On Thu, 2009-11-19 at 11:45 +0000, Richard Hughes wrote:
Surely if you're deploying a workstation (1000s of workstations?)
you
would just ship an extra package that set the PolicyKit policies
according to the domain policy, so if I was a school, I would allow
the active users to unplug removable drives, but not detach physical
drives. I would also stop them installing and upgrading (not even give
them the option to enter a root password) and also lock down who can
change the clock. I would also prevent them from installing debuginfo
files and being able to set thier audio system to real-time priority.
FWIW, what I set up for our school's Fedora 11 workstations is here:
http://jdieter.fedorapeople.org/lesbg-polkit-setup-client.spec
There are definitely some ways I could clean it up, but it at least
keeps me from having students installing software (or running updates)
without permission.
Jonathan