X Guest Again

Now that Fedora 8 is approaching completion, I have cut a new version of xguest.rpm

You must be fully updated to the latest rawhide.

To install you can copy down the rpm then execute

yum install --nogpgcheck xguest-1.0.1-2.fc8.noarch.rpm

This should also bring in the latest sabayon code.

This rpm will create an xguest user account with a disabled password.

You can not log into this account by anything but gdm when SELinux is in enforcing mode.

It uses pam_selinux_permit to perform this magic.

This rpm sets up pam_namespace to mount a temporary file system for /tmp, /var/tmp and $HOME.

It also uses sabayon to change the default login. Basically it removes any of the privledged panel apps that a normal login session would run

setroubleshoot, network manager, performance manager. logout.

You should have a full login session, but not be able to talk to any network ports, other then using firefox to talk to the web, other apps like curl , and links will fail. You can not run any setuid applications.

Try it out and tell me what you think.

( 18 comments — Leave a comment )

(Anonymous)

2007-10-24 03:29 am (UTC)

I think you should roll it up in a LiveCD. Easy for places like public libraries to pop in and run. Just a thought ;)

We are thinking about this.

danwalsh

2007-10-25 04:17 pm (UTC)

I have not figured out if we want to add this as a package to Fedora.
I guess if it has enough use.

NetworkManager

matt.domsch.myopenid.com

2007-10-28 03:08 am (UTC)

xguest doesn't have permissions to talk to NM, and NM at this point doesn't auto-connect to any network (or if it did, the xguest user might need to change that). So, while it will start firefox, it can't connect anywhere because NM hasn't brought up a network interface.

Re: NetworkManager

2007-10-29 04:37 pm (UTC)

NetworkManager shouldn't have to talk to any of the xguest user processes.
If for some reason it really can't set up a network connection without communicating with processes owned by the user logged in to the console, there are alternative ways to handle network management.

2007-11-02 06:28 pm (UTC)

This is by design. I didn't want a kiosk user to be able to change the network settings on the machine. You can customize policy to allow this, though.

require {
type xguest_t;
}

#============= xguest_t ==============
networkmanager_dbus_chat(xguest_t)

This will allow the xguest user to run nm-applet to communicate with the NetworkManager. You would need to use sabayon to read nm-applet as a application on startup also.

amberamyro

2008-07-11 01:38 am (UTC)

With Kiosk you can create profiles that are attached to users or groups of users. A profile can define any KDE setting, but usually includes the contents of the desktop, panel, and K Menus, as well as the choice of wallpaper, default fonts, and widget style.

judyzubit

2008-07-10 10:52 pm (UTC)

Here you go: —- ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel network={ ssid=”tangent” key_mgmt=WPA-PSK psk=”network key goes here” priority=2 } network={ ssid=”adlnet” bssid=xx:xx:xx:xx:xx:xx key_mgmt=WPA-PSK psk=”network key goes here” } —- Btw, if you have DHCP set up, it could very long to obtain IP address or it could even never get it (request timeout), however network interface should be brought up (you can see ethX up, but with no IP assigned).

cd change

2007-11-10 08:51 pm (UTC)

Hello! Joris Voorn-From A Deep Place_(GR101CD)-CD-2007
wonderful music recommended to all. What listen you ? please write here :)
buy buy

Persistent Changes?

http://malloc.org/mra/

2007-11-12 07:56 pm (UTC)

xguest works great for me on my freshly installed Fedora 8 system, but all the changes I make to gnome toolbars disappear after each logout. This seems like a good thing by design, but I was wondering how I could adjust the desktop layout?

Adjusting the xguest homedir

2007-11-12 08:41 pm (UTC)

xguest is using a tool called sabayon to setup the home directory.

http://www.gnome.org/projects/sabayon

Every time you login the gnome scrips execute sabayon-apply which reads
/etc/desktop-profiles/users.xml

for a mapping between the login user name and the sabayon zip file

cat /etc/desktop-profiles/users.xml

You will see the xguest.zip file there. If you want to modify the xguest login, you need to install sabayon (gui) tool, and run it. You can then select the xguest.zip file and change the gnome session on login.

Re: Adjusting the xguest homedir

2007-12-14 03:51 pm (UTC)

Is sabayon is working for you in F8?
When i edit xguest some selinux errors appear then it fails on saving...
Any alternatives?

===== BEGIN MILESTONES (/usr/sbin/sabayon) =====
MainThread 2007/12/14 17:38:13.0121 (admin-tool): Creating profiles dialog
MainThread 2007/12/14 17:38:13.2246 (admin-tool): Starting main loop
MainThread 2007/12/14 17:39:28.4953 (admin-tool): Got fatal error: sabayon-session exited with a FATAL ERROR (exit code 1)
MainThread 2007/12/14 17:39:40.6043 (admin-tool): Terminating main loop
MainThread 2007/12/14 17:39:40.6044 (admin-tool): Exiting abnormally; dumping log due to a fatal error
===== END MILESTONES (/usr/sbin/sabayon) =====
===== BEGIN RING BUFFER (/usr/sbin/sabayon) =====
MainThread 2007/12/14 17:38:13.0121 (admin-tool): Creating profiles dialog
MainThread 2007/12/14 17:38:13.2246 (admin-tool): Starting main loop
MainThread 2007/12/14 17:38:15.6926 (USER): Starting to edit profile 'xguest'
MainThread 2007/12/14 17:39:28.4953 (admin-tool): Got fatal error: sabayon-session exited with a FATAL ERROR (exit code 1)
MainThread 2007/12/14 17:39:40.6038 (USER): Finishing editing profile
MainThread 2007/12/14 17:39:40.6043 (admin-tool): Terminating main loop
MainThread 2007/12/14 17:39:40.6044 (admin-tool): Exiting abnormally; dumping log due to a fatal error
===== END RING BUFFER (/usr/sbin/sabayon) =====

This configuration for the debug log can be re-created
by putting the following in /root/sabayon-debug-log.conf
(use ';' to separate domain names):

[debug log]

monytohyk

2008-07-11 06:56 am (UTC)

Each ZIP file contains GNOME configuration files that differ from the system default files, and any additional files that you added on the desktop for users with this profile.