fix: a notification's Configure button no longer opens system settings

The kernel memory killer's "Memory Shortage Avoided" notice carried a
Configure button that ran kcmshell6 and opened KDE's whole Notifications
settings under the teacher's account. Reproduced in the lab.

Plasma draws that button without consulting the Kiosk policy, but
kcmshell6 and System Settings do: every settings module Debian 13's
Plasma 6.3 installs (90) is now refused in the classroom's immutable
kdeglobals, so the same click shows only "disabled by the system
administrator". The clock's Configure Digital Clock goes with
plasma/allow_configure_when_locked=false; Configure Audio Devices
disappears on its own; the disabled window's Help button opened KDE Help
Center, which the package now conflicts with (plasma-desktop only
recommends it).

The maintenance terminal runs outside the classroom's configuration and
still opens every module, verified. converged-check fails if any module
on a machine is ever left unrestricted: 126 passed in the lab.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

config/plasma/xdg/kdeglobals

@@ -26,6 +26,12 @@ editable_desktop_icons=false
 editable_bookmarks=false
 movable_toolbars=false
 plasma/plasmashell/unlockedDesktop=false
+# A locked panel still offered "Configure Digital Clock…" on the clock's
+# right-click menu — measured on Plasma 6.3. This is Plasma's own key for
+# "no widget settings while the desktop is locked", and with it that entry
+# is gone. (The clock's "Adjust Date and Time…" stays, and opens a System
+# Settings with nothing in it: every module is restricted below.)
+plasma/allow_configure_when_locked=false
 plasma-desktop/scripting_console=false
 # Nothing in the classroom should offer to file a bug or open a manual.
 action/help_report_bug=false
@@ -47,6 +53,115 @@ action/help_contents=false
 # is not shown doors that will not open.
 [KDE Control Module Restrictions][$i]
 kcm_networkmanagement=false
+#
+# AND EVERY OTHER SETTINGS MODULE. A notification's Configure button —
+# measured on Plasma 6.3, from the "Memory Shortage Avoided" notice the
+# kernel's memory killer raised — runs `kcmshell6 notifications`, which
+# opened KDE's whole notification settings under the teacher's account:
+# every application and system service, with Apply. The notification
+# applet draws that button without asking this group; kcmshell6 and
+# System Settings do ask it, and with the module listed here the same
+# click opens only "The module kcm_notifications is disabled ... by the
+# system administrator". Measured.
+#
+# KDE has no wildcard for this, so the list is every module installed by
+# Debian 13's Plasma 6.3, as found on the lab machine. A teacher has a use
+# for none of them. tools/lab/converged-check fails if a module is ever
+# installed that is not listed here, so a Plasma update cannot quietly
+# reopen a door.
+#
+# The maintenance terminal is untouched: it runs with
+# XDG_CONFIG_DIRS=/etc/xdg, outside this file, so System Settings started
+# from it is the whole of System Settings.
+kcm_about-distro=false
+kcm_access=false
+kcm_activities=false
+kcm_audio_information=false
+kcm_autostart=false
+kcm_baloofile=false
+kcm_block_devices=false
+kcm_bluetooth=false
+kcm_bolt=false
+kcm_clock=false
+kcm_colors=false
+kcm_componentchooser=false
+kcm_cpu=false
+kcm_cursortheme=false
+kcm_desktoppaths=false
+kcm_desktoptheme=false
+kcm_device_automounter=false
+kcm_disks=false
+kcm_edid=false
+kcm_egl=false
+kcm_energyinfo=false
+kcm_feedback=false
+kcm_filetypes=false
+kcm_firewall=false
+kcm_firmware_security=false
+kcm_fontinst=false
+kcm_fonts=false
+kcm_gamecontroller=false
+kcm_glx=false
+kcm_icons=false
+kcm_interrupts=false
+kcm_kded=false
+kcm_keyboard=false
+kcm_keys=false
+kcm_kgamma=false
+kcm_krunner_kill=false
+kcm_krunnersettings=false
+kcm_kscreen=false
+kcm_kwallet5=false
+kcm_kwin_effects=false
+kcm_kwin_scripts=false
+kcm_kwin_virtualdesktops=false
+kcm_kwindecoration=false
+kcm_kwinoptions=false
+kcm_kwinrules=false
+kcm_kwinscreenedges=false
+kcm_kwinsupportinfo=false
+kcm_kwintabbox=false
+kcm_kwintouchscreen=false
+kcm_kwinxwayland=false
+kcm_landingpage=false
+kcm_lookandfeel=false
+kcm_memory=false
+kcm_mouse=false
+kcm_netpref=false
+kcm_network=false
+kcm_nightlight=false
+kcm_notifications=false
+kcm_opencl=false
+kcm_pci=false
+kcm_plasmasearch=false
+kcm_powerdevilprofilesconfig=false
+kcm_proxy=false
+kcm_pulseaudio=false
+kcm_qtquicksettings=false
+kcm_recentFiles=false
+kcm_regionandlang=false
+kcm_samba=false
+kcm_screenlocker=false
+kcm_sddm=false
+kcm_smserver=false
+kcm_solid_actions=false
+kcm_soundtheme=false
+kcm_splashscreen=false
+kcm_style=false
+kcm_tablet=false
+kcm_touchpad=false
+kcm_touchscreen=false
+kcm_usb=false
+kcm_users=false
+kcm_virtualkeyboard=false
+kcm_vulkan=false
+kcm_wallpaper=false
+kcm_wayland=false
+kcm_webshortcuts=false
+kcm_workspace=false
+kcm_xserver=false
+kcmspellchecking=false
+kwincompositing=false
 
