Lock down chromium policy

files/kiosk/chromium-kiosk-policy.json

@@ -0,0 +1,34 @@
+{
+  "_comment": "Chromium managed policy for the diskless kiosk. Installed to /etc/chromium/policies/managed/. Stops Chromium phoning home to *.google.com / *.googleapis.com (sign-in, variations, optimization guide, component/auto updates, metrics, safe browsing) — none of which a fixed-URL kiosk needs. Pairs with the hardening flags in kiosk-session. Unknown keys are ignored by Chromium, so this is forward/backward safe.",
+
+  "MetricsReportingEnabled": false,
+  "UrlKeyedAnonymizedDataCollectionEnabled": false,
+  "DeviceMetricsReportingEnabled": false,
+
+  "BrowserSignin": 0,
+  "SyncDisabled": true,
+
+  "SafeBrowsingProtectionLevel": 0,
+  "SafeBrowsingExtendedReportingEnabled": false,
+
+  "ComponentUpdatesEnabled": false,
+  "ChromeVariations": 2,
+  "BrowserNetworkTimeQueriesEnabled": false,
+
+  "SearchSuggestEnabled": false,
+  "DefaultSearchProviderEnabled": false,
+  "SpellCheckServiceEnabled": false,
+  "TranslateEnabled": false,
+  "NetworkPredictionOptions": 2,
+
+  "BackgroundModeEnabled": false,
+  "PromotionalTabsEnabled": false,
+  "WelcomePageOnOSUpgradeEnabled": false,
+  "DefaultBrowserSettingEnabled": false,
+
+  "AutofillAddressEnabled": false,
+  "AutofillCreditCardEnabled": false,
+  "PasswordManagerEnabled": false,
+  "ShoppingListEnabled": false,
+  "EnableMediaRouter": false
+}

files/kiosk/kiosk-session

@@ -34,10 +34,24 @@ BROWSER=$(command -v chromium-browser || command -v chromium || true)
     done
     export WAYLAND_DISPLAY="$SOCK"
     while :; do
+        # --disable-* / --no-pings etc.: stop Chromium phoning home to Google
+        # (background networking = variations/field-trials + GCM, component &
+        # auto updates, domain reliability, crash upload, hyperlink pings). The
+        # --disable-features list kills the Optimization Guide hints fetch
+        # (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
+        # and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
+        # safe browsing, search suggest, ...) is the managed policy at
+        # /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
+        # what policy can't. A fixed-URL kiosk needs none of it.
         "$BROWSER" \
             --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
             --disable-session-crashed-bubble --start-maximized \
             --ozone-platform=wayland --disable-gpu \
+            --disable-background-networking --disable-component-update \
+            --disable-sync --disable-domain-reliability --disable-breakpad \
+            --no-pings --no-default-browser-check --metrics-recording-only \
+            --disable-search-engine-collection \
+            --disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
             --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
             "$KIOSK_URL" || true
         sleep 2