ekklesiaandClaude Opus 5
23dff0b7b4
Ctrl+Alt+Delete opened Plasma's session screen and a teacher hibernated a classroom computer from it. A hibernated room cannot be recovered by anybody standing in front of it, which on a Sunday morning is everybody. logout=false was already set and did not stop it. That restriction governs Plasma's own actions — what plasmashell draws in a menu or an applet. The chord is a KGlobalAccel shortcut registered by ksmserver and it asks D-Bus for the greeter without consulting a Plasma action at all. A restriction on a menu cannot see a key. Three layers, because each one alone has a way past it. The key. kglobalshortcutsrc unbinds every ksmserver session action and PowerDevil's Sleep, Hibernate, PowerDown and PowerOff, each entry marked immutable. It is deliberately not in the xdg directory with the other settings: kglobalacceld opens that file as a SimpleConfig, so it reads one file in the teacher's home and no system directory at all. Measured — with it in the cascade, kreadconfig6 reported the chord unbound while the shortcut server went on answering Ctrl+Alt+Del. classroom-desktop-reset copies the package's copy into place before the shortcut server starts, the same way the panel is copied out of the package at every login. The policy. A polkit rule refuses login1.suspend* and .hibernate* for the classroom user and for nobody else. This is the layer that matters: a key can be unbound and anything reaching logind can still ask. Refusing here rather than masking sleep.target keeps a technician's own account working, and is also what tells Plasma to stop drawing the button — CanSuspend and CanHibernate come back no. Hybrid sleep and suspend-then-hibernate have no action of their own in systemd 257; both are authorised through hibernate, so denying it denies all three. The greeter. Its D-Bus activation is shadowed with /bin/false, the same mechanism already used for the old notification daemon. Layer one removes the caller, this removes the callee. Measured in the lab, from the package, after a reboot: the escape reproduced first with the shadow removed — the greeter really does start — and then refused, exited 1, with it back. The chord reports nothing bound. systemctl suspend as the classroom user is denied. The maintenance chord and the display chord both still answer, by key code, after the shortcut file is replaced wholesale. A root process may still suspend, hibernate, reboot and power off. 182 checks pass across a logout and back. Screen locking stays disabled, the power button still does nothing, and reboot and shut down are not newly denied to anybody. Co-Authored-By: Claude Opus 5 <[email protected]>
23 lines
844 B
Desktop File
23 lines
844 B
Desktop File
[Unit]
|
|
Description=Ekklesia Classroom desktop layout
|
|
Documentation=file:///usr/local/bin/classroom-desktop-reset
|
|
# Before the shell, because the shell owns the file this removes. Editing
|
|
# it underneath a running plasmashell was measured to destroy the panel.
|
|
Before=plasma-plasmashell.service
|
|
# And before the shortcut server, for the same reason: kglobalacceld reads
|
|
# ~/.config/kglobalshortcutsrc once, at start, and this writes it. Both
|
|
# units are wanted by plasma-workspace.target, so without this line they
|
|
# would start together and a room could come up with Ctrl+Alt+Delete still
|
|
# bound to the session screen.
|
|
Before=plasma-kglobalaccel.service
|
|
PartOf=graphical-session.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/classroom-desktop-reset
|
|
RemainAfterExit=yes
|
|
Slice=session.slice
|
|
|
|
[Install]
|
|
WantedBy=plasma-workspace.target
|