Hello all.

Hopefully someone can guide me and solve this issue.

Distro: Rocky Linux 8.5
Kde Plasma Version: 5.23.3

I'm setting up a VDI environment using Thinlinc VNC and if a user chooses 'Shut Down' or 'Restart' options their sessions ends up in a weird state where it is not terminated but also not working. This is why I need to restrict access to restart and shut down.
An alternative to restricting access would be to globally enforce 'Show buttons for: Sessions' instead of the default 'Show buttons for: Power' in the KDE menu.

I have not managed to accomplish any of that and can't seem to figure out how to do it.
I know what is changed in the users plasma-org.kde.plasma.desktop-appletsrc file to make the menu display the 'Lock' and 'Log Out' options instead of the 'Shut Down' and 'Restart' options, but no matter what I do nothing seems to take.

Same with System Settings->Startup and Shutdown->Offer Shutdown Options.
This one option I have managed to restrict by editing /usr/share/kde-settings/kde-profile/default/xdg/ksmserverrc, but when I press 'Log Out' i am still presented with 'Shut Down' and 'Restart' options as if it is completely ignored.

I'm read through the Kiosk documentation and it offers no insight into how to do any of this.
There seem to be no actions for restricting access to 'Shut Down' and 'Restart' in kiosk at all.

I'm hopeful you can help me solve this issue.

Thanks in advance for any pointers towards a solution.

Rgds.

// Fredrik

This is what I do to restrict suspend and hibernate.

sudo vim /etc/polkit-1/rules.d/10-disable-suspend.rules

polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.login1.suspend" ||
action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
action.id == "org.freedesktop.login1.hibernate" ||
action.id == "org.freedesktop.login1.hibernate-multiple-sessions")
{
return polkit.Result.NO;
}
});

My guess is you should have reboot and power-off in your list. The full list of actions available to you are probably in:

pkaction | grep login1

Thank you for trying to answer and pointing me in a direction.

What you have done with polkit is more or less what I have also done...

Code: Select all

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.suspend" ||
        action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
        action.id == "org.freedesktop.login1.hibernate" ||
        action.id == "org.freedesktop.login1.hibernate-multiple-sessions")
    {
        if (!subject.local) {
                return polkit.Result.NO;
        }
    }
});

I added a check so that the rules are only applied if the person is logged in remotely as it is in my case with my VDI setup.

I also did the same for 'org.freedesktop.login1.power-off' and 'org.freedesktop.login1.reboot' but that changed nothing.

I'm starting to believe that the Application Launcher is buggy and is ignoring all settings regarding disabling shutdown and reboot.
I base that on the fact that it completely ignores the System Settings->Startup and Shutdown.>Desktop Session->"Offer Shutdown Options" and still presents the users with 'Shut Down' and 'Restart' options when they use any of the power or session options.

There are some alternatives in the pkaction list that I have not tried. I guess I will give them a try and hope that some mercyfull soul here on the forum puts me out of my misery

Cheers

// Fredrik

I retract and apologize för anything bad I've said against the Application Launcher

I finally got it to work...
I created the file /etc/polkit-1/rules.d/11-poweroff-reboot-halt.rules with the following content and restarted ssdm and now it works.

Code: Select all

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.login1.halt" ||
        action.id == "org.freedesktop.login1.halt-multiple-sessions" ||
        action.id == "org.freedesktop.login1.power-off" ||
        action.id == "org.freedesktop.login1.power-off-multiple-sessions" ||
        action.id == "org.freedesktop.login1.reboot" ||
        action.id == "org.freedesktop.login1.reboot-multiple-sessions")
    {
        if (!subject.local) {
                return polkit.Result.NO;
        }
    }
});

Cheers

// Fredrik