Multi-user: Restrict apps per user possible?

Is it possible that the admin user of a SFOS Device can decide which apps another user can use? I want to prepare a SFOS device for my child and I only want her to see only very few fundamental apps. So I would like to be the admin use, my child a user with restricted access to apps.

2 Likes

I have just created an extra account on my dev device. As device owner you can turn off calls and sms, but further no restrictions:


(please correct me if I’m wrong)

1 Like

Update: I tried it and it seems to work fine. So yes, hiding from a casual user that app XY is installed does work. It still won’t prevent the user from opening the app in other ways if he or she knows it’s there.

Original post:
I’ve not tried any of this, but while watching Netflix I thought along the lines of:

As long as your child isn’t a hacker, you needn’t really block the launch of a certain app under all circumstances. (Like, from the command line.) It should be enough that the icon for this app does not show up on the app grid, right?

If so, maybe some more advanced Linux expert might judge the following idea:

The icons are read from the *.desktop files, right? Desktop files are owned root:root and are readable by everyone on the system. (Which is exactly the problem here.)

Could one make the desktop files that should become invisible to the guest user readable by owner and group only, create a new group “adults”, change the owner from root:root to root:adults and add the main user to the group adults?

I mean… we’d be tinkering with crucial system files owned by root, what could possibly go wrong?

As I said, just an idea, I’ve tried none of this. The one thing that comes to my mind as a possible hickup is that the system throws an error when it detects a desktop file (“this should become an icon on the desktop”) but then can’t open it because the current user lacks the permission. Maybe there’s no graceful error handling in place there. Also, it could be that there’s some additional caching that complicates things. And maybe the idea is just not good. But it might be worth investigating.

On my phone at least, the app menu seems to be definied in /home/defaultuser/.config/lipstick/applications.menu - it is a text file with xml-type entries in the order the icons appear. If I edit it with a text editor and reboot the phone, the menu changes according to my edits.

So presumably guest users have their own .config/lipstick/applications.menu, and you could just remove entries you did not want the guest users to see (but I have not tried it!). After all a guest user can rearrange icons and create folders with web links in etc and you would not want that to affect your app menu, so each user must have their own menu surely.

Yes a knowledgable user who knows about Linux hidden .files could add their own entries but it is actually quite difficult to find a way to edit it on the phone with an editor - I used a computer and SFTP.

Update: This didn’t survive a re-boot, the deleted file in /usr/share/applications suddenly re-appeared. (No idea what triggers this. Is it a general Sailfish “feature” or is it because the app in question was an Android app?) Anyway, @nephros seems to have found a more interesting way.

Original post:

And another one: The desktop files are read from both /usr/share/applications (for all users) and from ~/.local/share/applications (user specific). Moving (not copying) the desktop file away from /usr/share/applications to the local path for your user also works. I tested it. It’s even more flexible.
The only thing that might be a problem: I don’t know what happens when we uninstall the app in question and the *.desktop file is not in its place. I didn’t go that far in my test, wanted to keep the app. :slight_smile:
So after scanning through the thread… It’s possible in more than one way. I wonder when somebody makes an app to create child-safe app launchers. :slight_smile:

Another idea:

Copy the .desktop files of apps you want to hide in the restricted users’ directory and set the keys

Hidden=true
NotShowIn=X-MeeGo

which will hide them from the launcher.

Be sure to disable developer mode for the user so they can’t launch Terminal, and set the permissions so the user can’t write to them.

My kids mide app did this before we had multiple users. I haven’t had time to fix it for sailfish 4 though.

It requires patching system files. I used blacklist apps list to force the hiding, the system automatically creates the new xml.

https://openrepos.net/content/anig/kids-mode

Happy for someone to pick it up.