Chapter 20. Restricting the session to a single application

You can start the GNOME session in single-application mode, also known as kiosk mode. In this session, GNOME displays only a full-screen window of the application that you have selected.

20.1. Single-application mode

Single-application mode is a modified GNOME session that reconfigures the Mutter window manager into an interactive kiosk. This session locks down certain behavior to make the standard desktop more restrictive. The user can interact only with a single application selected by the administrator.

You can set up single-application mode for several use cases, such as:

  • In the communication, entertainment, or education fields
  • As a self-serve machine
  • As an event manager
  • As a registration point

The gnome-session-kiosk-session package provides the single-application mode configuration and sessions in RHEL 8.

20.2. Enabling single-application mode

This procedure installs and enables single-application mode, which restricts the GNOME session to a single application.

Procedure

  1. Install the gnome-session-kiosk-session package: 

    # yum install gnome-session-kiosk-session

  2. As the user that will open the single-application session, create the /home/user/.local/bin/redhat-kiosk file: 

    [user]$ mkdir -p ~/.local/bin

[user]$ touch ~/.local/bin/redhat-kiosk

  3. Edit the /home/user/.local/bin/redhat-kiosk file and enter the executable name of the application that you want to launch in single-application mode.

    For example, to launch the Firefox browser in single-application mode, enter the following content: 

    #!/bin/sh

while true; do
    firefox --kiosk https://example.org
done

    The while true loop ensures that the application restarts if it terminates for any reason.

  4. Make the file executable: 

    [user]$ chmod +x ~/.local/bin/redhat-kiosk

  5. If you created the file or its containing directories as a different user than the single-application user, such as root, ensure that the file has the correct permissions: 

    # chown -R user:group ~user/.local
  6. At the GNOME login screen, select the Kiosk session from the gear button menu and log in as the single-application user.