Kiosk Keys

This article contains a listing of known keys that can be used with Kiosk and what they do. How to actually use these keys and other capabilities of Kiosk such as URL restrictions, creating assigning profiles, etc. is covered in the Introduction to Kiosk article.

Which configuration file to put these entries in depends on whether you wish to make them global to all applications or specific to one application. To make the restrictions valid for all applications, put them in kdeglobals. To enable a restriction for a specific applications place them in the application-specific configuration, e.g. konquerorrc for Konqueror.

Application Action Restrictions

These keys disable actions that are commonly found in KDE applications. To use these actions, create a section in kdeglobals that looks like this:

[KDE Action Restrictions][$i]
action/file_open_recentFileOpen Recent File
action/file_save_asFileSave As
action/file_print_previewFilePrint Preview
action/file_mailFileEmail File
action/edit_select_allEditSelect All
action/edit_find_nextEditFind Next
action/edit_find_lastEditFind last
action/view_actual_sizeView100% Zoom
action/view_fit_to_pageViewFit To Page (zooming)
action/view_fit_to_widthViewFit To Width (zooming)
action/view_fit_to_heightViewFit To Height (zooming)
action/view_zoom_inViewZoom In
action/view_zoom_outViewZoom Out
action/go_gotoGoGo To…
action/go_goto_pageGoGo To Page…
action/go_goto_lineGoGo To Line…
action/go_firstGoGo To Start
action/go_lastGoGo To End
action/bookmarksBookmarksAlso disables action/bookmark_add and action/bookmark_edit
action/bookmark_addBookmarksAdd Bookmark
action/bookmark_editBookmarksEdit Bookmarks
action/tools_spellingToolsCheck Spelling
action/options_show_menubarSettingsShow/hide Menubar
action/options_show_toolbarSettingsShow/hide Toolbar, will also disable the “Toolbars” submenu if present
action/options_show_statusbarSettingsShow/hide statusbar
action/options_save_SettingsSettingsSave Settings
action/options_configureSettingsConfigure application
action/options_configure_keybindingSettingsConfigure Shortcuts
action/options_configure_toolbarsSettingsConfigure Toolbars
action/options_configure_notificationsSettingsConfigure Notifications
action/fullscreenSettingsEnter full screen mode
action/helpHelpNot yet fully implemented
action/help_contentsHelpApplication handbook
action/help_whats_thisHelpGo into “what’s this” mode
action/help_report_bugHelpReport a bug
action/help_about_appHelpShow about application dialog
action/help_about_kdeHelpShow about KDE dialog


By marking the kcalcrc config file as immutable, the “Configure” button will not be shown.

File Manager

action/editfiletypeEdit associated applications
action/propertiesFile properties
action/openwithOpen file with action
action/openintabOpen link in a new tab
action/kdesktop_rmbRMB menu, see note below

Show preview thumbnails in icons, though it leaves the actual setting untouched. To disable previews (as opposed to simply disabling the user to change the setting) you also need to add the following lines to konqiconviewrc:

acton/sharefileDisables file sharing from the UI, but you may also want to disable filesharing altogether.
action/sendURLSend Link Address
action/sendPageSend File
action/devnewCreate New -> Device
action/incIconSizeIncrease icon size
action/decIconSizeDecrease icon size
action/goEntire go menu
action/configdesktopConfigure desktop in RMB menu, see also Control Module Restrictions
action/executeshellcommandIn Konqueror Tools menu, see also shell_access

Disables the option to toggle showing hidden files, the actual setting remains unaffected. To disable showing hidden files, add the following lines to konqiconviewrc:



