MisthiosandClaude Opus 5.5
4f71d350fa
Build containers / Compute changes (pull_request) Successful in 2s
Build containers / fedora-remote (44) (pull_request) Successful in 11m9s
Build containers / fedora-cosmic (rawhide) (pull_request) Successful in 12m8s
Build containers / fedora-cosmic (44) (pull_request) Successful in 14m20s
Build containers / fedora-intune (44) (pull_request) Canceled after 10m35s
Build containers / fedora-intune-himmelblau (44) (pull_request) Canceled after 9m41s
Build containers / Prune old releases and tags (pull_request) Skipped
Fixes found by building and inspecting the image: - Select the Intune authselect profile with-altfiles. Without it system users in /usr/lib/passwd (gdm, pipewire, mdatp) do not resolve and the login screen never starts. The build now fails if gdm does not resolve. - Ship /opt as a plain directory (opt-usrlocal: root). Defender installs to /opt/microsoft/mdatp and keeps state in /var/opt/microsoft/mdatp; with the default /opt -> /var/opt symlink those were the same read-only directory. rpm-ostree still relocates /opt content to /usr/lib/opt, so finalize.d/60-opt-links links it back (only for images where /opt is a directory; fedora-cosmic/remote are unaffected). - Run Defender's %post on first boot (mdatp-firstboot.service): in a compose /var is read-only and the machine GUID/state must not be shared. mdatp.service waits for it. New image fedora-intune-himmelblau: the same workstation with Entra ID sign-in through Himmelblau (Community Nightly packages), which joins the device at the first sign-in and enrolls it in Intune (apply_policy) instead of the Microsoft Intune app. Workstation, Edge and Defender manifests move to images/shared so both images use them; build.sh copies images/shared/*.yaml and CI builds both images in one matrix job. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
|
|
# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
|
|
#
|
|
# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
|
|
# because they link against the same library generation as Fedora 44.
|
|
|
|
repo-packages:
|
|
- repo: microsoft-rhel10
|
|
packages:
|
|
- intune-portal
|
|
- microsoft-identity-broker
|
|
|
|
packages:
|
|
# intune-portal scriptlet dependencies (authselect profile + SELinux module)
|
|
# and the sssd base its authselect profile is derived from.
|
|
- authselect
|
|
- checkpolicy
|
|
- policycoreutils
|
|
- sssd-client
|
|
- nss-altfiles
|
|
# Secret storage for the identity broker tokens.
|
|
- gnome-keyring
|
|
- libsecret
|
|
|
|
add-files:
|
|
- ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]
|
|
|
|
postprocess:
|
|
# The intune-portal %post builds an authselect profile with pam_intune.so and
|
|
# an SELinux module, but neither reliably survives a compose (no running
|
|
# SELinux, authselect state under /etc). Redo both here so the image is
|
|
# deterministic either way.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
profile=/etc/authselect/custom/intune-profile
|
|
if [[ ! -d "${profile}" ]]; then
|
|
authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
|
|
fi
|
|
for f in system-auth password-auth; do
|
|
grep -q pam_intune.so "${profile}/${f}" && continue
|
|
sed -i \
|
|
-e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required \2/' \
|
|
-e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required \2/' \
|
|
"${profile}/${f}"
|
|
sed -i \
|
|
-e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth sufficient pam_intune.so' \
|
|
-e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password sufficient pam_intune.so' \
|
|
-e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session optional pam_intune.so' \
|
|
"${profile}/${f}"
|
|
done
|
|
# with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
|
|
# /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
|
|
authselect select custom/intune-profile with-altfiles --force --nobackup
|
|
getent passwd gdm >/dev/null
|
|
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
cd /usr/share/selinux/packages/intune
|
|
tmp="$(mktemp -d)"
|
|
checkmodule -M -m -o "${tmp}/intune.mod" intune.te
|
|
semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
|
|
semodule -n -i "${tmp}/intune.pp"
|
|
rm -rf "${tmp}"
|
|
|
|
# intune-agent (user timer) reports compliance; enable it for every user.
|
|
- |
|
|
#!/usr/bin/env bash
|
|
set -xeuo pipefail
|
|
systemctl --user --global preset-all
|