Chapter 20. Locking down selected tasks

Procedure

1. Create the user profile in /etc/dconf/profile/user unless it already exists:

   user-db:user
   system-db:local

   Copy to Clipboard Toggle word wrap

2. Create a local database for machine-wide settings in the etc/dconf/db/local.d/00-lockdown file:

   [org/gnome/desktop/lockdown]
   
   # Prevent applications from printing
   disable-printing=true

   Copy to Clipboard Toggle word wrap

3. Override the user’s setting and prevent the user from changing it in the /etc/dconf/db/local.d/locks/lockdown file:

   # List the keys used to configure lockdown
   /org/gnome/desktop/lockdown/disable-printing

   Copy to Clipboard Toggle word wrap

4. Update the system databases:

   # dconf update

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the user profile in /etc/dconf/profile/user unless it already exists:

   user-db:user
   system-db:local

   Copy to Clipboard Toggle word wrap

2. Create a local database for machine-wide settings in the /etc/dconf/db/local.d/00-lockdown file:

   [org/gnome/desktop/lockdown]
   
   # Prevent the user from saving files on disk
   disable-save-to-disk=true

   Copy to Clipboard Toggle word wrap

3. Override the user’s setting and prevent the user from changing it in the /etc/dconf/db/local.d/locks/lockdown file:

   # Lock this key to disable saving files on disk
   /org/gnome/desktop/lockdown/disable-save-to-disk

   Copy to Clipboard Toggle word wrap

4. Update the system databases:

   # dconf update

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a file with the same content as in /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy:

   cp /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy /etc/share/polkit-1/actions/org.freedesktop.udisks2.policy

   Copy to Clipboard Toggle word wrap

   Do not change the /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy file, your changes will be overwritten by the next package update.

2. Delete the action you do not need, and add the following lines to the /etc/polkit-1/actions/org.freedesktop.udisks2.policy file:

   <action id="org.freedesktop.udisks2.modify-device">
     <message>Authentication is required to modify the disks settings</message>
        <defaults>
           <allow_any>no</allow_any>
           <allow_inactive>no</allow_inactive>
           <allow_active>yes</allow_active>
         </defaults>
    </action>

   Copy to Clipboard Toggle word wrap

   Replace no by auth_admin if you want to ensure only the root user is able to perform the action.

3. Save the changes.

Procedure

1. Create the /etc/dconf/profile/user profile, which contains the following lines:

   user-db:user
   system-db:local

   Copy to Clipboard Toggle word wrap

   where local is the name of a dconf database

2. Create the /etc/dconf/db/local.d/ directory if it does not already exist.

3. Create the /etc/dconf/db/local.d/00-logout key file to provide information for the local database:

   [org/gnome/desktop/lockdown]
   # Prevent the user from user switching
   disable-log-out=true

   Copy to Clipboard Toggle word wrap

4. Override the user’s setting, and prevent the user from changing it in the /etc/dconf/db/local.d/locks/lockdown file:

   # Lock this key to disable user logout
   /org/gnome/desktop/lockdown/disable-log-out

   Copy to Clipboard Toggle word wrap

5. Update the system databases:

   # dconf update

   Copy to Clipboard Toggle word wrap
6. Users must log out and back in again before the system-wide settings take effect.

Procedure

1. Create the /etc/dconf/profile/user profile, which contains the following lines:

   user-db:user
   system-db:local

   Copy to Clipboard Toggle word wrap

   where local is the name of a dconf database

2. Create the /etc/dconf/db/local.d/ directory if it does not already exist.

3. Create the /etc/dconf/db/local.d/00-user-switching key file to provide information for the local database:

   # Prevent the user from user switching
   [org/gnome/desktop/lockdown]
   disable-user-switching=true
   
   [org/gnome/desktop/screensaver]
   user-switch-enabled=false

   Copy to Clipboard Toggle word wrap

4. Override the user’s setting, and prevent the user from changing it in the /etc/dconf/db/local.d/locks/lockdown file:

   # Lock this key to disable user switching
   /org/gnome/desktop/lockdown/disable-user-switching
   /org/gnome/desktop/screensaver/user-switch-enabled

   Copy to Clipboard Toggle word wrap

5. Update the system databases:

   # dconf update

   Copy to Clipboard Toggle word wrap
6. Users must log out and back in again before the system-wide settings take effect.