644 "${tmp}"/*
|
|
|
|
# Swap in the new snapshot; readers see either the old or the new one.
|
|
rm -rf "${DEST}.old"
|
|
[[ -d "${DEST}" ]] && mv "${DEST}" "${DEST}.old"
|
|
mv "${tmp}" "${DEST}"
|
|
rm -rf "${DEST}.old"
|
|
trap - EXIT
|