#!/bin/bash
set -uo pipefail

# Renders the Common Criteria evaluated-configuration status into a login
# banner, consumed via pam_motd's default /run/motd.d scan. Deliberately not
# `set -e`: a failure here should degrade to a missing/stale banner, never
# abort in a way that could affect anything else. Triggered periodically by
# the cc-banner.timer/cc-banner.service systemd units, not on a login itself -
# pam_motd only ever concatenates static files, it can't execute anything.
#
# Only `check`'s own final summary line is kept - not the per-script
# PASS/FAIL/REBOOT lines or their individual reasons. The banner is shown to
# every user who logs in, not just root, while `check` itself requires root
# (see scripts/libcc's cc_require_root); spelling out which specific setting
# is non-compliant and why in a banner every account can read would expose
# detail only someone who can actually act on it - by running `check`/`apply`
# themselves as root - has any use for. That summary line already tells them
# where to look (see check's own closing case statement).
#
# `check` itself exits non-zero whenever the system isn't fully compliant -
# expected and correct for `check`, but with `pipefail` that would become
# *this* script's own exit status too, and this script succeeding at
# rendering a banner that correctly reports a problem is not the same thing
# as this script failing. `|| true` keeps check's own output either way
# while stopping its exit code from reaching systemd as if the render itself
# had failed.
mkdir -p /run/motd.d
out=$(/usr/lib/common-criteria/check || true)
echo "$out" | tail -n 1 > /run/motd.d/cc-status