These keys can appear in kdeglobals, konsolepartrc or konsolerc.
action/konsole_rmbContext menus
action/settingsDisable the entire settings menu
action/show_menubarShow/hide the menubar
action/show_toolbarShow/hide the toolbar
action/scrollbarShow/hide the scrollbar
action/bellConfigure bell actions
action/fontConfigure font
action/keyboardSet keyboard type
action/schemaSelect the schema to use
action/sizeSet the terminal size
action/historyConfigure history
action/save_defaultSave settings as defaults
action/save_sessions_profileSave sessions profile
action/send_signalSend a signal to the current terminal
action/bookmarksBookmarks menu
action/add_bookmarkAdd a bookmark
action/edit_bookmarksEdit bookmarks
action/clear_terminalClear the current terminal
action/reset_clear_terminalClear and reset the current terminal
action/find_historyFind in history
action/find_nextFind next item in history
action/find_previousFind previous item in history
action/save_historySave history to disk
action/clear_historyClear history of current terminal
action/clear_all_historiesClear histories of all terminals
action/detach_sessionDetach current tab
action/rename_sessionRename current session
action/zmodem_uploadZModem uploading
action/monitor_activityMonitor current terminal for activity
action/monitor_silenceMonitor current terminal for silence
action/send_input_to_all_sessionsReplicate input to all sessions
action/close_sessionClose current terminal session
action/new_sessionCreate a new terminal session
action/activate_menuActivate menubar
action/list_sessionsSession list menu
action/move_session_leftShift tab to the left
action/move_session_rightShift tab to the right
action/previous_sessionGo to tab to the left
action/next_sessionGo to tab to the right
action/switch_to_session_#Go to tab numbered #, where # is a number between 1 and 12 inclusive.
action/bigger_fontIncrease font size
action/smaller_fontDecrease font size
action/toggle_bidiTurn bidirectional text support on or off


action/kwin_rmbContext menus on window titlebar and frame


Locking down the entire config with [$i] will cause everything to be immutable. Locking a Containment group will render that one group of widgets to be immutable, and locking a widget itself will cause it to not be movable as well as otherwise locked.

In addition, the following resource restrictions are available:

plasma/allow_configure_when_locked (since Plasma 4.4): Whether widgets and containments can be configured when immutable / locked. The default is true as a convenience to users.

plasma/containment_actions (since KDE Frameworks 5.49): Whether or not to allow Plasma mouse actions on desktop and panels (most notably context menus, but also mouse wheel to switch virtual desktops, etc.)

plasma/plasmashell/unlockedDesktop (since Plasma 5.0): Whether to allow widgets in Plasma to be unlocked; when false, the following restrictions apply:

  • Widgets cannot be unlocked
  • Favorites and applications in the application launchers cannot be added, removed, rearranged, or otherwise altered (since Plasma 5.7)
  • Application launchers in the task manager cannot be added or removed (since Plasma 5.8)

plasma-desktop/scripting_console (since Plasma 4.4): Whether the plasma desktop scripting console is accessible or not.

plasma-desktop/add_activities (>= 4.7.1): Whether the user may add new activities or not.


Plasma offers to download new widgets, wallpapers, scripts, and other 3rd party add-ons from the KDE Store using the KNewStuff (aka “Get Hot New Stuff”) framework. The buttons are typically labeled “Get New …” with a “star” icon. If this feature is undesirable it can be disabled using the following key:

ghns (since KDE Frameworks 5.27): Whether the Download Dialog of Get Hot New Stuff can be accessed


Application .desktop files can have an additional field X-KDE-AuthorizeAction.

If this field is present the .desktop file is only considered valid if the action(s) mentioned in this field has been authorized. If multiple actions are listed they should be separated by commas (',').

If the .desktop file of an application lists one or more actions this way and the user has no authorization for even one of these actions then the application will not appear in the KDE menu, will not allow execution via that .desktop file and will not be used by KDE for opening files of associated mimetypes.

File Dialog {#file_dialog}

These keys disable actions that are found in the KDE file dialog. To use them, create a section in `kdeglobals that looks like this:

[KDE Action Restrictions][$i]
action/homeGo to home directory
action/upGo to parent directory
action/backGo to previous directory
action/forwardGo to next directory
action/reloadReload directory
action/mkdirCreate new directory
action/toggleSpeedbarShow/hide sidebar
action/sorting menuSorting options
action/short viewSelect short view
action/detailed viewSelect detailed view
action/show hiddenShow/hide hidden files
action/previewShow/hide preview
action/separate dirsShow/hide separate directories


There are several keys that restrict various aspects of the KDE print dialog and printing system. To use them, create a configuration section like this:

[KDE Resource Restrictions][$i]
print/<resource key>=false

Note how each of the printing keys start with print in the configuration file.

print/copies: Disables the panel that allows users to make more than one copy.

print/dialog: Disables the complete print dialog. Selecting the print option will immediately print the selected document using default settings. Make sure that a system-wide default printer has been selected. No application-specific settings are honored when this restriction is activated.

print/options: Disables the button to select additional print options.

print/properties: Disables the button to change printer properties or to add a new printer.

print/selection: Disables the options that allows selecting a (pseudo) printer or change any of the printer properties. Make sure that a proper default printer has been selected before disabling this option. Disabling this option also disables print/system, print/options and print/properties.

print/system: Disables the option to select the printing system backend, e.g. CUPS. It is recommended to disable this option once the correct printing system has been configured.