 # Not immutable. Marking this group [$i] froze the colour scheme so hard
 # that `classroom-theme light` changed the running session and then lost

docs/kiosk.md

@@ -116,3 +116,45 @@ and nothing needs reinstalling.
 To put the session screen back, remove the D-Bus shadow and the
 `kglobalshortcutsrc` entries; both are package files, so an update will
 restore them, which is the intended direction.
+
+## Settings the teacher must not reach (0.2.6.2)
+
+During testing the kernel's memory killer raised Plasma's *Memory Shortage
+Avoided* notice, and its **Configure** button opened KDE's Notifications
+settings under the teacher's account — every application and system
+service, with Apply. Reproduced in the lab: the button runs
+`kcmshell6 notifications`.
+
+Plasma draws that button on any notification whose application has KDE
+notification settings, without asking the Kiosk policy. What does ask is
+the thing it launches: `kcmshell6` and System Settings refuse a module
+listed under `[KDE Control Module Restrictions]`. KDE has no wildcard for
+that group, so **every settings module Debian 13's Plasma 6.3 installs —
+90, found on the lab machine — is listed**, immutable, in the classroom's
+`kdeglobals`. Measured afterwards:
+
+| Entry point | Before | After |
+| --- | --- | --- |
+| A notification's Configure button | Notifications settings, editable | *The module kcm_notifications is disabled … by the system administrator* |
+| That window's **Help** button | KDE Help Center: menus, man pages, file dialogs | not installed (`Conflicts: khelpcenter`; plasma-desktop only recommends it) |
+| Volume: right-click | *Configure Audio Devices…* | entry gone — the applet asks the policy |
+| Clock: right-click | *Adjust Date and Time…*, *Configure Digital Clock…* | *Configure* gone (`plasma/allow_configure_when_locked=false`); *Adjust* opens a System Settings with nothing in it |
+| Bell, empty panel: right-click | no menu | no menu |
+| Network | already refused (0.2.4) | unchanged |
+
+The button itself still shows on such a notification, and still opens the
+small "disabled" window: hiding it would mean replacing Plasma's
+notification applet, which is exactly what this appliance does not do.
+Notifications themselves are untouched — Parent Call, the room's
+messages, Wonder Ink's "Sent to the printer" all still appear.
+
+**The maintenance route is unaffected.** `classroom-admin-terminal` starts
+Konsole with `XDG_CONFIG_DIRS=/etc/xdg`, outside this file, so anything a
+technician starts from it — `systemsettings`, `kcmshell6 kcm_notifications`
+— is the whole of it. Verified in the lab: the same module refused to the
+teacher opened fully, editable, from the maintenance terminal.
+
+`tools/lab/converged-check` fails if any settings module on the machine is
+not refused in the classroom's cascade, so a Plasma update that adds one
+cannot quietly reopen this; and it checks the maintenance cascade still
+refuses nothing.

