Restrict Access to Applications

sometimes, applications are installed on the system, but not all users should not be able to start it.

uninstalling not always possible, because some users may use it, or it is part of a larger RPM and the other applications from the RPM should stay on the system.

different approaches:

TryExec

check, if the user is allowed, to execute the application:

[Desktop Entry]
Comment=Ganttproject
Exec=/opt/ganttproject/ganttproject.sh
TryExec=/opt/ganttproject/ganttproject.sh

If the command that is specified by TryExec is not executable by the user, the Desktop-Entries is not displayed in the Start-Menu.

adding additional checks to the .desktop file

show only, if VMware image exists (and is readable):

vmware-winnt.desktop:

[Desktop Entry]
Name=Windows NT
GeneralName=VMware
Exec=/usr/bin/sudo /usr/bin/sc_vmware.sh /local/vmware/vermka/Windows_NT.vmx
TryExec[$e]=$(test -r /local/vmware/vermka/Windows_NT.vmx && echo "/usr/bin/vmplayer" || echo "/INVALID-PROGRAM")

Works with KDE3 and KDE4.

IMPORTANT: with KDE3 it is possible to use Hidden (or NoDisplay) for this purpose. Due to a bug in KDE4 (tested up until KDE 4.4, see ​https://trac.dass-it.de/lvermgeo/ticket/62 and ​https://bugs.kde.org/show_bug.cgi?id=225255) the following is only possible with KDE3 and NOT with KDE4:

vmware-winnt.desktop:

[Desktop Entry]
Name=Windows NT
GeneralName=VMware
Exec=/usr/bin/sudo /usr/bin/sc_vmware.sh /local/vmware/vermka/Windows_NT.vmx
Hidden[$e]=$(test -r /local/vmware/vermka/Windows_NT.vmx || echo "true")

permissions

Set application permissions to not executable by normal user and desktop files to be not readable. Define this in a permissions file under /etc/permissions.d/. Filename must match a installed RPM name.

Execute /sbin/conf.d/SuSEconfig.permissions

which sets permissions accordantly. After package installation by YaST, SuSEconfig is called and sets permissions. Therefore application is still unaccessible after a package update.

Example: /etc/permissions.d/k3b:

/usr/bin/k3b                                    root.media      750
/usr/share/applications/kde4/k3b.desktop        root.media      640

Another way to evaluate the permission definitions is the chkstat command.

• Check, what permissions will change
  • chkstat --system --warn
• change the permissions
  • chkstat --system --set

Restrict Access to Systemsettings

to disable a configuration item from systemsettings, restrict the read permissions on file share/kde4/services/settings-NAME, as described in the former section. This can also be done in a KDE-profile.

Get List of configuraton modules

kcmshell4 --list

Example: disable configuration module display

assume using the KDE-Profile /var/lib/kde-profiles/vermkv_kiosk/

Create config file /var/lib/kde-profiles/vermkv_kiosk/share/kde4/services/settings-display.desktop:

[Desktop Entry]
TryExec=/bin/false

or if it should be depend on the environment:

[Desktop Entry]
Hidden[$e]=$(if test -e /tmp/flagfile_example; then echo "false"; else echo "true"; fi)