desktop-control.sh

#!/bin/bash
allowedFilename='allowed.patterns'
closedFilename='closed.names'
touch "$closedFilename"

closeWindowsUnlessAllowed () {
  for wid in `xdotool search --name --onlyvisible --sync .`; do
    name=`xdotool getwindowname $wid`
    isAllowed=false
    while IFS= read -r entry; do
      # echo "entry = $entry"
      if [[ $name == $entry ]]; then
        isAllowed=true
        break
      fi
    done < "$allowedFilename"
    if [ $isAllowed == false ]; then
      if fgrep -q "$name" "$closedFilename"; then
        echo "$name already added"
      else
        echo "$name" >> "$closedFilename"
      fi
      xdotool windowunmap $wid
    fi
  done
}

while true; do
  closeWindowsUnlessAllowed
  sleep 3
done

LinuxDesktopControl.markdown

Desktop Control System for Linux

A system for controlling what can be done within a desktop session, to be used as a parental control system for example.

Goals

• Not just internet filtering (e.g. DansGuardian) but also control over which local applications can be run
• Require root access to disable or reconfigure. (Not yet achieved)
• As simple as possible to set up and maintain

How to

Install the desktop-control.sh script for the target user(s).

Open any windows that should always be allowed.

Run xdotool search --sync --onlyvisible . getwindowname %@ > allowed.patterns

Edit allowed.patterns to taste. Each line will be interpreted as a pattern so *, ?, [, +, @, and ! have special meaning.

Run desktop-control.sh & and do everything that should be allowed. Open permitted apps and exercise them as should be allowed. Do any configuration that should be allowed (e.g. configure a new WiFi connection). The names of any windows that are closed will be added to closed.names. Copy the ones you want to allow into allowed.patterns and edit to taste.

To stop the desktop-control.sh script run killall desktop-control.sh.

How it works

The desktop-control.sh script periodically (every 3 seconds) runs xdotool to get the titles of all windows. The titles of any windows that don't match a regular expression in allowed.patterns are added to closed.names and closed.

TODO

Don't close any windows if allowed.patterns doesn't exist.

Use pam_script to automatically run desktop-control.sh upon login and kill it on logout

Prompt the user before closing the window to allow an admin to override for a specific window and/or add it to the whitelist.

Provide a graphical tool for modifying the whitelist.