Ask for password when starting dconf

Question

I'd like to have a password request whenever someone tries to start the dconf Editor. Is there any possilility to achieve this?

To prevent others from messing around easily when I'm logged in... but I found out it's quite useless... — s3lph, Jan 13 '14 at 20:24

score 1 · Answer 1 · answered Oct 26 '13 at 13:35

One possibility is to patch the code to make it show a password dialogue. Or to write a wrapper and place it in, say, /usr/local/bin/dconf-editor. But all that is security theatre only unless you manage ~/.config/dconf/ differently. By default, it is owned by the user who can thus modify it as she likes.

If you want to prevent certain changes in the configuration to be made, you might want to have a look at Pessulus (https://wiki.gnome.org/Pessulus). But you would have to put in a lot of work as it has been deprecated long time ago.

score 0 · Accepted Answer · answered Oct 26 '13 at 14:01

0

First edit /usr/share/applications/dconf-editor.desktop file as follow:

From terminal open dconf-editor.desktop file using the following command:
```
sudo -i gedit /usr/share/applications/dconf-editor.desktop
```

Find the following line:

Exec=dconf-editor

and replace it with:

Exec=pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY dconf-editor

Save the file and close it.

Second, change the permission of /usr/bin/dconf-editor file to be executable only by the root. To do this, from terminal run the following command:

sudo chmod go-x /usr/bin/dconf-editor

answered Oct 26 '13 at 14:01

Radu Rădeanu

169,590

1

Using dconf editor as root won't work, because it edits the dconf settings of the user it's beeing runned by. – s3lph Oct 27 '13 at 10:47
@the_Seppi It will work like a charm. Just try it. Would you like to make a screen cast to show you? – Radu Rădeanu Oct 27 '13 at 10:56
Now dconf editor isn't starting at all. How can i undo chmod go-x? – s3lph Oct 27 '13 at 10:57
@the_Seppi You probably did something wrong. – Radu Rădeanu Oct 27 '13 at 10:59
I copy-pasted every command/line-to-be-written. What can I do wrong? – s3lph Oct 27 '13 at 11:00
@the_Seppi So, now, if you run gksu dconf-editor from terminal, dconf-editor will not start? – Radu Rădeanu Oct 27 '13 at 11:10

score 0 · Answer 3 · answered Jan 13 '14 at 20:28

You should just remove the dconf editor package:

sudo apt-get remove dconf-editor

so anyone that wants to modify your dconf should know:

Your sudo password or
How to use dconf command line

There's another option, but should not be used if you don't know what you are doing, which is literally put your ~/.conf/dconf directory as read-only.

Ask for password when starting dconf

3 Answers3