fix: CIS regressions — re-apply /etc/issue banners + comprehensive logfile permissions for scan VM#8317
Open
fix: CIS regressions — re-apply /etc/issue banners + comprehensive logfile permissions for scan VM#8317
Conversation
apt_get_dist_upgrade uses --force-confnew which forces dpkg to overwrite all conffiles with the package maintainer's version. When a new base-files package is published to Ubuntu repos, /etc/issue and /etc/issue.net get replaced with the default Ubuntu content (containing \n \l escape sequences), failing CIS rules 1.6.2 and 1.6.3. Fix by re-copying the custom login banners from the packer staging area after all apt operations complete in post-install-dependencies.sh. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
djsly
requested review from
AbelHu,
Devinwong,
SriHarsha001,
awesomenix,
calvin197,
cameronmeissner,
ganeshkumarashok,
junjiezhang1997,
lilypan26,
mxj220,
pdamianov-dev,
phealy,
r2k1,
sulixu,
surajssd,
timmy-wright and
zachary-bailey
as code owners
awesomenix
approved these changes
Apr 15, 2026
Devinwong
approved these changes
Apr 15, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Re-applies custom /etc/issue and /etc/issue.net login banners after Ubuntu apt operations to prevent CIS 1.6.2/1.6.3 regressions caused by base-files conffile overwrites during dist-upgrade.
Changes:
- Adds a post-
aptstep inpost-install-dependencies.shto copy the custom local and remote login banners back into place. - Documents why
apt_get_dist_upgrade --force-confnewcan revert the banner files.
The scan VM boots from the VHD and boot-time daemons (syslog, journal) create new log files with default permissions that violate CIS 6.1.3.1 (22.04) / 6.1.4.1 (24.04). The previous simple chmod 640 only handled file mode but not directory perms or group ownership. Replace with comprehensive fix matching cis.sh assignFilePermissions(): - File permissions: at most 0640 (clear execute, group-write, other-all) - Directory permissions: at most 0750 (clear group-write, other-all) - Group ownership: must be root, adm, or syslog Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
djsly
changed the title
The ETC_ISSUE_CONFIG_SRC/DEST variables are defined in packer_source.sh which is not sourced by post-install-dependencies.sh. Use the literal paths directly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move /etc/issue re-copy logic into a reapplyBanners() function in packer_source.sh so post-install-dependencies.sh uses the same source of truth as copyPackerFiles(). Source packer_source.sh in post-install (safe — it only defines functions, no top-level side effects) matching the pattern already used by pre-install-dependencies.sh. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
PR Title Lint Failed ❌Current Title: Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns: Conventional Commits Format:
Guidelines:
Examples:
Please update your PR title and the lint check will run again automatically. |
Address review feedback: - Expand -perm masks to /7137 (files) and /7027 (dirs) to also catch setuid/setgid/sticky bits that violate CIS rules. - Prefer adm group over syslog when both exist, as adm is the conventional log group on Ubuntu. Only fall back to syslog when adm is absent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Multiple CIS rules are regressing on Ubuntu VHD builds, blocking every PR on pipeline 119535:
apt_get_dist_upgrade --force-confnewoverwrites custom/etc/issueand/etc/issue.netbanners whenbase-filespackage upgradesRoot Causes
/etc/issue (1.6.2/1.6.3)
copyPackerFiles()inpre-install-dependencies.shcopies custom banners early in the buildapt_get_dist_upgrade()runs with--force-confnew, overwriting conffiles with maintainer versions\n \lescape sequencesLogfile permissions (6.1.3.1/6.1.4.1)
cis.shfixes log permissions during VHD build (runs last among config scripts)chmod 640) only handled file mode, not directory perms or group ownershipFixes
Commit 1: Re-copy banners in post-install-dependencies.sh
Re-copy custom login banners from the packer staging area after all apt operations complete. This ensures banners survive any
base-filesupgrade.Commit 2: Comprehensive logfile fix in cis-report.sh
Replace the simple
find /var/log -type f -exec chmod 640 {} \;with comprehensive treatment matchingcis.sh:This supersedes PR #8299 which attempted to fix the logfile issue but removed the scan-time fix, making things worse.
Impact