Chapter 9. Restricting the desktop session

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-logout keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable user logut
   disable-log-out=true
   
   # Disable user switching
   disable-user-switching=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock user logout
   /org/gnome/desktop/lockdown/disable-log-out
   
   # Lock user switching
   /org/gnome/desktop/lockdown/disable-user-switching

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-printing keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable printing
   disable-printing=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock printing
   /org/gnome/desktop/lockdown/disable-printing

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-filesaving keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   # Disable saving files on disk
   disable-save-to-disk=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock file saving
   /org/gnome/desktop/lockdown/disable-save-to-disk

3. Apply the changes to the system databases:

   # dconf update

Procedure

1. Create a plain text /etc/dconf/db/local.d/00-lockdown keyfile in the /etc/dconf/db/local.d/ directory with the following content:

   [org/gnome/desktop/lockdown]
   
   # Disable command prompt
   disable-command-line=true

2. Create a new file under the /etc/dconf/db/local.d/locks/ directory and list the keys or subpaths you want to lock down:

   # Lock command prompt
   /org/gnome/desktop/lockdown/disable-command-line

3. Apply the changes to the system databases:

   # dconf update

4. For this settings to take effect, users needs to log out and log back in.

Procedure

1. Copy the /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy file under the /etc/share/polkit-1/actions/ directory:

   # cp /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy /etc/share/polkit-1/actions/org.freedesktop.udisks2.policy

2. In the /etc/polkit-1/actions/org.freedesktop.udisks2.policy file, delete any actions that you do not need and add the following lines:

   <action id="org.freedesktop.udisks2.modify-device">
     <message>Authentication is required to modify the disks settings</message>
        <defaults>
           <allow_any>no</allow_any>
           <allow_inactive>no</allow_inactive>
           <allow_active>yes</allow_active>
         </defaults>
    </action>

   If you want to restrict access only to the root user, replace <allow_any>no</allow_any> with <allow_any>auth_admin</allow_any>.