Forbid changing home directory

modules/common/services/desktop.nix

@@ -181,7 +181,9 @@ in
             {
               name = "File Manager";
               description = "Organize & Manage Files";
-              path = "${pkgs.pcmanfm}/bin/pcmanfm";
+              path = "${pkgs.pcmanfm}/bin/pcmanfm ${
+                config.users.users.${config.ghaf.users.accounts.user}.home
+              }/Shares";
               icon = "system-file-manager";
             }
 

modules/common/users/accounts.nix

@@ -1,10 +1,16 @@
 # Copyright 2022-2024 TII (SSRC) and the Ghaf contributors
 # SPDX-License-Identifier: Apache-2.0
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 # account for the development time login with sudo rights
 let
   cfg = config.ghaf.users.accounts;
   inherit (lib)
+    mkMerge
     mkEnableOption
     mkOption
     optionals
@@ -30,29 +36,50 @@ in
         A default password for the user.
       '';
     };
+    readOnlyHome = mkEnableOption "read-only home directory" // {
+      default = true;
+    };
   };
 
-  config = mkIf cfg.enable {
-    users = {
-      mutableUsers = false;
-      users."${cfg.user}" = {
-        isNormalUser = true;
-        inherit (cfg) password;
-        #TODO add "docker" use "lib.optionals"
-        extraGroups = [
-          "wheel"
-          "video"
-          "networkmanager"
-        ] ++ optionals config.security.tpm2.enable [ "tss" ];
-      };
-      groups."${cfg.user}" = {
-        name = cfg.user;
-        members = [ cfg.user ];
+  config = mkMerge [
+    (mkIf cfg.enable {
+      users = {
+        mutableUsers = false;
+        users."${cfg.user}" = {
+          isNormalUser = true;
+          inherit (cfg) password;
+          #TODO add "docker" use "lib.optionals"
+          extraGroups = [
+            "wheel"
+            "video"
+            "networkmanager"
+          ] ++ optionals config.security.tpm2.enable [ "tss" ];
+          # # Remove writing permission on home directory as it usually tmpfs.
+          # homeMode = "500";
+        };
+        groups."${cfg.user}" = {
+          name = cfg.user;
+          members = [ cfg.user ];
+        };
       };
-    };
 
-    # to build ghaf as ghaf-user with caches
-    nix.settings.trusted-users = mkIf config.ghaf.profiles.debug.enable [ cfg.user ];
-    #services.userborn.enable = true;
-  };
+      # to build ghaf as ghaf-user with caches
+      nix.settings.trusted-users = mkIf config.ghaf.profiles.debug.enable [ cfg.user ];
+      #services.userborn.enable = true;
+    })
+    (mkIf cfg.readOnlyHome {
+      systemd.services.${"read-only-home-" + cfg.user} = {
+        description = "Make home read only after everything is mounted";
+        after = [ "local-fs.target" ];
+        wantedBy = [ "multi-user.target" ];
+        unitConfig = {
+          RequiresMountsFor = config.users.users.${cfg.user}.home;
+        };
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${pkgs.coreutils}/bin/chmod 500 ${config.users.users.${cfg.user}.home}";
+        };
+      };
+    })
+  ];
 }