Fixed the secure boot enrollment script

docs/stig-deviations.md

@@ -114,6 +114,30 @@ reverts to a justified deviation; (b) reproducibility — `semanage` rebuilds th
 SELinux policy store, so confirm the verity hash is stable across two builds (and
 normalize in 2d hygiene if it drifts).
 
+## 13. Ctrl+Alt+Del console reboot hotkey kept enabled (decision 2026-06-20)
+
+The RHEL 9 STIG disables the console reboot hotkey via two rules, both **waived**
+in the tailoring:
+- `disable_ctrlaltdel_reboot` — masks `ctrl-alt-del.target` (single Ctrl+Alt+Del).
+- `disable_ctrlaltdel_burstaction` — sets `CtrlAltDelBurstAction=none` in
+  `/etc/systemd/system.conf` (the rapid 7× burst reboot).
+
+**Why waived:** the STIG intent is to stop an **unauthenticated console user from
+causing an unplanned reboot/outage**. On this fleet that risk is structurally
+absent — the hosts are **diskless and stateless** (immutable erofs+dm-verity root,
+tmpfs volatile overlay), so a console reboot loses nothing and persists nothing,
+and a **field technician needs to recover a wedged kiosk from the keyboard when
+SSH is unavailable**. The two rules are unselected so `--remediate` leaves the
+systemd default (the hotkey reboots).
+
+**Compensating control / scope:** the hotkey only triggers a **clean stateless
+reboot** — it cannot exfiltrate data, alter the read-only root, or bypass auth to
+a shell. Authenticated reboot paths (`systemctl reboot` over the key-only admin
+SSH session) are unaffected either way. The console itself is otherwise locked
+down (kiosk autologin to a single locked browser; no getty shell on tty1;
+`debug_shell` is lab-only and never shipped). If a future deployment wants the
+hotkey disabled (e.g. a physically exposed terminal), re-select both rule IDs.
+
 ## Things that are NOT deviations (kept / enforced)
 
 - **SELinux enforcing** (`selinux --enforcing`; labels preserved into the erofs).