Re: bluesky admin requests

[Havoc Pennington <hp redhat com>]

On Wed, Aug 20, 2003 at 04:50:33PM -0400, David T Hollis wrote:
> You raise a couple of points that get my brain working a bit.  One thing 
> that would be really cool (and maybe it's possible with GConf already, 
> but I doubt it) would be a way to enforce administrative policies.  Hate 
> to bring up the Redmond folks, but System Policies/Group Policies 
> whatever you want to call them provide this to provide a way to 
> assign/enforce system settings.  My understanding of the under-the-hood 
> process is that when a call is made for a registry value such as getting 
> the desktop background, the first location is Group Policy 'tree' in the 
> registry.  If the value is not defined, than the current user's setting 
> is checked.  With this design, even if the user went and hand-edited 
> their registry setting, it isn't going to make a difference because the 
> policies are checked first. 

Definitely agree. We already have this for just enforcing a setting,
such as desktop background. For GNOME 2.4, George is fixing a lot of
bugs so that apps will behave properly when a setting is locked down;
GNOME 2.2 can freak out if certain things are locked.

> It would be great if GConf could support this ability so that admins are 
> not editing the package schemas under /etc/gconf/schemas which naturally 
> get overwritten on upgrades.  Some way to provide administrative 
> policies in a different location that get consulted before reading the 
> users specific value would be a great way to enable some real desktop 
> administration.

Yikes, you aren't supposed to edit the .schemas files. ;-) 

Instead, if you set a value in the /etc/gconf/gconf.xml.mandatory
database, it will always be preferred over values the user sets.  See
the gnome admin guide at www.gnome.org/learn/ or the gconf info at
www.gnome.org/projects/gconf/

GNOME 2.4 should be significantly more graceful about handling the
locked-down settings (disabling the UI for the locked settings 
for example, and not popping up error dialogs about them).

Havoc