KDE Kiosk Mode HOWTO

Roland Fehrenbacher


Peter Kruse


Revision History
Revision 1.42002-09-26Revised by: gjf
Revision $Revision: 1.3 $$Date: 2001/08/14 07:44:07 $Revised by: $Author: kruse $

Table of Contents
1. Introduction
1.1. Copyright Information
1.2. Disclaimer
1.3. New Versions
1.4. Credits
1.5. Feedback
2. Motivation
3. Implementation
3.1. Source Code Patches
3.2. Global modifications
3.3. How to set the variable KDE_MODE

1. Introduction

This document describes a by-product of a project, in which a large number of Linux based workstations were provided. Although a kiosk-mode patch exists for KDE 1, this document assumes KDE 2 and the patches apply to KDE version 2.1.1(2).

1.4. Credits

for giving useful tips, and proof-reading this HOWTO

for first-time testing the instructions given here

2. Motivation

The following requirements had to be met:

Note that these are not requirements for the applications that run under KDE. Every application should make sure by itself, that these requirements are met. It is known, that of course many applications have an Open File Dialog, and thus could modify Files under .kde and so make it possible to run arbitrary commands.

The restrictions should only apply when an environment variable KDE_MODE is set to ``restricted''. If it is not set, a normal KDE Desktop should open. It follows, that the user can only run applications that are found in the Application menu. So the administrator must be able to provide the applications. A tool is needed to add, remove and modify entries in the menu.

3. Implementation

3.2. Global modifications

Instead of a dcop call, a program screensaver is executed, which must be found in the PATH. Just create a script called screensaver with the following contents:

dcop kdesktop KScreensaverIface lock
make it executable and put it in $KDEDIR/bin.

Instead of the normal procedure, a program klogout is called, which must be found in the PATH. Create a script called klogout with the following contents:

dcop kdesktop KDesktopIface logout
make it executable and put it in $KDEDIR/bin, where $KDEDIR is the install directory of KDE and $KDEDIR/bin is found in your PATH.

Everything else can be done with normal configuration, that is: (Configuration files can be found in $KDEDIR/share/config) Remove Trash, Templates and Autostart Icons from the desktop and disable Alt+F2 by modifying kdeglobals. Make sure the following entries exist:





[Global Keys]

Execute command=
(it may be .kde instead of .kde2)

disable Desktop menu and tips on start. Make sure the following entry exists in kdesktoprc:
[Mouse Buttons]



You could also login as the special user, and configure it only for him, then the config files are found in $KDEHOME/share/config where $KDEHOME is normally $HOME/.kde.

3.3. How to set the variable KDE_MODE

To answer this, you must understand what happens after you successfully authorized yourself to the system: Depending on your distribution, some scripts are executed, from which one should be modified to set KDE_MODE. There is a script called Xsession under /etc/X11/xdm or /usr/X11R6/lib/xdm, which you could modify, or startkde, that is located under $KDEDIR/bin. Note however, that the variable must be set prior to calling the kde processes.

Since we had the need to make a setup for a big environment (now reaching 300 users) we wrote an application that enables us to administer. It also creates the KDE Menus. It writes a file called .env.sh in a user's home directory, that will be sourced in Xsession. That is what you could do. So you could put in .env.sh of that specific user's home directory:



export KDE_MODE

and add to Xsession, somewhere prior to calling startkde:

if [ -f $HOME/.env.sh ]; then

    . $HOME/.env.sh


We also have two kdedirs that looks like to separate installations of KDE, this was neccessary so "normal" users could still have a full-featured KDE. So we have an original kdedir, and a restricted kdedir, in which we removed entries under share/applnk and set the variable KDEDIR (under KDE 2 the variable KDEDIRS was introduced but KDEDIR is still used). The files under share/applnk make up the menu. Caution, you cannot just remove all files there, because some are needed to initialize KDE.

You also set the Variable KDEDIR in Xsession, after sourcing .env.sh like this:

case "$KDE_MODE" in







export KDEDIR

Replace /usr/local/kde with the install directory of your KDE. The contents of /usr/local/kde/restricted_kdedir looks like:

bin -> ../bin

cgi-bin -> ../cgi-bin

etc -> ../etc

lib -> ../lib


only share is a real directory, every other directory is a symbolic link pointing to original kdedir. /usr/local/kde/restricted_kdedir/share has the following contents:

aclocal -> ../../share/aclocal


apps -> ../../share/apps

autostart -> ../../share/autostart

config -> ../../share/config

doc -> ../../share/doc

fonts -> ../../share/fonts

icons -> ../../share/icons

locale -> ../../share/locale

mimelnk -> ../../share/mimelnk

services -> ../../share/services

servicetypes -> ../../share/servicetypes

sounds -> ../../share/sounds

templates -> ../../share/templates

wallpapers -> ../../share/wallpapers

only applnk is a real directory. As a minimal requirement remove everything except:






under /usr/local/kde/restricted_kdedir/share/applnk