workaround(azurelinux-release): bind-mount /proc/version for CBL-Mariner compat

base/comps/azurelinux-release/90-default.preset

@@ -28,6 +28,10 @@ enable auditd.service
 
 enable audit-rules.service
 
+# Backward-compat: override /proc/version so tools that grep for "Mariner"
+# can identify Azure Linux
+enable proc-version-override.service
+
 # Locally-running service
 enable restorecond.service
 
@@ -371,4 +375,3 @@ enable gpio-manager.service
 
 # Enable authselect-apply-changes.service
 enable authselect-apply-changes.service
-

base/comps/azurelinux-release/azurelinux-release.spec

@@ -36,7 +36,7 @@ Summary:        Azure Linux release files
 Name:           azurelinux-release
 Version:        4.0
 # TODO(azl): Review whether we can move back to autorelease (with conditional -p)
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        MIT
 URL:            https://aka.ms/azurelinux
 
@@ -49,6 +49,8 @@ Source14:       distro-template.swidtag
 Source15:       distro-variant-template.swidtag
 Source16:       20-azurelinux-defaults.conf
 Source17:       20-azure.conf
+Source18:       proc-version-override.service
+Source19:       proc-version-override.sh
 
 BuildArch:      noarch
 
@@ -391,6 +393,10 @@ ln -s --relative %{buildroot}%{_swidtagdir} %{buildroot}%{_sysconfdir}/swid/swid
 # Install DNF 5 configuration defaults
 install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/
 
+# Install proc-version-override (backward-compat for tools that grep /proc/version for "Mariner")
+install -Dm0644 %{SOURCE18} -t %{buildroot}%{_unitdir}/
+install -Dm0755 %{SOURCE19} %{buildroot}%{_libexecdir}/proc-version-override
+
 
 %files common
 %license licenses/LICENSE
@@ -419,6 +425,8 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/
 %dir %{_sysconfdir}/swid
 %{_sysconfdir}/swid/swidtags.d
 %{_prefix}/share/dnf5/libdnf.conf.d/20-azurelinux-defaults.conf
+%{_unitdir}/proc-version-override.service
+%{_libexecdir}/proc-version-override
 
 
 %if %{with basic}
@@ -455,5 +463,8 @@ install -Dm0644 %{SOURCE16} -t %{buildroot}%{_prefix}/share/dnf5/libdnf.conf.d/
 
 
 %changelog
+* Tue Apr 01 2026 Rachel Menge <rachelmenge@microsoft.com> - 4.0-3
+- Add proc-version-override service for Guest-Configuration-Extension compat
+
 * Fri Feb 27 2026 Reuben Olinsky <reubeno@microsoft.com> - 4.0-2
 - Initial version

base/comps/azurelinux-release/proc-version-override.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Override /proc/version for legacy OS detection (CBL-Mariner compat)
+Before=waagent.service cloud-init.service cloud-init-local.service
+After=local-fs.target
+ConditionVirtualization=vm
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/proc-version-override
+ExecStop=-/bin/umount /proc/version
+ExecStopPost=-/bin/rm -f /run/proc_version_override
+
+[Install]
+WantedBy=multi-user.target

base/comps/azurelinux-release/proc-version-override.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Generate a /proc/version override that includes both "CBL-Mariner" and
+# "azurelinux" identifiers, then bind-mount it over /proc/version.
+#
+# This preserves backward compatibility with tools that grep /proc/version
+# for "Mariner" (e.g. Guest-Configuration-Extension) while also advertising
+# the current distro name.
+
+set -euo pipefail
+
+OVERRIDE=/run/proc_version_override
+
+# `mount --bind` on a file target is not idempotent; repeated runs can stack
+# mounts on /proc/version. Unwind any existing mount layers before reading
+# the real /proc/version and rebinding.
+while findmnt -n /proc/version >/dev/null 2>&1; do
+    umount /proc/version
+done
+
+# Build a version string using the real kernel version, replacing only
+# the (user@host) field with (root@CBL-Mariner-azurelinux).
+#
+# Real /proc/version format:
+#   Linux version <uname -r> (mockbuild@koji-builder-...) (gcc (GCC) ...) #1 SMP ...
+# Override:
+#   Linux version <uname -r> (root@CBL-Mariner-azurelinux) (gcc (GCC) ...) #1 SMP ...
+#
+# We strip the first parenthesized group (user@host) and keep everything
+# after it (compiler info, build config, timestamp) verbatim.
+# Also replace "Red Hat" in the GCC version string so tools that pattern-match
+# /proc/version (e.g. GCE's guest-configuration-shim) don't misidentify AZL as
+# RHEL based on the compiler tag.
+KVER=$(uname -r)
+TAIL=$(sed 's/^[^)]*)[[:space:]]*//' /proc/version | sed 's/Red Hat/Azure Linux/g')
+
+install -m 0444 /dev/null "$OVERRIDE"
+cat > "$OVERRIDE" <<EOF
+Linux version ${KVER} (root@CBL-Mariner-azurelinux) ${TAIL}
+EOF
+chmod 0444 "$OVERRIDE"
+
+mount --bind "$OVERRIDE" /proc/version
+mount -o remount,bind,ro /proc/version