Re: bluesky admin requests

[David T Hollis <dhollis davehollis com>]

Havoc Pennington wrote:

> On Wed, Aug 20, 2003 at 04:50:33PM -0400, David T Hollis wrote:
>  
>
> > You raise a couple of points that get my brain working a bit.  One thing 
> > that would be really cool (and maybe it's possible with GConf already, 
> > but I doubt it) would be a way to enforce administrative policies.  Hate 
> > to bring up the Redmond folks, but System Policies/Group Policies 
> > whatever you want to call them provide this to provide a way to 
> > assign/enforce system settings.  My understanding of the under-the-hood 
> > process is that when a call is made for a registry value such as getting 
> > the desktop background, the first location is Group Policy 'tree' in the 
> > registry.  If the value is not defined, than the current user's setting 
> > is checked.  With this design, even if the user went and hand-edited 
> > their registry setting, it isn't going to make a difference because the 
> > policies are checked first. 
> >    
>
> Definitely agree. We already have this for just enforcing a setting,
> such as desktop background. For GNOME 2.4, George is fixing a lot of
> bugs so that apps will behave properly when a setting is locked down;
> GNOME 2.2 can freak out if certain things are locked.
>
>  
>
> > It would be great if GConf could support this ability so that admins are 
> > not editing the package schemas under /etc/gconf/schemas which naturally 
> > get overwritten on upgrades.  Some way to provide administrative 
> > policies in a different location that get consulted before reading the 
> > users specific value would be a great way to enable some real desktop 
> > administration.
> >    
>
> Yikes, you aren't supposed to edit the .schemas files. ;-) 
>
> Instead, if you set a value in the /etc/gconf/gconf.xml.mandatory
> database, it will always be preferred over values the user sets.  See
> the gnome admin guide at www.gnome.org/learn/ or the gconf info at
> www.gnome.org/projects/gconf/
>
> GNOME 2.4 should be significantly more graceful about handling the
> locked-down settings (disabling the UI for the locked settings 
> for example, and not popping up error dialogs about them).
>
> Havoc
> _______________________________________________
> gnome-redhat-list mailing list
> gnome-redhat-list gnome org
> http://mail.gnome.org/mailman/listinfo/gnome-redhat-list
>  
Even better!  The support via GConf is there with the 
gconf.xml.mandatory.  I suppose a next step for getting some real 
desktop management would be the ability to generate desktop policies and 
assign based on user or group or some other criteria.  As en example, if 
you have a system acting as a kiosk (say it just lets employees punch in 
and out or something) so you lock it down real nice, now if the admin 
logs on, he's locked down as well!  Or maybe the payroll person needs to 
log on to get the information or gennerate a report or something like 
that, you may want them to have a more relaxed policy setting.  
Certainly not 2.4 stuff, but the kind of stuff that is really helpful in 
the enterprise.

Note - the scenarios are just examples, I know a lot of those are 
'access the data over the network' etc etc type of things....