0

I am attempting to lock down a Fedora 19 install so that the user is locked in to a full screen version of Firefox. This can be achived with an number of addons for Firefox. I also need to lock down the desktop environment in the event that Firefox crashes.

I am using the Xfce desktop environment (as it is less resource hungry than gnome). Obviously this lockdown task needs to be completed via the command line so it can be included within the initial setup scripts.

Examples of lockdowns:

  • Remove all panels
  • Disable right click
  • Remove desktop icons
  • Disable Ctrl+Alt+F1/F2
  • Disable hotkeys Alt+tab / Alt+F4

So far I am unable to find any documentation on how to perform these changes via the command line. The Xfce website provides very limited documentation about their 'kiosk mode' -> http://wiki.xfce.org/howto/kiosk_mode which appears to be pointing in the right direction, however is incomplete.

Has anyone had experience with locking down the Xfce desktop environment, or any other environment?

Any suggestions would be appreciated.

--------------------EDIT--------------------

The box is not (normally) interacted with. It is being used to display a single web page, which is dynamically changed. The reason for the lock down is to stop tampering. As the boxes still have USB ports, it is possible, although unlikely, that someone may attempt to attach input devices.

1

2 Answers 2

0

It doesn't directly answer your question but as an alternative I created the JustBrowsing LiveCD that you can use instead. Contains a locked down environment with Firefox, Chrome and not much else. Boots into Firefox by default.

JustBrowsing LiveCD

JustBrowsing uses the i3 WM (it has a single text-based configuration file) and adeskbar panel that contains some shortcuts and lockscreen, reboot, shutdown launchers (modified python file to disable editing panel). Virtual Terminals are disabled using a Xorg config file and no terminal emulators are installed. I discuss these details here.

Don't lock down the browser (let users install whatever extensions they like) instead lock down the Desktop Environment as detailed above.

1
  • Unfortunately for my implementation, I am unable to use this. The box is not (normally) interacted with. It is being used to display a single web page, which is dynamically changed. The reason for the lock down is to stop tampering. As the boxes still have USB ports, it is possible, although unlikely, that someone may attempt to attach input devices. Also the hardware I am using has limited resources, so unfortunately running a live linux distro is not really an option. Thanks for the feedback, I was possibly not as clear as I should have been in my question, I shall update it.
    – dooffas
    Sep 3, 2013 at 8:32
0

After some research I came up with these solutions:

Remove all panels:

This can be done in the current session by running:

killall xfce4-panel

To make this persist after reboot you can change the xfce4-session.xml file. In my case located -> /etc/xdg/xfce/xfconf/xfce-perchannel-xml/xfce4-session.xml Edit the line

<value type="string" value="xfce4-panel"/>

I did this with a sed command

sed -i 's#value=xfce4-panel#value=#' xfce4-session.xml

Disable right click / hotkeys:

This can be done in the current session by running:

Xmodmap -e 'pointer = 1 2 0 4 5 6 7 8 9'

To reverse this you can run:

Xmodmap -e 'pointer = default'

To make this persist after reboot create a file in the users home directory named .xinitrc In that file add:

if [ -s ~/.Xmodmap ]; then
    xmodmap ~/.Xmodmap
fi

Export the current Xmodmap config to the users home direcory using:

Xmodmap -pke > /~.xmodmap

append this line to the end of the file:

pointer = 1 2 0 4 5 6 7 8 9

This file can be used to disable keyboard keys for instance ctrl, alt, menu and super.

Remove desktop Icons:

This took me a while to work out. By default some icons are displayed on the desktop. To stop them form appering you can edit a file: xfce4-desktop.xml Located -> /~/.config/xfce4/xfconf/xfce-perchannel-xml/ Change the lines in the file to read:

<property name="show-trash" type="bool" value="false"/>
<property name="show-filesystem" type="bool" value="false"/>
<property name="show-home" type="bool" value="false"/>
<property name="show-removable" type="bool" value="false"/>

This file however, only exists after changes have been made in a front end menu. So for my scenario, I edited the file and move it in to place during the installation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .