Fixed the secure boot enrollment script

files/secureboot/fleet-sb-enroll

@@ -28,8 +28,12 @@ EFIVARS=/sys/firmware/efi/efivars
 GUID_GLOBAL=8be4df61-93ca-11d2-aa0d-00e098032b8c   # PK, KEK, SetupMode
 GUID_DB=d719b2cb-3d3a-4596-a3bc-dad00e67656f       # db, dbx
 # EFI var attributes: NON_VOLATILE|BOOTSERVICE_ACCESS|RUNTIME_ACCESS|
-# TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x27, little-endian 4 bytes.
-ATTR=$'\x27\x00\x00\x00'
+# TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x27, written as a 4-byte little-endian
+# u32 prefixed to the .auth payload. These 4 bytes contain NULs, so they are
+# emitted with printf at WRITE TIME, never stored in a variable: a bash string
+# can't hold a NUL (it truncates at the first one), which would leave only the
+# 0x27 byte, corrupt the 4-byte attribute field efivarfs reads, and make the
+# kernel reject the write with EINVAL ("dd: Invalid argument").
 
 die() { echo "fleet-sb-enroll: $*" >&2; exit 1; }
 
@@ -57,7 +61,7 @@ enrol_one() {  # $1=var name  $2=guid  $3=.auth path
   local f="$EFIVARS/$1-$2" tmp
   [ -f "$3" ] || die "missing $3"
   tmp=$(mktemp)
-  printf '%s' "$ATTR" > "$tmp"
+  printf '\x27\x00\x00\x00' > "$tmp"   # 4-byte LE attribute prefix (see note above)
   cat "$3" >> "$tmp"
   # Existing EFI vars carry the immutable flag; clear it before overwriting.
   [ -e "$f" ] && chattr -i "$f" 2>/dev/null || true

files/stig/diskless-tailoring.xml

@@ -162,5 +162,16 @@
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" selected="true"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" selected="true"/>
 
+    <!-- Ctrl+Alt+Del reboot hotkey (decision 2026-06-20): KEEP the console
+         reboot hotkey working on these diskless kiosks. The STIG masks
+         ctrl-alt-del.target + sets CtrlAltDelBurstAction=none to stop an
+         unauthenticated console reboot, but the hosts are STATELESS (immutable
+         erofs+verity root, tmpfs overlay) so a console reboot has no data-loss
+         or persistence risk, and a field tech needs to recover a wedged kiosk
+         without SSH. Unselect both so remediation leaves the systemd default
+         (hotkey reboots). Justified in docs/stig-deviations.md #13. -->
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="false"/>
+    <xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="false"/>
+
   </xccdf:Profile>
 </xccdf:Tailoring>