# Lockdown

What a teacher can and cannot do to the machine, and where each of those
answers lives.

Most of it is KDE's own Kiosk mechanism, in
`/etc/ekklesia-classroom/xdg/kdeglobals`: no shell, no command line, no
lock screen, no editable panel. That file is the first place to look, and
lifting a restriction for maintenance is a one-line edit there followed by
a session restart.

This page is about the part that is *not* in that file: ending or
suspending the session.

## The escape this closed

A teacher pressed **Ctrl+Alt+Delete**, got Plasma's session screen, and
hibernated the classroom computer from it. A hibernated room cannot be
recovered by anybody standing in front of it who does not know where the
power button is, which on a Sunday morning is everybody.

`[KDE Action Restrictions] logout=false` was already set and did not stop
it, and the reason is worth keeping written down: that restriction governs
**Plasma's own actions** — the entries plasmashell draws in a menu or an
applet. Ctrl+Alt+Delete is not one of them. It is a KGlobalAccel shortcut
registered by ksmserver, and pressing it asks D-Bus for the logout greeter
without ever consulting a Plasma action. A restriction on a menu cannot
see a key.

## Three layers

### 1. The key

`/etc/ekklesia-classroom/kglobalshortcutsrc` unbinds every ksmserver
session action and PowerDevil's Sleep, Hibernate, PowerDown and PowerOff
keys, with each entry marked `[$i]` so nothing writes them back.

It is **not** in `/etc/ekklesia-classroom/xdg` with the other settings, and
that is deliberate. `kglobalacceld` opens `kglobalshortcutsrc` as a
KConfig `SimpleConfig`: no cascade, no system directories. Measured — with
the file in the cascade, `kreadconfig6` reported the chord unbound while
the shortcut server went on answering Ctrl+Alt+Del.

So `classroom-desktop-reset` copies the package's copy into
`~/.config/kglobalshortcutsrc` before the session's shortcut server
starts, exactly as it does with the panel. Replacing the whole file costs
nothing: KGlobalAccel puts every shortcut the file does not name back from
each component's own defaults, and the entries the package does name are
immutable, which is what stops it putting those back too.

The room's own chords are registered from their desktop entries and are
unaffected — `converged-check` asserts both of them by key code after the
replace.

### 2. The policy

`/usr/share/polkit-1/rules.d/49-ekklesia-classroom-sleep.rules` refuses
`org.freedesktop.login1.suspend*` and `.hibernate*` **for the `classroom`
user only**.

This is the layer that matters, because a key can be unbound and anything
that reaches logind can still ask. PowerDevil, the greeter, `systemctl
suspend` from the maintenance terminal and any future applet all go
through these actions.

Hybrid sleep and suspend-then-hibernate have no polkit action of their own
in systemd 257: logind authorises both through the hibernate action, so
denying hibernate denies all three. The rule names the other two spellings
anyway, in case a future systemd splits them out.

Refusing here rather than masking `sleep.target` is the point. Masking is
machine-wide and would take suspend away from a technician's account too;
worse, it would be invisible to Plasma, which would go on drawing a
Hibernate button that silently failed. logind asks polkit whether *this
user* may sleep, so a NO is both the enforcement and the supported way to
tell the desktop not to offer it — `CanSuspend()` and `CanHibernate()`
come back `no`.

Nothing here touches power-off or reboot, and nothing here applies to any
other account.

### 3. The greeter

`/usr/local/share/dbus-1/services/org.kde.LogoutPrompt.service` shadows
plasma-workspace's own activation file with `Exec=/bin/false`, the same
mechanism the classroom already uses for the old notification daemon.

Ctrl+Alt+Delete does not draw anything itself; it asks D-Bus to start
`ksmserver-logout-greeter`. Layer 1 removes the caller, this removes the
callee, so any other caller finds nothing to start either.

## What is deliberately still there

- **Screen locking stays disabled.** None of this touches
  `kscreenlockerrc`, and `action/lock_screen=false` is unchanged. A
  classroom must never present a password prompt.
- **The power button still does nothing** on a short press, at both the
  logind and PowerDevil layers, and a long firmware hold still cuts the
  power. That is the only recovery a person standing at a wedged machine
  has.
- **Meta+Ctrl+Alt+Shift+K still opens the maintenance terminal**, and
  Meta+Ctrl+Alt+Shift+D still opens the display dialog.
- **Reboot and shut down are not newly denied to anybody.** A teacher
  asking for either already lands on an administrator's password prompt,
  which they do not have; that behaviour is unchanged. A technician on SSH
  or at the maintenance terminal, with their own account, can still do all
  of it.

## Lifting it

For a technician who needs a classroom machine to suspend — a laptop on a
bench, say — drop a file of the same name into `/etc/polkit-1/rules.d/`,
which polkit reads ahead of the package's copy. Nothing needs rebuilding
and nothing needs reinstalling.

To put the session screen back, remove the D-Bus shadow and the
`kglobalshortcutsrc` entries; both are package files, so an update will
restore them, which is the intended direction.

## Settings the teacher must not reach (0.2.6.2)

During testing the kernel's memory killer raised Plasma's *Memory Shortage
Avoided* notice, and its **Configure** button opened KDE's Notifications
settings under the teacher's account — every application and system
service, with Apply. Reproduced in the lab: the button runs
`kcmshell6 notifications`.

Plasma draws that button on any notification whose application has KDE
notification settings, without asking the Kiosk policy. What does ask is
the thing it launches: `kcmshell6` and System Settings refuse a module
listed under `[KDE Control Module Restrictions]`. KDE has no wildcard for
that group, so **every settings module Debian 13's Plasma 6.3 installs —
90, found on the lab machine — is listed**, immutable, in the classroom's
`kdeglobals`. Measured afterwards:

| Entry point | Before | After |
| --- | --- | --- |
| A notification's Configure button | Notifications settings, editable | *The module kcm_notifications is disabled … by the system administrator* |
| That window's **Help** button | KDE Help Center: menus, man pages, file dialogs | not installed (`Conflicts: khelpcenter`; plasma-desktop only recommends it) |
| Volume: right-click | *Configure Audio Devices…* | entry gone — the applet asks the policy |
| Clock: right-click | *Adjust Date and Time…*, *Configure Digital Clock…* | *Configure* gone (`plasma/allow_configure_when_locked=false`); *Adjust* opens a System Settings with nothing in it |
| Bell, empty panel: right-click | no menu | no menu |
| Network | already refused (0.2.4) | unchanged |

The button itself still shows on such a notification, and still opens the
small "disabled" window: hiding it would mean replacing Plasma's
notification applet, which is exactly what this appliance does not do.
Notifications themselves are untouched — Parent Call, the room's
messages, Wonder Ink's "Sent to the printer" all still appear.

**The maintenance route is unaffected.** `classroom-admin-terminal` starts
Konsole with `XDG_CONFIG_DIRS=/etc/xdg`, outside this file, so anything a
technician starts from it — `systemsettings`, `kcmshell6 kcm_notifications`
— is the whole of it. Verified in the lab: the same module refused to the
teacher opened fully, editable, from the maintenance terminal.

`tools/lab/converged-check` fails if any settings module on the machine is
not refused in the classroom's cascade, so a Plasma update that adds one
cannot quietly reopen this; and it checks the maintenance cascade still
refuses nothing.