Resource Restrictions

KDE applications can take advantage of many types of resources such as configuration data, caches, plugin registries, etc. These are loaded from both system-wide as well as from per-user locations on disk. It is possible to restrict the use of the per-user resources directories, preventing users from adding to or altering existing shared resources.

This is accomplished by creating a section like this in a configuration file:

[KDE Resource Restrictions][$i]
<resource key>=false

The following resources can be used as keys and controlled in this manner:

alln/aAll resources listed in this table
autostartshare/autostartApps to start on login
datashare/appApplication data
data_<appname>share/appsApplication data for the application named
htmlshare/doc/HTMLHTML files
configshare/configApplication configurations
xdgdata-appsshare/applicationApplication .desktop files
soundshare/soundSound files
localeshare/localeLocalization data
servicesshare/servicesProtocols, plugins, kparts, control panels, etc. registry
servicetypesshare/servicestypesPlugin definitions, referenced in services registry entries
mimeshare/mimelnkMimetype definitions
wallpapershare/wallpapersDesktop wallpaper images
templatesshare/templatesDocument templates
exebinExecutable files


In kdeglobals in the [KDE Action Restrictions] group:

opengl_screensavers: Defines whether OpenGL screensavers are allowed to be used.

manipulatescreen_screensavers: Defines whether screensavers that manipulate an image of the screen (e.g. moving chunks of the screen around) are allowed to be used.

Automatic Log-out

In kscreensaverrc:


The timeout is the time in seconds that the user must be idle for before the logout process is automatically started. Be careful with this capability as it can lead to data loss if the user has unsaved files open.

Session Capability Restrictions

These keys apply to various capabilities associated with a desktop session and are not application specific. To use them, create a section in `kdeglobals that looks like this:

[KDE Action Restrictions][$i]

custom_config: Whether the --config command line option should be honored. The --config command line option can be used to circumvent locked-down configuration files.

editable_desktop_icons: Defines whether icons on the desktop can be moved around. In order to prevent adding, removing, or renaming icons, you should set the desktop folder read-only. (since Plasma 5.14)

lineedit_text_completion: Defines whether input lines should have the potential to remember any previously entered data and make suggestions based on this when typing. When a single account is shared by multiple people you may wish to disable this out of privacy concerns.

lineedit_reveal_password: Defines whether password input fields may have a button that allows showing the password in plain text. (since KDE Frameworks 5.30 and/or Plasma 5.9)

action/lock_screen: Defines whether the user will be able to lock the screen.

logout: Defines whether the user will be able to logout from the Plasma session.

movable_toolbars: define whether toolbars may be moved around by the user. See also action/options_show_toolbar.

run_command: Defines whether the “Run Command” (Alt-F2) option is available.

Note: To also disable desktop context menu run command action/run_command is required at [KDE Action Restrictions]

run_desktop_files: Defines whether users may execute desktop files that are not part of the default desktop, KDE menu, registered services and autostarting services.

  • The default desktop includes the files under .local/share/kdesktop/Desktop but not the files under $HOME/Desktop.
  • The KDE menu includes all files under $KDEDIR/share/applnk and $XDGDIR/applications
  • Registered services includes all files under `$KDEDIR/share/services
  • Autostarting services include all files under $KDEDIR/share/autostart but **not** the files under $KDEHOME/Autostart

shell_access: Whether a shell suitable for entering random commands may be started. This also determines whether the “Run Command” option (Alt-F2) can be used to run shell-commands and arbitrary executables. Likewise, executables placed in the user’s Autostart folder will no longer be executed. Applications can still be autostarted by placing .desktop files in the .local/share/autostart directory. See alsorun_desktop_files`.

You probably also want to activate the following resource restrictions:

  • “appdata_kdesktop” - To restrict the default desktop.
  • “apps” - To restrict the KDE menu.
  • “xdgdata-apps” - To restrict the KDE menu.
  • “services” - To restrict registered services.
  • “autostart” - To restrict autostarting services.

Otherwise users can still execute .desktop files by placing them in e.g. `.local/share/kdesktop/Desktop

skip_drm: Defines if the user may omit DRM checking. At the time of writing, this primarily applies to document formats with a DRM mechanism (e.g. PDF).

action/start_new_session: Defines whether the user may start a new session.

action/switch_user: Defines whether user switching is allowed.


Whilst telemetry is disabled by default, a user can choose to enable it inside applications.

To force global disabling set