| |
|
|
KDE Kiosk Mode HOWTORoland Fehrenbacher rfehrenb@transtec.de Peter Kruse Peter.Kruse@wolnet.de
The requirements for the desktop environment of users in a large network environment is often very different to a typical homeuser. The number of applications that these users need to run is usually very limited, and the users themselves are not very experienced in solving computing related problems. The administrators of the network therefore need to ensure that the required applications run reliably, and can be started by the users with a minimum of hassle. For security, stability, and also administrative reasons it is then advisable to provide only the absolutely necessary applications and functionality. With the advent of modern desktop technology like KDE, this goal has become harder to achieve. Interoperability between different desktop programs, ease of configuration by configuration engines, etc. allow the user a great deal of control over her/his desktop, which is great when needed. The above large network scenario, however, is not addressable in standard KDE. This is where the restricted mode tries to fill in the gap.
1. IntroductionThis document describes a by-product of a project, in which a large number of Linux based workstations were provided. Although a kiosk-mode patch exists for KDE 1, this document assumes KDE 2 and the patches apply to KDE version 2.1.1(2). 1.1. Copyright InformationThis document is copyrighted (c) 2001 Peter Kruse and Roland Fehrenbacher and is distributed under the terms of the Linux Documentation Project (LDP) license, stated below. Unless otherwise stated, Linux HOWTO documents are copyrighted by their respective authors. Linux HOWTO documents may be reproduced and distributed in whole or in part, in any medium physical or electronic, as long as this copyright notice is retained on all copies. Commercial redistribution is allowed and encouraged; however, the authors would like to be notified of any such distributions. All translations, derivative works, or aggregate works incorporating any Linux HOWTO documents must be covered under this copyright notice. That is, you may not produce a derivative work from a HOWTO and impose additional restrictions on its distribution. Exceptions to these rules may be granted under certain conditions; please contact the Linux HOWTO coordinator at the address given below. In short, we wish to promote dissemination of this information through as many channels as possible. However, we do wish to retain copyright on the HOWTO documents, and would like to be notified of any plans to redistribute the HOWTOs. If you have any questions, please contact <linux-howto@metalab.unc.edu> 1.2. DisclaimerNo liability for the contents of this documents can be accepted. Use the concepts, examples and other content at your own risk. As this is a new edition of this document, there may be errors and inaccuracies, that may of course be damaging to your system. Proceed with caution, and although this is highly unlikely, the authors do not take any responsibility for that. All copyrights are held by their by their respective owners, unless specifically noted otherwise. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark. Naming of particular products or brands should not be seen as endorsements. You are strongly recommended to take a backup of your system before major installation and backups at regular intervals. 1.4. Credits<Werner.Westerkamp (at) lbbw.de> for giving useful tips, and proof-reading this HOWTO <remalone (at) sympatico.ca> for first-time testing the instructions given here 2. MotivationThe following requirements had to be met:
Note that these are not requirements for the applications that run under KDE. Every application should make sure by itself, that these requirements are met. It is known, that of course many applications have an Open File Dialog, and thus could modify Files under .kde and so make it possible to run arbitrary commands. The restrictions should only apply when an environment variable KDE_MODE is set to ``restricted''. If it is not set, a normal KDE Desktop should open. It follows, that the user can only run applications that are found in the Application menu. So the administrator must be able to provide the applications. A tool is needed to add, remove and modify entries in the menu. 3. Implementation3.1. Source Code PatchesSome files in kdebase-2.1.1 have to be patched:
3.2. Global modificationsInstead of a dcop call, a program screensaver is executed, which must be found in the PATH. Just create a script called screensaver with the following contents:
Instead of the normal procedure, a program klogout is called, which must be found in the PATH. Create a script called klogout with the following contents:
Everything else can be done with normal configuration, that is: (Configuration files can be found in $KDEDIR/share/config) Remove Trash, Templates and Autostart Icons from the desktop and disable Alt+F2 by modifying kdeglobals. Make sure the following entries exist:
disable Desktop menu and tips on start. Make sure the following entry exists in kdesktoprc:
3.3. How to set the variable KDE_MODETo answer this, you must understand what happens after you successfully authorized yourself to the system: Depending on your distribution, some scripts are executed, from which one should be modified to set KDE_MODE. There is a script called Xsession under /etc/X11/xdm or /usr/X11R6/lib/xdm, which you could modify, or startkde, that is located under $KDEDIR/bin. Note however, that the variable must be set prior to calling the kde processes. Since we had the need to make a setup for a big environment (now reaching 300 users) we wrote an application that enables us to administer. It also creates the KDE Menus. It writes a file called .env.sh in a user's home directory, that will be sourced in Xsession. That is what you could do. So you could put in .env.sh of that specific user's home directory:
and add to Xsession, somewhere prior to calling startkde:
We also have two kdedirs that looks like to separate installations of KDE, this was neccessary so "normal" users could still have a full-featured KDE. So we have an original kdedir, and a restricted kdedir, in which we removed entries under share/applnk and set the variable KDEDIR (under KDE 2 the variable KDEDIRS was introduced but KDEDIR is still used). The files under share/applnk make up the menu. Caution, you cannot just remove all files there, because some are needed to initialize KDE. You also set the Variable KDEDIR in Xsession, after sourcing .env.sh like this:
Replace /usr/local/kde with the install directory of your KDE. The contents of /usr/local/kde/restricted_kdedir looks like:
only share is a real directory, every other directory is a symbolic link pointing to original kdedir. /usr/local/kde/restricted_kdedir/share has the following contents:
only applnk is a real directory. As a minimal requirement remove everything except:
| |||||||||||||||||||||||||||
