Lock down chromium policy

diskless.pkr.hcl

@@ -324,12 +324,17 @@ build {
       "install -D -m0755 /tmp/kiosk/kiosk-session /usr/local/bin/kiosk-session",
       "install -D -m0644 /tmp/kiosk/kiosk.service /etc/systemd/system/kiosk.service",
       "install -D -m0644 /tmp/kiosk/weston.ini /etc/xdg/weston/weston.ini",
+      # Chromium managed policy: stops the browser phoning home to Google
+      # (sign-in, variations, optimization-guide, component/auto update, metrics,
+      # safe browsing). EPEL chromium reads /etc/chromium/policies/managed/*.json.
+      # Pairs with the hardening flags in kiosk-session.
+      "install -D -m0644 /tmp/kiosk/chromium-kiosk-policy.json /etc/chromium/policies/managed/10-kiosk-lockdown.json",
       # URL from the var (weston renderer is set via --use-pixman in the unit).
       "install -d -m0755 /etc/kiosk",
       "printf 'KIOSK_URL=%s\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
       "chmod 0644 /etc/kiosk/kiosk.env",
       # Label the new files so they survive into the enforcing erofs.
-      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk",
+      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk /etc/chromium",
       # Boot graphical and start the kiosk (replaces the tty1 getty).
       "systemctl enable kiosk.service",
       "systemctl set-default graphical.target",

docs/TODO.md

@@ -155,6 +155,15 @@ Path to getting here (don't re-discover):
   avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
   if they appear; add a policy module). Admin SSH (the key user) still works for
   debug even if the kiosk fails (it lands at graphical.target either way).
+- **Phone-home lockdown (done 2026-06-17):** Chromium was dialing Google
+  (accounts/variations/optimization-guide/component+auto update/safe browsing —
+  seen in dnsmasq logs). Stopped via a managed policy
+  (`files/kiosk/chromium-kiosk-policy.json` → `/etc/chromium/policies/managed/`)
+  plus hardening flags in `kiosk-session` (`--disable-background-networking`,
+  `--disable-component-update`, `--disable-features=OptimizationHints,...`, etc.).
+  Verify with the dnsmasq query log after a rebuild — only `boot.fleet.lab`
+  (kiosk page) + chrony NTP should remain. NTP is the OS (chrony), not Chromium;
+  optionally point it at the serving host to fully contain egress.
 - **Image size:** Chromium+Mesa add hundreds of MB to the *uncompressed* erofs —
   feeds the "shrink the rootfs" concern (and #7); reconsider whether a lighter
   browser/render path is viable.

files/kiosk/chromium-kiosk-policy.json

@@ -0,0 +1,34 @@
+{
+  "_comment": "Chromium managed policy for the diskless kiosk. Installed to /etc/chromium/policies/managed/. Stops Chromium phoning home to *.google.com / *.googleapis.com (sign-in, variations, optimization guide, component/auto updates, metrics, safe browsing) — none of which a fixed-URL kiosk needs. Pairs with the hardening flags in kiosk-session. Unknown keys are ignored by Chromium, so this is forward/backward safe.",
+
+  "MetricsReportingEnabled": false,
+  "UrlKeyedAnonymizedDataCollectionEnabled": false,
+  "DeviceMetricsReportingEnabled": false,
+
+  "BrowserSignin": 0,
+  "SyncDisabled": true,
+
+  "SafeBrowsingProtectionLevel": 0,
+  "SafeBrowsingExtendedReportingEnabled": false,
+
+  "ComponentUpdatesEnabled": false,
+  "ChromeVariations": 2,
+  "BrowserNetworkTimeQueriesEnabled": false,
+
+  "SearchSuggestEnabled": false,
+  "DefaultSearchProviderEnabled": false,
+  "SpellCheckServiceEnabled": false,
+  "TranslateEnabled": false,
+  "NetworkPredictionOptions": 2,
+
+  "BackgroundModeEnabled": false,
+  "PromotionalTabsEnabled": false,
+  "WelcomePageOnOSUpgradeEnabled": false,
+  "DefaultBrowserSettingEnabled": false,
+
+  "AutofillAddressEnabled": false,
+  "AutofillCreditCardEnabled": false,
+  "PasswordManagerEnabled": false,
+  "ShoppingListEnabled": false,
+  "EnableMediaRouter": false
+}

files/kiosk/kiosk-session

@@ -34,10 +34,24 @@ BROWSER=$(command -v chromium-browser || command -v chromium || true)
     done
     export WAYLAND_DISPLAY="$SOCK"
     while :; do
+        # --disable-* / --no-pings etc.: stop Chromium phoning home to Google
+        # (background networking = variations/field-trials + GCM, component &
+        # auto updates, domain reliability, crash upload, hyperlink pings). The
+        # --disable-features list kills the Optimization Guide hints fetch
+        # (optimizationguide-pa.googleapis.com), Translate, Media Router discovery
+        # and Autofill server calls. The comprehensive lockdown (sign-in, metrics,
+        # safe browsing, search suggest, ...) is the managed policy at
+        # /etc/chromium/policies/managed/10-kiosk-lockdown.json; these flags cover
+        # what policy can't. A fixed-URL kiosk needs none of it.
         "$BROWSER" \
             --kiosk --noerrdialogs --disable-infobars --incognito --no-first-run \
             --disable-session-crashed-bubble --start-maximized \
             --ozone-platform=wayland --disable-gpu \
+            --disable-background-networking --disable-component-update \
+            --disable-sync --disable-domain-reliability --disable-breakpad \
+            --no-pings --no-default-browser-check --metrics-recording-only \
+            --disable-search-engine-collection \
+            --disable-features=Translate,OptimizationHints,OptimizationTargetPrediction,MediaRouter,AutofillServerCommunication,InterestFeedContentSuggestions \
             --user-data-dir=/tmp/kiosk-profile --disk-cache-dir=/tmp/kiosk-cache \
             "$KIOSK_URL" || true
         sleep 2