Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.4: Disable the installation of Dashboard Widgets System 10.4
Tiger only hintMy company is preparing to install Tiger on all of our Macs, and I was told by an IT guy in the know that there's an intent to completely disable the Dashboard. Having used the Dashboard since Tiger's release and loving it, I can understand that, for security reasons and not wanting users to be able to install any system-damaging widgets they come across, disabling the Dashboard completely is not unwarranted.

But I believe the Dashboard is an inherently useful tool, and if there could be a way to prevent users from installing their own widgets, the Dashboard should be allowed to remain active. That being the case, I figured out that you take these two steps to secure the Dashboard, and prevent unauthorized widget installs:
  1. Use Admin/Root privileges to lock the top-level /Library -> Widgets folder, to prevent system-level widget installs. Use the Admin/Root privileges to lock the user's Library -> Widgets folder to prevent User installs (this will also block drag and drop installs).

  2. Widgets are installed by a small program called the Widget Installer. It resides deep inside of the OS X System folder. Modify the permissions of this app so that the end user has no access, and this will prevent any installation of a Widget, while allowing full use of the Dashboard. The program is located here: /System -> Library -> CoreServices -> Dock (control-click and Show Package Contents) -> Contents -> Resources -> Widget Installer.app.
(You can also prevent users from deleting or disabling widgets with the built-in Widget Manager (called Widgets) by locking it. It resides in the same folder as the Widget Installer.)

Doing both of these things will disable the system's ability to install new widgets, but keep the Dashboard's ability to run existing widgets.

[robg adds: For this to work, the normal users must not have admin privileges, obviously, or they could just override the permissions settings.]
    •    
  • Currently 2.83 / 5
  You rated: 2 / 5 (6 votes cast)
 
[11,268 views]  

10.4: Disable the installation of Dashboard Widgets | 7 comments | Create New Account
Click here to return to the '10.4: Disable the installation of Dashboard Widgets' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.4: Disable the installation of Dashboard Widgets
Authored by: bkazez on May 12, '06 09:55:13AM

Interesting hint, although an installed widget has no more potential for harm than an application downloaded to the desktop. They can do an equal amount of damage to a system, and under the plan you mention, the user would still be able to download malicious applications (and widgets) to the desktop and run them.

Ben

---
http://www.benkazez.com/



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: bkazez on May 12, '06 10:04:42AM

I should have mentioned how it's possible to run a widget without installing it, since this isn't common knowledge:

1. Double-click the uninstalled widget.

2. Hold down command and option.

3. The "Install" button in the confirmation dialog box will have changed to "Run."

Ben

---
http://www.benkazez.com/



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: neuralstatic on May 12, '06 10:53:30AM

well you can prevent which applications a user can run in the Accounts settings, Desktop or Application folder.

i personally just disable dashboard for all users since they're resource pigs.
but to keep a locked suite of 'ok' widgets, this tip looks useful.



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: mm2270 on May 15, '06 07:18:12AM

I ended up disabling the whole dashboard environment for my users when I rolled out Tiger because there are too many games for Dashboard. Being in a corporate environment, getting caught playing a game is the kiss of death, so I did this to remove any temptation to do so. I'm actually protecting the users, even though I'm sure some of them don't see it that way.

However, I'll take a closer look at this hint to see if setting up a limited and accepted Dashboard environment will work.



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: leamanc on May 12, '06 11:22:06AM

One problem with this scenario (changing file permissions to lock users out of doing certain things) is that your changes are not likely to stick.

Running Repair Permissions or an OS update will likely revert many, if not all, of the changes back to system default.



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: critcol on May 12, '06 11:34:01AM

Disabling the Widget Installer gets around Ben's exploit of not installing but running the widget. It's the widget installer which provides the dialogue that lets you switch Install to Run.

And repairing permissions will maintain the User's No Access Widget folder, and turns the ./libary widget folder into Read Only.

-CritCol

PS, Ben, thank's for that handy widget install tip.



[ Reply to This | # ]
10.4: Disable the installation of Dashboard Widgets
Authored by: GlowingApple on May 13, '06 12:12:34PM

However, you can still Show Package Contents and then run the Widget directly through an internet browser. I believe the Widget has the same security access this way as running with the Installer.

---
Jayson --When Microsoft asks you, "Where do you want to go today?" tell them "Apple."



[ Reply to This | # ]