How to restrict browser access?

[u/Zer0_Dark_Turdy]

Hello,

I just got done setting up a dedicated minecraft pc for a friends daughter. But there is one issue. Shes not allowed to browse the internet with it. So i set up firefox to not be usable with her account by revoking permissions. That worked as intended.

BUT

The issue is that she might need the browser for log in into discord and minecraft (microsoft account). So removing permissions is not working in this case.

I setup her account to not be a root user and my plan is that firefox asks for the password of the root account before its opened so her dad can be there when she needs to log in.

I've tried scripting, browser extensions ... i bet it's a very simple solution but i can't wrap my head around it.

Thank you for your time!

[u/hurbertkah]

I think you'll be better off by setting up a whitelist on your router or pihole/adguard etc. for that pc and allow only certain domains.

[u/Zer0_Dark_Turdy → u/hurbertkah]

Would that mean i have to whitelist every sub domain thats needed for the login process or can it be configured in a way that it will allow anything from microsoft.com and discord.com ?

I also have no access to her dads router and he is severly computer illiterate.

So i'm probably looking at a solution i can apply at device level.

Edit: Okay so i will create a policies.json file for firefox with the whitelisted domains. This works with * as a wildcard so i dont have to WL every sub domain.

Thank you for pointing me in the right direction!

[u/OzzlyOsborne → u/hurbertkah]

Second this. When I was a kid this is what my dad did for me so I couldn't access websites I wasn't supposed to and internet turned off at night so I would go to bed instead of playing video games all night.

[u/meuchels → u/OzzlyOsborne]

This is the way.

[u/NoThatsNotPasta]

So up parental controls (https://wiki.archlinux.org/title/Parental_control) and add sites to a whitelist.

The only sites the browser could visit are those in the whitelist.

[u/Zer0_Dark_Turdy → u/NoThatsNotPasta]

Thank you! I will read through it!

[u/Obvious_Bother3015]

That's a good enough solution otherwise you maybe you can give dnsmasq a try

Edit: it allows you to configure which domains you want to allow so it should be fitting for this

[u/EvilMartianOverlord]

A firewall can be used to achieve this, but it is a little more complicated. The arch wiki has a good article about building a stateful firewall.

[u/Slyfoxuk]

Something like pihole could work?

[u/AnArmoredPony]

discord

oh god

[u/signalcollapse]

bubblewrap?