Skip to content

PCOM-1044 Skip US Govt banner and use default ubuntu banner on login #802

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
roshanirathi merged 2 commits into from
Aug 25, 2026
Merged

PCOM-1044 Skip US Govt banner and use default ubuntu banner on login #802

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2883285
PCOM-1044 Skip US Govt banner and use default ubuntu banner on login
roshanirathi Aug 25, 2026
a2231ca
fix(ubuntu-fips/22.04): keep banner restore script outside /tmp
roshanirathi Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions ubuntu-fips/22.04/Dockerfile.ubuntu22.04-fips
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@ FROM quay.io/kairos/kairos-init:v0.8.12 AS kairos-init
FROM ubuntu:22.04
ARG VERSION=v4.0.4
ARG ENABLE_STIG=1
ARG SKIP_STIG_BANNER=0
ENV DEBIAN_FRONTEND=noninteractive

# NOTE: --fips is NOT passed here. Unlike RHEL (where subscription-manager enables FIPS repos
Expand Down Expand Up @@ -38,11 +37,11 @@ RUN kernel=$(ls /lib/modules | head -n1) && mv /tmp/modules.fips /lib/modules/${

COPY 22.04/fix.sh /tmp/fix.sh
COPY stig-remediate.sh /tmp/stig-remediate.sh
COPY restore-ubuntu-default-banners.sh /tmp/restore-ubuntu-default-banners.sh
RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /tmp/restore-ubuntu-default-banners.sh \
# Install outside /tmp: kairos-init -s init clears /tmp, and this script must run after init.
COPY restore-ubuntu-default-banners.sh /usr/local/sbin/restore-ubuntu-default-banners.sh
RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /usr/local/sbin/restore-ubuntu-default-banners.sh \
&& if [ "$ENABLE_STIG" = "1" ]; then /tmp/stig-remediate.sh; fi \
&& rm -f /tmp/stig-remediate.sh \
&& if [ "$ENABLE_STIG" = "1" ] && [ "$SKIP_STIG_BANNER" = "1" ]; then bash /tmp/restore-ubuntu-default-banners.sh; fi
&& rm -f /tmp/stig-remediate.sh

# --fips is passed here (not at install stage) because Ubuntu PRO has been attached and all
# FIPS packages (linux-image-fips, strongswan-hmac, etc.) are already installed above.
Expand All @@ -51,11 +50,21 @@ RUN chmod +x /tmp/fix.sh /tmp/stig-remediate.sh /tmp/restore-ubuntu-default-bann
RUN --mount=type=bind,from=kairos-init,src=/kairos-init,dst=/kairos-init \
/kairos-init -l debug -s init --fips --version "${VERSION}"

# Restore stock Ubuntu banners after kairos-init so OEM/init merges cannot reintroduce
# the USG/DoD text from STIG remediation (or from fix.sh's final issue → issue.net sync).
# Default 1: keep STIG remediations but drop the USG banner. Pass SKIP_STIG_BANNER=0 to retain it.
ARG ENABLE_STIG
ARG SKIP_STIG_BANNER=1
RUN if [ "$ENABLE_STIG" = "1" ] && [ "$SKIP_STIG_BANNER" = "1" ]; then \
bash /usr/local/sbin/restore-ubuntu-default-banners.sh; \
fi

# Symlink kernel HMAC
RUN kernel=$(ls /boot/vmlinuz-* | head -n1) && ln -sf ."${kernel#/boot/}".hmac /boot/.vmlinuz.hmac

# Clear cache
RUN find /var/cache -mindepth 1 -maxdepth 1 ! -name 'cracklib' -exec rm -rf {} + && \
rm -f /usr/local/sbin/restore-ubuntu-default-banners.sh && \
rm -rf /tmp/* /var/tmp/* && \
journalctl --vacuum-size=1K || true && \
rm -f /etc/machine-id /var/lib/dbus/machine-id /etc/hostname || true
4 changes: 2 additions & 2 deletions ubuntu-fips/22.04/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@
| Variable | Default | Meaning |
| -------- | ------- | ------- |
| `ENABLE_STIG` | `1` | When `1`, run DISA STIG remediation (`fix.sh`). Set to `0` for FIPS-only builds without STIG. |
| `SKIP_STIG_BANNER` | `0` | When `1` (with STIG enabled), restore stock Ubuntu login banners instead of the USG DoD banner (`/etc/issue`, SSH `Banner`, GDM, `/etc/profile.d/ssh_confirm.sh`). |
| `SKIP_STIG_BANNER` | `1` | When `1` (with STIG enabled), restore stock Ubuntu login banners instead of the USG DoD banner (`/etc/issue`, SSH `Banner`, GDM, `/etc/profile.d/ssh_confirm.sh`). Set to `0` to keep the STIG USG banner. |

Examples: `ENABLE_STIG=0 bash build.sh`, `SKIP_STIG_BANNER=1 bash build.sh my-tag`.
Examples: `ENABLE_STIG=0 bash build.sh`, `SKIP_STIG_BANNER=0 bash build.sh my-tag`.

**Note:** `build.sh` uses the `ubuntu-fips` directory as the Docker build context so shared files (e.g. `restore-ubuntu-default-banners.sh`) resolve correctly.

Expand Down
2 changes: 1 addition & 1 deletion ubuntu-fips/22.04/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ UBUNTU_FIPS_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
BASE_IMAGE="${1:-ubuntu-jammy-fips}"
VERSION=22.04
ENABLE_STIG="${ENABLE_STIG:-1}"
SKIP_STIG_BANNER="${SKIP_STIG_BANNER:-0}"
SKIP_STIG_BANNER="${SKIP_STIG_BANNER:-1}"

DOCKER_BUILDKIT=1 docker build \
--secret id=pro-attach-config,src="${SCRIPT_DIR}/pro-attach-config.yaml" \
Expand Down