sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fixed the secure boot enrollment script

Browse Source
This commit is contained in:
Audiobuzz
2026-06-20 12:16:37 +00:00
parent 33583bb4d8
commit d2b2156a22
7 changed files with 194 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/diskless-tailoring.xml
+11
View File
@@ -162,5 +162,16 @@
<xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" selected="true"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" selected="true"/>
<!-- Ctrl+Alt+Del reboot hotkey (decision 2026-06-20): KEEP the console
reboot hotkey working on these diskless kiosks. The STIG masks
ctrl-alt-del.target + sets CtrlAltDelBurstAction=none to stop an
unauthenticated console reboot, but the hosts are STATELESS (immutable
erofs+verity root, tmpfs overlay) so a console reboot has no data-loss
or persistence risk, and a field tech needs to recover a wedged kiosk
without SSH. Unselect both so remediation leaves the systemd default
(hotkey reboots). Justified in docs/stig-deviations.md #13. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="false"/>
</xccdf:Profile>
</xccdf:Tailoring>