MDATP installation in Docker on Linux Image

by

Was anyone able to install MDATP on a Linux Docker image?

We tried CentOS, Debian, and Ubuntu and all have the same issue. I installed MDATP successful when the Linux box is a full host but not in Docker.

I am following these instructions: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually

I preceded the installation with:

apt-get -y install curl libplist-utils gpg apt-transport-https libseccomp2 libuuid1 libatomic1 libc6 python3 uuid-runtime dmidecode auditd libselinux1 systemd

This page says MDATP requires systemd: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux

I was able to get systemd and audit working with an image that supported it (centos/systemd) and these lines in the Dockerfile:

VOLUME [ "/sys/fs/cgroup" ]
CMD [ "/usr/sbin/init" ]

Now am I stuck loading libraries:

[root@7061463d26f5 src]# systemctl status mdatp
    ● mdatp.service - Microsoft Defender ATP
      Loaded: loaded (/usr/lib/systemd/system/mdatp.service; enabled; vendor preset: disabled)
      Active: deactivating (stop-sigterm) (Result: exit-code) since Sat 2021-03-13 00:54:54 PST; 4s ago
     Process: 1389 ExecStart=/opt/microsoft/mdatp/sbin/wdavdaemon (code=exited, status=111)
    Main PID: 1389 (code=exited, status=111)
      CGroup: /docker/7061463d26f5ea10a880ad4209ea11b1a7c05349cb5a9641a0ac12245c51b674/system.slice/mdatp.service
              └─1412 /opt/microsoft/mdatp/sbin/wdavdaemon edr 11 10 3
    Mar 13 00:54:54 7061463d26f5 systemd[1]: Started Microsoft Defender ATP.
    Mar 13 00:54:54 7061463d26f5 systemd[1]: mdatp.service: main process exited, code=exited, status=111/n/a
    [root@7061463d26f5 src]# /opt/microsoft/mdatp/sbin/wdavdaemon &
    [1] 1654
    [root@7061463d26f5 src]# /opt/microsoft/mdatp/sbin/crashpad_handler: error while loading shared libraries: libc++.so.1: cannot open shared object file: No such file or directory
    [root@7061463d26f5 src]# ll /opt/microsoft/mdatp/lib/libc++.so.1
    -rw-r--r-- 1 root root 879240 Mar  8 05:56 /opt/microsoft/mdatp/lib/libc++.so.1
[root@7061463d26f5 src]# grep LD /usr/lib/systemd/system/mdatp.service
Environment=LD_LIBRARY_PATH=/opt/microsoft/mdatp/lib/

As you can see, the “missing” library exists and is seemingly configured correctly. Perhaps the env variable is incorrect?

This person may have been using a Linux Docker image: https://dawnbringer.net/blog/1085/msatp_debian10

Our enterprise MS support said that Docker isn’t supported and closed the case.

Any ideas on how I can continue?

Answer

Attribution
Source : Link , Question Author : qc_234578909 , Answer Author : Community

Leave a Comment