/usr/share/help/C/system-admin-guide/lockdown-command-line.page is in gnome-user-docs 3.28.1-0ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 | <page xmlns="http://projectmallard.org/1.0/"
xmlns:its="http://www.w3.org/2005/11/its"
type="topic" style="task"
id="lockdown-command-line">
<info>
<link type="guide" xref="software#management" />
<revision pkgversion="3.12" date="2014-06-18" status="review" />
<credit type="author copyright">
<name>Petr Kovar</name>
<email>pknbe@volny.cz</email>
<years>2014</years>
</credit>
<credit type="author copyright">
<name>Ekaterina Gerasimova</name>
<email>kittykat3756@gmail.com</email>
<years>2014</years>
</credit>
<include href="legal.xml" xmlns="http://www.w3.org/2001/XInclude"/>
<desc>Prevent users from accessing the command-line.</desc>
</info>
<title>Disable command-line access</title>
<p>You can prevent users from being able to access the command-line through
virtual terminals and terminal applications by following the steps described
below.</p>
<list>
<item>
<p>Prevent users from accessing the
<keyseq><key>Alt</key><key>F2</key></keyseq> command prompt.</p>
</item>
<item>
<p>Disable dropping to a virtual terminal (VT).</p>
</item>
<item>
<p>Remove <app>Terminal</app> and all other terminal applications from
the <gui>Activities</gui> overview in GNOME Shell. You will also need to
prevent the user from installing a new terminal application.</p>
<comment>
<cite>Petr Kovar</cite>
<p>We have yet to cover removing a menu item in this guide. We don’t
want system admins having to modify .desktop files as those could be
overwritten on system update.</p>
</comment>
</item>
</list>
<section id="command-prompt">
<title>Disable the command prompt</title>
<steps>
<include href="dconf-snippets.xml"
xpointer="xpointer(/*/*[@xml:id='dconf-profile-user'])"
xmlns="http://www.w3.org/2001/XInclude"/>
<item>
<p>Create a <sys>local</sys> database for machine-wide settings in
<file>/etc/dconf/db/local.d/00-lockdown</file>:</p>
<code># Specify the dconf path
[org/gnome/desktop/lockdown]
# Disable the command prompt
disable-command-line=true</code>
</item>
<item>
<p>Override the user’s setting and prevent the user from changing it in
<file>/etc/dconf/db/local.d/locks/lockdown</file>:</p>
<code># List the keys used to configure lockdown
/org/gnome/desktop/lockdown/disable-command-line</code>
</item>
<include href="dconf-snippets.xml"
xpointer="xpointer(/*/*[@xml:id='dconf-update'])"
xmlns="http://www.w3.org/2001/XInclude"/>
<include href="dconf-snippets.xml"
xpointer="xpointer(/*/*[@xml:id='dconf-logoutin'])"
xmlns="http://www.w3.org/2001/XInclude"/>
</steps>
</section>
<section id="virtual-terminal">
<title>Disable dropping to a virtual terminal</title>
<p>Users can normally use the
<keyseq><key>Ctrl</key><key>Alt</key><key><var>function
key</var></key></keyseq> shortcuts (for example,
<keyseq><key>Ctrl</key><key>Alt</key><key>F2</key></keyseq>) to switch from
the GNOME desktop to a virtual terminal.</p>
<p>If the computer is running the <em>X Window System</em>, you can disable
access to all virtual terminals by adding a <code>DontVTSwitch</code> option
to the <code>Serverflags</code> section in the
<file>/etc/X11/xorg.conf.d</file> file.</p>
<steps>
<item>
<p>Create or edit an X configuration file in
<file>/etc/X11/xorg.conf.d</file>:</p>
<code>Section "Serverflags"
Option "DontVTSwitch" "yes"
EndSection</code>
</item>
<item>
<p>Restart GDM for the change to take effect.</p>
</item>
</steps>
</section>
<!-- TODO: add section for removing applications from the Activities overview. -->
</page>
|