ekklesiaandClaude Opus 5
bf7b959893
These are shared computers in rooms full of people, and in a stock Plasma
desktop "use the network" and "read the network's password" are much
closer together than they look.
Measured on Debian 13 with NetworkManager 1.52 and Plasma 6.3:
* org.freedesktop.NetworkManager.settings.modify.own ships as "yes" for
an active session — no prompt, no administrator. It covers any
connection whose connection.permissions names that user, and a Wi-Fi
network added from the desktop is created exactly that way. So a
password a teacher types in is readable by the next person to sit
down.
* the applet offers "Show Network's QR Code" on every saved wireless
connection, and the QR code contains the pre-shared key.
* that action, and the "Configure…" beside it, are contextual actions in
ConnectionItem.qml and do NOT consult
authorizeControlModule("kcm_networkmanagement"). The Kiosk key gates
the toolbar button only. Hiding buttons was never going to be the
answer.
Every one of those paths ends at NetworkManager's GetSecrets, so that is
where this is answered. A polkit rule refuses settings.modify.own,
settings.modify.system, both wifi.share actions and the machine-wide
settings, for the classroom user by name.
Deliberately NOT refused: network-control, wifi.scan and the
enable/disable actions. None returns a secret, and they are what
connecting and seeing a network are made of. Automatic reconnection does
not go through polkit at all — NetworkManager does it as root — so nothing
here can stop the room coming back on the network after a reboot, which is
the property that matters most on a Sunday.
An administrator's account and root are untouched, and the override route
is the same one the sleep rule has.
classroom-wifi is the other half, and it is a requirement rather than a
convenience: it provisions the church Wi-Fi as a SYSTEM connection, with
no connection.permissions, psk-flags=0 and a 0600 root:root file. A
connection the machine owns is one nobody in the room can read. Verified
against real NetworkManager in the lab — the classroom account gets
"Permission denied" on the file, "--" from nmcli and "Insufficient
privileges" from GetSecrets, while autoconnect stays on.
There is deliberately no teacher-facing join dialog. Anything that lets
the room add a connection lets the room own it, and an owned connection is
a readable one; docs/networking.md says so rather than leaving it to be
rediscovered.
The rule is plain JavaScript, so the test evaluates it with polkit's
objects stubbed and asserts both halves: which actions come back NO, and
which are left alone. What it cannot test is the last mile — polkit
resolves a subject through logind and a container has no graphical seat
session, so every check there is denied for reasons unrelated to this
rule. That one is a physical check, and it is written down as one.
Co-Authored-By: Claude Opus 5 <[email protected]>
114 lines
4.7 KiB
Plaintext
114 lines
4.7 KiB
Plaintext
# Ekklesia Classroom session policy.
|
|
#
|
|
# Installed to /etc/xdg/kdeglobals, where it is the bottom of Plasma's
|
|
# configuration cascade. Every group is marked [$i] — immutable — so a
|
|
# teacher, a stray click or a misbehaving application cannot override it
|
|
# from the user's own configuration. This is KDE's own Kiosk mechanism:
|
|
# nothing here is achieved by deleting a binary or hiding a menu entry.
|
|
#
|
|
# Lifting a restriction for maintenance is a one-line edit to this file
|
|
# followed by a session restart, which is what makes the appliance
|
|
# serviceable rather than merely locked.
|
|
|
|
[KDE Action Restrictions][$i]
