Back when internet cafés were still a thing, a common practice was to have a bunch of thin clients that would have no local storage and have them boot over the network. The environment would get wiped every time someone logged off.

You could do something similar. Cheap machines with no local storage. Bios settings that prevent any sort of booting from usb sticks and protect the bios with a password.

Projects like LTSP are designed for this.

You could boot the machines in a read only mode and just have the browser available. Perhaps also only allowing sharing of files through something like nextcloud where you could theoretically also lock down what type of files are allowed. Or at least be able to inspect the files that people are storing.

You will need to configure secure boot with your own keys, efistub and create a user with no sudo.

After that any selinux or apparmor distro will do.

What you are concerned about here is physical security so you will need to lock the bios, cut off the CMOS reset pins and probably solder the 3.3 battery.

I’ve found the gold standard to be the NCSC Guidelines. This covers everything around proper deployment of end user devices in an organization. https://www.ncsc.gov.uk/collection/device-security-guidance

They have clamp down configurations for Windows and Ubuntu, plus others. This is the Ubuntu page, but there’ll be lots of cross over to other distros https://www.ncsc.gov.uk/collection/device-security-guidance/platform-guides/ubuntu-lts

Their security configuration packs are hosted on GitHub so you can vet them first if you want https://github.com/ukncsc/Device-Security-Guidance-Configuration-Packs

Would this locked-down distro be used by customers or by employees? If it is being used by employees, there is no faster way to be hated than putting unnecessary restrictions on their logins. You don’t want that kind of workplace.

I simply do this:

1. Make sure they don’t get sudo/root privileges.

2. Remote mount their home directories (nfs).

3. Don’t add any restrictions beyond that. It is a waste of time and money.

4. Control the rest through company policy, usually clauses under the ‘Misuse of company network’ section.

5. Who cares if employees are browsing tik-tok or whatever if they’ve done all their work? That’s a work-allocation issue. If they haven’t done all their work then that’s already a solved problem. Either motivate them or performance manage them slowly towards the door.

6. Who cares if they want to install xyz software [in their home directory]? Chances are it’ll be a free boost for performance and/or morale.

I think avoiding ChromeOS is wise, that just puts Google in charge of your IT systems and leave you at the mercy of their data harvesting abomination of Linux loaded with proprietary software.

ChromeOS sucks… I think its the worst OS I ever used

If you’re looking for a pure kiosk experience check out porteus kiosk, it’s a very stripped down distro that lets you choose Firefox or chrome and by default uses private browsing.

I’m sure if you need a whole desktop experience that’s also possible but i don’t know how

for kiosk, there’s also https://github.com/cage-kiosk/cage

Fedora Silverblue is locked down desktop linux

https://fedoraproject.org/silverblue/

As long as you don’t give the users sudo powers there is little they can do to screw up the system.

But that would only make sense if you want them to have their own users. If it’s just a public computer, you probably want the kiosk thin mentioned before.

I’m sure there’s a better solution, but SELinux is an option. It can be difficult to customize, but it’s capable of locking down the system entirely. You could theoretically block all actions taken by the user except for a select few mozilla_t actions and others necessary for login.

NixOS

Ngl I know you don’t want to use big tech but I think chromeOS is probably your best bet.

I’m a huge proponent of Linux but unless your business is locking down linux you’re better off getting an off-the-shelf OS that’s simple to maintain so you can make money with your core business. ChromeOS is your best bet.

You don’t want to do this.