Re: Mandatory Settings

[Malcolm Tredinnick <malcolm commsecure com au>]

On Tue, 2003-12-02 at 05:35, Nick Vahalik wrote:
[...]
> Right now, I have mandatory gconf settings in
> /etc/gconf/gconf.xml.mandatory that make stuff like background/theme/etc
> read-only... for all users.  Is there a way to implement users so that
> they certain users (Managers) can have access to stuff like the address
> bar in Epihany and the regular users can't AND make both of those
> settings read-only to the users they apply to?  Does that sound too
> complicated?  Is there a better way?

Leaving aside the issue of which settings can be controlled by gconf
(since that is pretty application dependent), the "multiple policies"
issue is not too straightforward with gconf. When we have talked about
this in the past (as it pertains to lockdown settings), it has always
seemed to come back to the fact that you need to be running different
gconfd programs for the different policies. So normal users might be
running /usr/bin/gconf* and managers running /opt/managers/bin/gconf*
programs. Then you need to fiddle with permissions or ACLs or something
to prevent users from running the manager version, etc. All a bit
fiddly, but not impossible (the point being that each gconfd will access
its own set of configuration files where you can tweak the policies.

Cheers,
Malcolm