# KDE Kiosk Mode HOWTO

### Roland Fehrenbacher

rfehrenb@transtec.de

### Peter Kruse

Peter.Kruse@wolnet.de

Revision History
Revision 1.4 | 2002-09-26 | Revised by: gjf
Archived.
Revision $Revision: 1.3 $ | $Date: 2001/08/14 07:44:07 $ | Revised by: $Author: kruse $

The requirements for the desktop environment of users in a large network environment is often very different to a typical homeuser. The number of applications that these users need to run is usually very limited, and the users themselves are not very experienced in solving computing related problems. The administrators of the network therefore need to ensure that the required applications run reliably, and can be started by the users with a minimum of hassle. For security, stability, and also administrative reasons it is then advisable to provide only the absolutely necessary applications and functionality.

With the advent of modern desktop technology like KDE, this goal has become harder to achieve. Interoperability between different desktop programs, ease of configuration by configuration engines, etc. allow the user a great deal of control over her/his desktop, which is great when needed. The above large network scenario, however, is not addressable in standard KDE. This is where the restricted mode tries to fill in the gap.

| Archived Document Notice: This document has been archived by the LDP because it does not apply to modern Linux systems. It is no longer being actively maintained. Further information on this topic can be found at http://www.brigadoon.de/peter/kde/.

# 1. Introduction

This document describes a by-product of a project, in which a large number of Linux based workstations were provided. Although a kiosk-mode patch exists for KDE 1, this document assumes KDE 2 and the patches apply to KDE version 2.1.1(2).

## 1.1. Copyright Information

This document is copyrighted (c) 2001 Peter Kruse and Roland Fehrenbacher and is distributed under the terms of the Linux Documentation Project (LDP) license, stated below.

Unless otherwise stated, Linux HOWTO documents are copyrighted by their respective authors. Linux HOWTO documents may be reproduced and distributed in whole or in part, in any medium physical or electronic, as long as this copyright notice is retained on all copies. Commercial redistribution is allowed and encouraged; however, the authors would like to be notified of any such distributions.

All translations, derivative works, or aggregate works incorporating any Linux HOWTO documents must be covered under this copyright notice. That is, you may not produce a derivative work from a HOWTO and impose additional restrictions on its distribution. Exceptions to these rules may be granted under certain conditions; please contact the Linux HOWTO coordinator at the address given below.

In short, we wish to promote dissemination of this information through as many channels as possible. However, we do wish to retain copyright on the HOWTO documents, and would like to be notified of any plans to redistribute the HOWTOs.

If you have any questions, please contact `<linux-howto@metalab.unc.edu>`

## 1.2. Disclaimer

No liability for the contents of this documents can be accepted. Use the concepts, examples and other content at your own risk. As this is a new edition of this document, there may be errors and inaccuracies, that may of course be damaging to your system. Proceed with caution, and although this is highly unlikely, the authors do not take any responsibility for that.

All copyrights are held by their by their respective owners, unless specifically noted otherwise. Use of a term in this document should not be regarded as affecting the validity of any trademark or service mark.

Naming of particular products or brands should not be seen as endorsements.

You are strongly recommended to take a backup of your system before major installation and backups at regular intervals.

## 1.3. New Versions

This document and the patches are available at http://www.brigadoon.de/peter/kde.

## 1.4. Credits

`<Werner.Westerkamp (at) lbbw.de>` for giving useful tips, and proof-reading this HOWTO

`<remalone (at) sympatico.ca>` for first-time testing the instructions given here

## 1.5. Feedback

Please send any comments, corrections or additions to one of the authors.

# 2. Motivation

The following requirements had to be met:

- The user should not be able to open an interactive shell (Terminal), or run arbitrary commands,

- The user should not have a view to the filesystem, so no filemanager,

- The user should not be able to modify or create files directly by means provided by KDE (no editor, menuedit, etc.).

Note that these are not requirements for the applications that run under KDE. Every application should make sure by itself, that these requirements are met. It is known, that of course many applications have an Open File Dialog, and thus could modify Files under .kde and so make it possible to run arbitrary commands.

The restrictions should only apply when an environment variable `KDE_MODE` is set to ``restricted''. If it is not set, a normal KDE Desktop should open. It follows, that the user can only run applications that are found in the Application menu. So the administrator must be able to provide the applications. A tool is needed to add, remove and modify entries in the menu.

# 3. Implementation

## 3.1. Source Code Patches

Some files in kdebase-2.1.1 have to be patched:

- appletop_mnu.cpp.patch: Applets on the panel can be moved and removed, but the Preferences dialog is disabled.

- k_mnu.cpp.patch: Run Command... and Configure Panel entries are removed from the standard K Menu

- khc_man.cc.patch: Online Help is completely disabled. This would open konqueror.

- konq_popupmenu.cc.patch: right-mouse menu on icons on the desktop are reduced to Cut, Copy, Paste, Delete, ... but no Open With ..., no Edit File Type... and no Poperties... dialogs.

