feat: Disable user Gnome extensions & user-installation of them (#361)

FAQ.md

@@ -67,6 +67,14 @@ If you still want to enable this functionality, run `ujust toggle-ghns`
 
 Xwayland is disabled by default on GNOME, KDE Plasma, and Sway. Use `ujust toggle-xwayland` if you need it
 
+#### Why I can't install any GNOME user extensions?
+
+This is because support for installing them has been intentionally disabled in secureblue.
+Only system extensions are trusted, if they are installed.
+
+To enable support for installing GNOME user extensions, you can run ujust command:
+`ujust toggle-gnome-extensions`
+
 #### My clock is wrong and it's not getting automatically set. How do I fix this?
 
 If your system time is off by an excessive amount due to rare conditions like a CMOS reset, your network will not connect. A one-time manual reset will fix this. This should never be required except under very rare circumstances.

files/gschema-overrides/zz1-secureblue.gschema.override

@@ -0,0 +1,5 @@
+# Disable GNOME user extensions installation
+# Only GNOME system extensions are trusted if installed
+
+[org.gnome.shell]
+allow-extension-installation=false

files/system/usr/share/ublue-os/just/60-custom.just

@@ -203,6 +203,18 @@ toggle-gnome-jit-js:
     	echo "JIT JavaScript for Gnome and WebkitGTK has been disabled."
     fi
 
+# Toggle support for using GNOME user extensions
+toggle-gnome-extensions:
+    #!/usr/bin/bash
+    GSETTING="$(gsettings get org.gnome.shell allow-extension-installation)"
+    if [[ "${GSETTING}" == "false" ]]; then
+      gsettings set org.gnome.shell allow-extension-installation true
+      echo "Support for GNOME user extensions have been enabled"
+    else
+      gsettings reset org.gnome.shell allow-extension-installation
+      echo "Support for GNOME user extensions have been disabled"
+    fi
+
 # Toggle Xwayland support
 toggle-xwayland ACTION="prompt":
     #!/usr/bin/pkexec /usr/bin/bash

recipes/asus/recipe-silverblue-asus-nvidia-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/asus/recipe-silverblue-asus-nvidia.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml 
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/asus/recipe-silverblue-asus-userns.yml

@@ -11,6 +11,7 @@ image-version: 40 # latest is also supported if you want new updates ASAP
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml  
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/asus/recipe-silverblue-asus.yml

@@ -11,6 +11,7 @@ image-version: 40 # latest is also supported if you want new updates ASAP
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml  
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/common/disable-gnome-extensions.yml

@@ -0,0 +1,3 @@
+type: gschema-overrides
+include:
+  - zz1-secureblue.gschema.override

recipes/general/recipe-bluefin-dx-main-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml  
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-bluefin-dx-nvidia-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-bluefin-main-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-bluefin-main.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-bluefin-nvidia-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-bluefin-nvidia.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/bluefin-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-silverblue-main-userns.yml

@@ -11,6 +11,7 @@ image-version: 40 # latest is also supported if you want new updates ASAP
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-silverblue-main.yml

@@ -11,6 +11,7 @@ image-version: 40 # latest is also supported if you want new updates ASAP
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/disableuserns-packages.yml

recipes/general/recipe-silverblue-nvidia-userns.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/common-packages.yml

recipes/general/recipe-silverblue-nvidia.yml

@@ -9,6 +9,7 @@ image-version: 40
 modules:
   - from-file: common/initialization-scripts.yml
   - from-file: common/gnome-packages.yml
+  - from-file: common/disable-gnome-extensions.yml
   - from-file: common/silverblue-packages.yml
   - from-file: common/gui-packages.yml
   - from-file: common/disableuserns-packages.yml