Add STIG hrdening

scripts/extract-artifacts.sh

@@ -27,6 +27,11 @@ NVMET_TRADDR=${NVMET_TRADDR:-NVMET_TRADDR}
 # "rhgb quiet" so Plymouth shows the graphical splash; anything else bakes
 # "plymouth.enable=0" for a fully verbose console boot (boot-chain debugging).
 BOOT_SPLASH=${BOOT_SPLASH:-true}
+# STIG hardening toggle (from the enable_stig Packer var). "true" bakes the STIG
+# kernel params into the (signed) UKI cmdline — the no-GRUB compensating control
+# for the bootloader-argument rules (see docs/stig-deviations.md). FIPS is NOT
+# included here (decision: off); add fips=1 when FIPS is turned on.
+STIG=${STIG:-true}
 # Stable namespace UUIDs. Devices are referenced by-id
 # (/dev/disk/by-id/nvme-uuid.<uuid>) rather than /dev/nvmeNnM because NVMe
 # controller/namespace indices are NOT stable (a transient discovery controller
@@ -156,6 +161,14 @@ else
     SPLASH_FRAGMENT="plymouth.enable=0 "
 fi
 
+# STIG kernel hardening params (no GRUB here, so they ride the signed UKI
+# cmdline): kernel auditing on from boot, larger audit backlog, slab/page
+# poisoning, no vsyscall, zero-on-alloc/free. NO fips=1 (FIPS off — decision).
+STIG_FRAGMENT=""
+if [ "$STIG" = "true" ]; then
+    STIG_FRAGMENT="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none init_on_alloc=1 init_on_free=1 "
+fi
+
 DOT1X_FRAGMENT=""
 if [ "$DISABLE_DOT1X" = "true" ]; then
     echo "==> WARNING: building TEST cmdline with rd.dot1x=0 (802.1X + MACsec DISABLED)" >&2
@@ -169,6 +182,7 @@ if [ "$DISABLE_DOT1X" = "true" ]; then
 fi
 printf '%s' \
   "$SPLASH_FRAGMENT" \
+  "$STIG_FRAGMENT" \
   "$DOT1X_FRAGMENT" \
   "rd.neednet=1 systemd.volatile=overlay " \
   "rd.dot1x.nvindex=0x01800001 rd.dot1x.timeout=60 " \