|
|
# No way to reach a shell, a command line, or an arbitrary program.
|
|
action/kdesktop_rmb=false
|
|
action/kwin_rmb=false
|
|
action/openwith=false
|
|
action/switch_user=false
|
|
action/start_new_session=false
|
|
action/lock_screen=false
|
|
run_command=false
|
|
shell_access=false
|
|
logout=false
|
|
# The desktop and the panel are a fixed part of the appliance.
|
|
editable_desktop_icons=false
|
|
editable_bookmarks=false
|
|
movable_toolbars=false
|
|
plasma/plasmashell/unlockedDesktop=false
|
|
plasma-desktop/scripting_console=false
|
|
# Nothing in the classroom should offer to file a bug or open a manual.
|
|
action/help_report_bug=false
|
|
action/help_about_kde=false
|
|
action/help_contents=false
|
|
|
|
# The network applet reads this one before it draws its own settings
|
|
# button and its "Configure Network Connections…" entry — see
|
|
# main.qml, which calls
|
|
# KAuthorized.authorizeControlModule("kcm_networkmanagement").
|
|
#
|
|
# This is only the first of two layers, and on its own it would be
|
|
# security theatre. The applet ALSO puts "Show Network's QR Code" and
|
|
# "Configure…" on every saved wireless connection as contextual actions,
|
|
# and neither of those consults this key — measured on Plasma 6.3. The QR
|
|
# code contains the pre-shared key. What actually refuses them is the
|
|
# polkit rule in org.ekklesia.classroom.network.rules, which answers at
|
|
# NetworkManager rather than in a menu. This key is here so that a teacher
|
|
# is not shown doors that will not open.
|
|
[KDE Control Module Restrictions][$i]
|
|
kcm_networkmanagement=false
|
|
|
|
# Not immutable. Marking this group [$i] froze the colour scheme so hard
|
|
# that `classroom-theme light` changed the running session and then lost
|
|
# the change at the next start — measured. These are defaults for a room
|
|
# that has no settings application anyway; the lock belongs on the
|
|
# restrictions above, not on the palette.
|
|
[General]
|
|
# Sized for a television, not a desk.
|
|
#
|
|
# Everything Plasma draws is measured in grid units, and a grid unit is
|
|
# the height of this font: the notification card's width, its padding,
|
|
# its icon and its buttons all come from here. There is no setting that
|
|
# makes a notification larger on its own, and the supported lever is this
|
|
# one — which is also the reason it is used rather than a replacement
|
|
# notification plasmoid.
|
|
#
|
|
# Measured at 100% in the lab: Breeze's 10 point gives a card about 350
|
|
# by 110 pixels with title text a volunteer at the back of the room
|
|
# cannot read; 15 point gives about 410 by 145 with a title that carries.
|
|
# The bar does not change, because its height is fixed and the clock
|
|
# sizes itself to it.
|
|
#
|
|
# At 200% the display scale doubles all of it again, so a 4K television
|
|
# gets the same card at twice the size without a second number.
|
|
font=Noto Sans,15,-1,5,50,0,0,0,0,0
|
|
smallestReadableFont=Noto Sans,13,-1,5,50,0,0,0,0,0
|
|
menuFont=Noto Sans,15,-1,5,50,0,0,0,0,0
|
|
toolBarFont=Noto Sans,15,-1,5,50,0,0,0,0,0
|
|
ColorScheme=EkklesiaDark
|
|
AccentColor=79,179,168
|
|
# The teacher's own words are not decoration: keep text rendering plain
|
|
# and readable rather than styled.
|
|
XftAntialias=true
|
|
XftHintStyle=hintslight
|
|
XftSubPixel=rgb
|
|
|
|
[KDE]
|
|
widgetStyle=Breeze
|
|
# One key, marked immutable on its own rather than by freezing the group.
|
|
#
|
|
# This is the name plasmashell reads to decide which layout script builds a
|
|
# panel for a session that has none, so it decides whether the room comes
|
|
# up as the classroom or as stock Plasma. A migrated machine reached this
|
|
# experiment with a user profile that had been through other desktops, and
|
|
# a user's own kdeglobals sits ahead of every system directory in the
|
|
# cascade. Immutable here means no leftover profile, and no stray write by
|
|
# a settings dialog that does not exist in this room anyway, can answer
|
|
# that question differently. The palette below stays writable, because
|
|
# classroom-theme is allowed to change it.
|
|
LookAndFeelPackage[$i]=org.ekklesia.classroom.desktop
|
|
SingleClick=false
|
|
AnimationDurationFactor=0.5
|
|
|
|
[Icons]
|
|
Theme=breeze-dark
|
|
|
|
[KFileDialog Settings][$i]
|
|
Allow Expansion=false
|
|
Automatically select filename extension=true
|
|
Show Bookmarks=false
|
|
Show Full Path=false
|
|
Show Inline Previews=false
|
|
Show Speedbar=false
|
|
Sort directories first=true
|