From 2883285b69af6a82d7aa79528c8ec11069e31ea9 Mon Sep 17 00:00:00 2001 From: Roshani Rathi Date: Tue, 25 Aug 2026 10:10:25 +0530 Subject: [PATCH 1/2] PCOM-1044 Skip US Govt banner and use default ubuntu banner on login --- ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips | 13 ++++++++++--- ubuntu-fips/22.04/README.md | 4 ++-- ubuntu-fips/22.04/build.sh | 2 +- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips index 5d4c06be..cb50a9dd 100644 --- a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips +++ b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips @@ -3,7 +3,6 @@ FROM quay.io/kairos/kairos-init:v0.8.12 AS kairos-init FROM ubuntu:22.04 ARG VERSION=v4.0.4 ARG ENABLE_STIG=1 -ARG SKIP_STIG_BANNER=0 ENV DEBIAN_FRONTEND=noninteractive # NOTE: --fips is NOT passed here. Unlike RHEL (where subscription-manager enables FIPS repos @@ -41,8 +40,7 @@ COPY stig-remediate.sh /tmp/stig-remediate.sh COPY restore-ubuntu-default-banners.sh /tmp/restore-ubuntu-default-banners.sh RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /tmp/restore-ubuntu-default-banners.sh \ && if [ "$ENABLE_STIG" = "1" ]; then /tmp/stig-remediate.sh; fi \ - && rm -f /tmp/stig-remediate.sh \ - && if [ "$ENABLE_STIG" = "1" ] && [ "$SKIP_STIG_BANNER" = "1" ]; then bash /tmp/restore-ubuntu-default-banners.sh; fi + && rm -f /tmp/stig-remediate.sh # --fips is passed here (not at install stage) because Ubuntu PRO has been attached and all # FIPS packages (linux-image-fips, strongswan-hmac, etc.) are already installed above. @@ -51,6 +49,15 @@ RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /tmp/restore-ubuntu-default-bann RUN --mount=type=bind,from=kairos-init,src=/kairos-init,dst=/kairos-init \ /kairos-init -l debug -s init --fips --version "${VERSION}" +# Restore stock Ubuntu banners after kairos-init so OEM/init merges cannot reintroduce +# the USG/DoD text from STIG remediation (or from fix.sh's final issue → issue.net sync). +# Default 1: keep STIG remediations but drop the USG banner. Pass SKIP_STIG_BANNER=0 to retain it. +ARG ENABLE_STIG +ARG SKIP_STIG_BANNER=1 +RUN if [ "$ENABLE_STIG" = "1" ] && [ "$SKIP_STIG_BANNER" = "1" ]; then \ + bash /tmp/restore-ubuntu-default-banners.sh; \ + fi + # Symlink kernel HMAC RUN kernel=$(ls /boot/vmlinuz-* | head -n1) && ln -sf ."${kernel#/boot/}".hmac /boot/.vmlinuz.hmac diff --git a/ubuntu-fips/22.04/README.md b/ubuntu-fips/22.04/README.md index 6e684ded..5899e92b 100644 --- a/ubuntu-fips/22.04/README.md +++ b/ubuntu-fips/22.04/README.md @@ -9,9 +9,9 @@ | Variable | Default | Meaning | | -------- | ------- | ------- | | `ENABLE_STIG` | `1` | When `1`, run DISA STIG remediation (`fix.sh`). Set to `0` for FIPS-only builds without STIG. | -| `SKIP_STIG_BANNER` | `0` | When `1` (with STIG enabled), restore stock Ubuntu login banners instead of the USG DoD banner (`/etc/issue`, SSH `Banner`, GDM, `/etc/profile.d/ssh_confirm.sh`). | +| `SKIP_STIG_BANNER` | `1` | When `1` (with STIG enabled), restore stock Ubuntu login banners instead of the USG DoD banner (`/etc/issue`, SSH `Banner`, GDM, `/etc/profile.d/ssh_confirm.sh`). Set to `0` to keep the STIG USG banner. | -Examples: `ENABLE_STIG=0 bash build.sh`, `SKIP_STIG_BANNER=1 bash build.sh my-tag`. +Examples: `ENABLE_STIG=0 bash build.sh`, `SKIP_STIG_BANNER=0 bash build.sh my-tag`. **Note:** `build.sh` uses the `ubuntu-fips` directory as the Docker build context so shared files (e.g. `restore-ubuntu-default-banners.sh`) resolve correctly. diff --git a/ubuntu-fips/22.04/build.sh b/ubuntu-fips/22.04/build.sh index 2eb59199..89b890e8 100755 --- a/ubuntu-fips/22.04/build.sh +++ b/ubuntu-fips/22.04/build.sh @@ -7,7 +7,7 @@ UBUNTU_FIPS_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)" BASE_IMAGE="${1:-ubuntu-jammy-fips}" VERSION=22.04 ENABLE_STIG="${ENABLE_STIG:-1}" -SKIP_STIG_BANNER="${SKIP_STIG_BANNER:-0}" +SKIP_STIG_BANNER="${SKIP_STIG_BANNER:-1}" DOCKER_BUILDKIT=1 docker build \ --secret id=pro-attach-config,src="${SCRIPT_DIR}/pro-attach-config.yaml" \ From a2231ca463e754a01dff305df0ce5bd977fdf489 Mon Sep 17 00:00:00 2001 From: Roshani Rathi Date: Tue, 25 Aug 2026 11:13:16 +0530 Subject: [PATCH 2/2] fix(ubuntu-fips/22.04): keep banner restore script outside /tmp kairos-init -s init clears /tmp, so the post-init SKIP_STIG_BANNER step could not find restore-ubuntu-default-banners.sh. Install it under /usr/local/sbin for the post-init RUN and remove it during cleanup. Co-authored-by: Cursor --- ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips index cb50a9dd..be758f5f 100644 --- a/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips +++ b/ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips @@ -37,8 +37,9 @@ RUN kernel=$(ls /lib/modules | head -n1) && mv /tmp/modules.fips /lib/modules/${ COPY 22.04/fix.sh /tmp/fix.sh COPY stig-remediate.sh /tmp/stig-remediate.sh -COPY restore-ubuntu-default-banners.sh /tmp/restore-ubuntu-default-banners.sh -RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /tmp/restore-ubuntu-default-banners.sh \ +# Install outside /tmp: kairos-init -s init clears /tmp, and this script must run after init. +COPY restore-ubuntu-default-banners.sh /usr/local/sbin/restore-ubuntu-default-banners.sh +RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /usr/local/sbin/restore-ubuntu-default-banners.sh \ && if [ "$ENABLE_STIG" = "1" ]; then /tmp/stig-remediate.sh; fi \ && rm -f /tmp/stig-remediate.sh @@ -55,7 +56,7 @@ RUN --mount=type=bind,from=kairos-init,src=/kairos-init,dst=/kairos-init \ ARG ENABLE_STIG ARG SKIP_STIG_BANNER=1 RUN if [ "$ENABLE_STIG" = "1" ] && [ "$SKIP_STIG_BANNER" = "1" ]; then \ - bash /tmp/restore-ubuntu-default-banners.sh; \ + bash /usr/local/sbin/restore-ubuntu-default-banners.sh; \ fi # Symlink kernel HMAC @@ -63,6 +64,7 @@ RUN kernel=$(ls /boot/vmlinuz-* | head -n1) && ln -sf ."${kernel#/boot/}".hmac / # Clear cache RUN find /var/cache -mindepth 1 -maxdepth 1 ! -name 'cracklib' -exec rm -rf {} + && \ + rm -f /usr/local/sbin/restore-ubuntu-default-banners.sh && \ rm -rf /tmp/* /var/tmp/* && \ journalctl --vacuum-size=1K || true && \ rm -f /etc/machine-id /var/lib/dbus/machine-id /etc/hostname || true