packaging/debian/control.template

@@ -6,7 +6,7 @@ Architecture: amd64
 Maintainer: Ekklesia
 Depends: pkexec, polkit-kde-agent-1, plasma-desktop, plasma-workspace, kwin-wayland, plasma-nm, plasma-pa, plasma-widgets-addons, konsole, sddm, dbus-user-session, xwayland, fonts-dejavu, fonts-noto, network-manager, pipewire, pipewire-audio, wireplumber, pulseaudio-utils, cups, cups-client, cups-filters, foomatic-db-compressed-ppds, python3-gi, python3-gi-cairo, gir1.2-gtk-3.0, gir1.2-gtklayershell-0.1, libnotify-bin, curl, gnupg, ca-certificates, python3-paho-mqtt, python3-pyqt6.qtwebengine, python3-pyqt6, libreoffice-impress, libreoffice-core, poppler-utils, fonts-liberation, fonts-liberation-sans-narrow, fonts-croscore, fonts-crosextra-carlito, fonts-crosextra-caladea, fonts-urw-base35, fonts-roboto, fonts-open-sans, fonts-lato, fonts-montserrat, fonts-noto-extra
 Recommends: vlc
-Conflicts: plasma-welcome, plasma-discover, kdeconnect, kup-backup
+Conflicts: plasma-welcome, plasma-discover, kdeconnect, kup-backup, khelpcenter
 Description: Ekklesia managed classroom environment
  A classroom appliance built on Debian's own Plasma desktop. The room's
  panel, window behaviour, notifications, palette and lockdown are
@@ -61,3 +61,9 @@ Description: Ekklesia managed classroom environment
  The Conflicts line is deliberate. A welcome tour, a software centre and
  a phone pairing daemon are all things plasma-desktop recommends and a
  room a teacher walks into should not have.
+ .
+ khelpcenter is there for the same reason, found the hard way: a
+ settings window's Help button opens it directly, whatever the Kiosk
+ restrictions say, and it is a browser of the machine's manual pages with
+ file dialogs of its own. plasma-desktop only recommends it, and nothing
+ else installed needs it.

tests/test-deployment-support.sh

@@ -197,6 +197,16 @@ for restriction in ("run_command=false", "shell_access=false",
                     "action/lock_screen=false",
                     "plasma/plasmashell/unlockedDesktop=false"):
     check(f"{restriction}", restriction in restrictions)
+check("a notification's Configure button opens nothing",
+      "kcm_notifications=false" in restrictions)
+check("and neither does any other settings module a teacher might reach",
+      all(f"{m}=false" in restrictions for m in (
+          "kcm_pulseaudio", "kcm_clock", "kcm_kscreen", "kcm_users",
+          "kcm_sddm", "kcm_keys", "kcm_bluetooth", "kcm_powerdevilprofilesconfig")))
+check("a locked panel offers no widget settings",
+      "plasma/allow_configure_when_locked=false" in restrictions)
+check("and the help center a settings window's Help button opens is not installed",
+      "khelpcenter" in re.search(r"^Conflicts: (.*)$", control, re.MULTILINE).group(1))
 check("the restrictions are immutable", "[KDE Action Restrictions][$i]" in restrictions)
 
 print()

tools/lab/converged-check

@@ -370,6 +370,26 @@ check "device.conf carries the setting" 1 \
     "$(in_lab 'grep -c "^WONDERINK_ENABLED=" /etc/ekklesia-classroom/device.conf || true')"
 check "and it defaults to on" true \
     "$(in_lab 'sed -n "s/^WONDERINK_ENABLED=//p" /etc/ekklesia-classroom/device.conf')"
+# THE TEACHER CANNOT OPEN SYSTEM SETTINGS, AND THE MAINTENANCE TERMINAL CAN.
+# Every settings module this machine has must be refused in the classroom's
+# cascade — a notification's Configure button opens whichever one it names —
+# and none may be refused in the cascade the maintenance terminal uses.
+teacher_cascade() { in_lab "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Control Module Restrictions' --key $1 --default true 2>/dev/null"; }
+modules=$(in_lab 'find /usr/lib/x86_64-linux-gnu/qt6/plugins -path "*kcms*" -name "*.so" | sed "s#.*/##; s#\.so\$##" | sort')
+open_modules=$(for m in $modules; do [[ "$(teacher_cascade "$m")" == false ]] || echo "$m"; done | tr '\n' ' ')
+check "every settings module is refused to the teacher (unrestricted: ${open_modules:-none})" 0 \
+    "$(wc -w <<< "$open_modules")"
+check "the notification settings the Configure button opens are among them" false \
+    "$(teacher_cascade kcm_notifications)"
+check "but not to the maintenance terminal" true \
+    "$(in_lab "XDG_CONFIG_DIRS=/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Control Module Restrictions' --key kcm_notifications --default true 2>/dev/null")"
+check "which still starts outside the classroom's configuration" 1 \
+    "$(in_lab 'grep -c "XDG_CONFIG_DIRS=/etc/xdg konsole" /usr/local/bin/classroom-admin-terminal || true')"
+check "a locked panel offers no widget settings" false \
+    "$(in_lab "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg kreadconfig6 --file kdeglobals --group 'KDE Action Restrictions' --key plasma/allow_configure_when_locked --default true 2>/dev/null")"
+check "and no help center is installed to open from a Help button" 0 \
+    "$(in_lab 'dpkg -l khelpcenter 2>/dev/null | grep -c "^ii" || true')"
+
 # One line the setting switches, since 0.2.3's one-setting-per-application
 # layout: var WONDERINK = true|false. This asked for the older marker
 # until 0.2.6.1 and so failed on every lab run in between.