- pagerapplet.cpp.patch: on minipager selection of type (Preview, Number, Name) is disabled. this caused trouble in multihead environment.

- panel.cpp.patch: right mouse menu on Panel is disabled.

## 3.2. Global modifications

Instead of a dcop call, a program screensaver is executed, which must be found in the `PATH`. Just create a script called screensaver with the following contents:

    #!/bin/bash

    dcop kdesktop KScreensaverIface lock

make it executable and put it in `$KDEDIR/bin`.

Instead of the normal procedure, a program klogout is called, which must be found in the `PATH`. Create a script called klogout with the following contents:

    #!/bin/bash

    dcop kdesktop KDesktopIface logout

make it executable and put it in `$KDEDIR/bin`, where `$KDEDIR` is the install directory of KDE and `$KDEDIR/bin` is found in your `PATH`.

- krootwm.cc.patch: klogout is executed instead of a dcop call

- systemtrayapplet.cpp.patch: again call of klogout and screensaver instead of dcop calls.

- workspace.cpp.patch: call of klogout instead of dcop call.

Everything else can be done with normal configuration, that is: (Configuration files can be found in `$KDEDIR/share/config`) Remove Trash, Templates and Autostart Icons from the desktop and disable Alt+F2 by modifying `kdeglobals`. Make sure the following entries exist:

    [Paths]

    Trash=$HOME/.kde2/Trash/

    Autostart=$HOME/.kde2/Autostart/

    Templates=$HOME/.kde2/Templates/

    Desktop=$HOME/.kde2/Desktop/

    [Global Keys]

    Execute command=

(it may be `.kde` instead of `.kde2`)

disable Desktop menu and tips on start. Make sure the following entry exists in `kdesktoprc`:

    [Mouse Buttons]

    Right=

    [General]

    TipsOnStart=false

You could also login as the special user, and configure it only for him, then the config files are found in `$KDEHOME/share/config` where `$KDEHOME` is normally `$HOME/.kde`.

## 3.3. How to set the variable KDE_MODE

To answer this, you must understand what happens after you successfully authorized yourself to the system: Depending on your distribution, some scripts are executed, from which one should be modified to set `KDE_MODE`. There is a script called Xsession under `/etc/X11/xdm` or `/usr/X11R6/lib/xdm`, which you could modify, or startkde, that is located under `$KDEDIR/bin`. Note however, that the variable must be set prior to calling the kde processes.

Since we had the need to make a setup for a big environment (now reaching 300 users) we wrote an application that enables us to administer. It also creates the KDE Menus. It writes a file called `.env.sh` in a user's home directory, that will be sourced in Xsession. That is what you could do. So you could put in `.env.sh` of that specific user's home directory:

    #!/bin/sh

    KDE_MODE="restricted"

    export KDE_MODE

and add to Xsession, somewhere prior to calling startkde:

    if [ -f $HOME/.env.sh ]; then

        . $HOME/.env.sh

    fi

We also have two kdedirs that looks like to separate installations of KDE, this was neccessary so "normal" users could still have a full-featured KDE. So we have an original kdedir, and a restricted kdedir, in which we removed entries under `share/applnk` and set the variable `KDEDIR` (under KDE 2 the variable `KDEDIRS` was introduced but `KDEDIR` is still used). The files under `share/applnk` make up the menu. Caution, you cannot just remove all files there, because some are needed to initialize KDE.

You also set the Variable `KDEDIR` in Xsession, after sourcing `.env.sh` like this:

    case "$KDE_MODE" in

        restricted)

            KDEDIR=/usr/local/kde/restricted_kdedir

            ;;

        *)

            KDEDIR=/usr/local/kde

    esac

    export KDEDIR

Replace `/usr/local/kde` with the install directory of your KDE. The contents of `/usr/local/kde/restricted_kdedir` looks like:

    bin -> ../bin

    cgi-bin -> ../cgi-bin

    etc -> ../etc

    lib -> ../lib

    share

only share is a real directory, every other directory is a symbolic link pointing to original kdedir. `/usr/local/kde/restricted_kdedir/share` has the following contents:

    aclocal -> ../../share/aclocal

    applnk

    apps -> ../../share/apps

    autostart -> ../../share/autostart

    config -> ../../share/config

    doc -> ../../share/doc

    fonts -> ../../share/fonts

    icons -> ../../share/icons

    locale -> ../../share/locale

    mimelnk -> ../../share/mimelnk

    services -> ../../share/services

    servicetypes -> ../../share/servicetypes

    sounds -> ../../share/sounds

    templates -> ../../share/templates

    wallpapers -> ../../share/wallpapers

only applnk is a real directory. As a minimal requirement remove everything except:

    Settings/Peripherals/mouse.desktop

    Settings/LookNFeel/background.desktop

                      /colors.desktop

                      /kwinoptions.desktop

                      /style.desktop

                      /virtualdesktops.desktop

under `/usr/local/kde/restricted_kdedir/share/applnk`