GNOME Parental Controls with Malcontent Explained

The GNOME desktop implements parental controls through an integrated framework named Malcontent, which allows system administrators to set usage restrictions for standard user accounts. By bridging the underlying Linux system with GNOME's graphical environment, Malcontent enables age-based application filtering, specific program blocklists, installation controls, and computer usage limits. This article details the architecture behind Malcontent and explains how GNOME components work together to enforce digital safety restrictions across the operating system.

The Architecture of Malcontent

Malcontent was created to provide a standardized parental control system for Linux desktops, originally spearheaded by Endless OS and adopted broadly into the upstream GNOME ecosystem. At its foundation, Malcontent consists of:

  • libmalcontent: A shared C library providing APIs for querying and checking application filtering and time limit settings.
  • Malcontent Daemon (malcontent-control): A background service communicating over D-Bus to inspect and update policy states.
  • AccountServices Integration: The system service used by GNOME to manage user accounts on the machine. Malcontent stores permissions as metadata directly within AccountServices user configurations.
  • PAM Module (pam_malcontent): A Pluggable Authentication Module that intercepts login attempts to block access outside of allowed hours.

Because restrictions are tied to standard user accounts managed via system accounts, only users with administrative (sudo or wheel) privileges can modify parental control settings.

Integration with GNOME Settings

GNOME integrates Malcontent controls directly into GNOME Control Center (GNOME Settings) under the Users panel. When an administrator inspects a standard user profile, they are presented with a "Parental Controls" option.

Within this interface, administrators can:

  • Enforce application filtering based on Open Age Rating Service (OARS) ratings.
  • Block specific applications individually regardless of their age rating.
  • Restrict standard users from installing software independently.
  • Restrict access to specific web browsers.

Application Filtering via OARS and GNOME Software

To avoid manual curation of every app, Malcontent relies on the Open Age Rating Service (OARS). Developers tag applications with content ratings (such as violence, language, or online interactions) within their AppStream metadata.

When an administrator designates an age threshold (e.g., ages 3+, 7+, 12+, or 18+), Malcontent reads the AppStream metadata of installed programs and blocks anything exceeding the designated tier.

GNOME Software enforces this mechanism dynamically:

  1. Browsing and Search: Applications rated above the user's allowed threshold are automatically hidden from search results and catalogs inside GNOME Software.
  2. Installation Prevention: If a restricted user attempts to install an application through flatpak bundles, package files, or external links, GNOME Software prevents installation by querying libmalcontent.

Launch-Time Application Blocking

Parental controls must also prevent execution of already-installed software. Malcontent enforces this at the desktop shell and execution layers:

  • Application Launcher: The GNOME Shell application grid reads the user's restrictions from Malcontent and hides launchers (.desktop files) for blocked programs.
  • Execution Hooks: If a restricted user attempts to launch an unapproved binary directly, Flatpak runtimes and desktop portals query libmalcontent and deny the execution process.

Access Schedules and Time Limits

Malcontent allows administrators to set weekly access schedules. This system controls both total daily usage time and specific time windows during which the user is allowed to log in.

Enforcement relies on two mechanisms:

  • Session Start (Authentication): When a user enters their credentials at the GDM (GNOME Display Manager) login screen, pam_malcontent checks the current time against allowed schedules. If the attempt occurs outside allowed hours, login is denied.
  • Active Sessions: An active daemon monitors running time. When a child's allowed time budget expires, the session manager warns the user and automatically logs the session out, returning the system to the display manager.