Tightening the Bolts a Little Bit More

While locking down configuration files is quite useful, KDE has a few more tricks to show you. As mentioned above, KDE lets you disable specific actions in KDE applications. Actions include such things as saving files, reporting bugs, and changing toolbar settings. These restrictions are recorded in the share/config/kdeglobals file in a special group called [KDE Action Restrictions].

A list of common actions that can be restricted can be found in the share/config/ui/ui_standards.rc file that is shipped with KDE. Additional application specific actions can be discovered using the dcop (Desktop COmmunication Protocol) scripting tools. For instance, to find all the actions used by KMail, start KMail, and then run the following command:

# dcop kmail qt objects | grep KActionCollection/ | cut -d '/' -f 3
KActionCollection-KAccel
viewDocumentSource

By prefacing these actions with action/ and placing them in a KDEGlobals file, you can enable and disable actions at will. In addition to individual actions, there are also action groups, as listed in Table One.

As an example, if you want to prevent users in your office from changing keyboard shortcuts, seeing "About KDE" dialogs, using shell commands from KDE applications, and overriding icons we would add the following to the /opt/kde/share/config/kdeglobals file:

[KDE Action Restrictions][$i]
action/options_configure_keybinding=false
action/help_about_kde=false
shell_access=false
icon=false

Note the use of [$i] immutable flag to prevent users from overriding these restrictions in their own kdeglobals file.

Locking Down Resource Types

As a final flourish, individual resource types can be restricted. This effectively prevents users from overriding system defaults (such as icons) with their own files in $KDEHOME. Any of the resource directories listed in Table Two can be restricted in this manner.