Update (2 Dec 2005): kiosk extension is broken, I'm now using a hacked browser.jar (version 1.0.7), I made a few changes to xinitrc-common as well Simple kiosk implementation, not entirely thorough, but enough for our purposes. Machine boots and gdm logs into a user without a password, firefox starts fullscreen and opens our homepage. Simple to implement.

Make a backup and set the security context:

[root@surrey policy]# mv /etc/selinux/targeted/policy/policy.18 /etc/selinux/targeted/policy/policy.18.orig
[root@surrey policy]# cp new/policy.18 /etc/selinux/targeted/policy/
[root@surrey policy]# chcon system_u:object_r:policy_config_t /etc/selinux/targeted/policy/policy.18
[root@surrey policy]# /usr/sbin/setfiles -q -c /etc/selinux/targeted/policy/policy.18
/etc/selinux/targeted/contexts/files/file_contexts
[root@surrey policy]# load_policy /etc/selinux/targ

Symptom:

[user@surrey ~]: gnome-volume-manager ** (gnome-volume-manager:10207): WARNING **: manager.c/912: failed to initialize HAL!

Generate policy rules using audit2allow

[root@surrey ~]# audit2allow -i /var/log/messages allow initrc_t unconfined_t:dbus send_msg; allow unconfined_t initrc_t:dbus { acquire_svc send_msg };

Install policy source rpm

[root@surrey ~]# yum install selinux-policy-targeted-sources

Add local rules to local.te

[root@surrey ~]# pushd /etc/selinux/targeted/src/

Using unicode fonts is the easiest way to properly display hindi, arabic, hebrew and other non latin languages. We install the unicode fonts in a local directory and then tell fontconfig to look in that directory. Edit /etc/fonts/local.conf

/usr/ias/share/fonts/fc

Then tell fontconfig to rehash it's tables

[root@host] # fc-cache

Check that your new font is there

[root@host] # fc-list |grep

10-1   Signal weak                   10-8   In service
10-2   Signal good                   10-9   Repeat
10-3   Stop transmitting             10-10  Negative
10-4   Affirmative                   10-12  Stand by
10-6   Busy                          10-19  Return to station
10-7   Out of service                10-23  Arrived at scene

After modifying gdm.conf we noticed that Xnewt would not start properly on occassion. Xnewt was not ignoring the vt[0-9] command line option sent to X to specify a virtual console on which to run. We removed this from the command line sent to Xnewt and renamed Xnewt to Xnewt.sun

pushd /usr/X11R6/bin
mv Xnewt Xnewt.sun
echo  EOF >Xnewt
#!/bin/sh

XFIX=`echo $@ |sed -e's/vt[0-9]*//'`
echo `date`: ARGS=$@ XFIX=$XFIX >>/var/log/Xnewt

exec Xnewt.sun $XFIX -fp unix/:7100
EOF
chmod 755 Xnewt
popd

IBM/Lenovo have a utility to remap the windows key, it's called

TpKmapAp.exe

(Keyboard Customizer Utility) It's in Program Files\ThinkPad\Utilities on our X41's.