Lock down chromium policy

files/kiosk/kiosk-session

@@ -34,10 +34,24 @@ BROWSER=$(command -v chromium-browser || command -v chromium || true)
     done
     export WAYLAND_DISPLAY="$SOCK"
     while :; do
+        # --disable-* / --no-pings etc.: stop Chromium phoning home to Google
+        # (background networking = variations/field-trials + GCM, component &
+        # auto updates, domain reliability, crash upload, hyperlink pings). The
+        # --disable-features list kills the Optimization Guide hints fetch
+        # (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
+        # and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
+        # safe browsing, search suggest, ...) is the managed policy at
+        # /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
+        # what policy can't. A fixed-URL kiosk needs none of it.
         "$BROWSER" \
             --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
             --disable-session-crashed-bubble --start-maximized \
             --ozone-platform=wayland --disable-gpu \
+            --disable-background-networking --disable-component-update \
+            --disable-sync --disable-domain-reliability --disable-breakpad \
+            --no-pings --no-default-browser-check --metrics-recording-only \
+            --disable-search-engine-collection \
+            --disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
             --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
             "$KIOSK_URL" || true
         sleep 2