Family Linux policy controls

The problem

A shared Linux laptop needed child-safe DNS and application controls while preserving normal administration and local Minecraft connectivity.

What I did

I implemented policy by user identity and traffic destination rather than applying a blanket lock-down.

• A restricted child account is targeted by user identity; the public page omits the real account name and UID
• Per-user nftables rules allow the home LAN and Minecraft Bedrock ports while restricting other traffic
• DNS for the child account is directed to AdGuard Home
• Tailscale remains system-wide while global DNS replacement is disabled
• GNOME Software is blocked for the child using an ACL that can be cleanly removed later

Implementation notes

Representative commands from the way I diagnose and maintain this project. Public examples use placeholders instead of credentials or sensitive addresses.

# Representative policy example; real account identifiers are intentionally omitted
sudo setfacl -m 'u:restricted_user:---' /usr/bin/gnome-software

# Remove the ACL when access should be restored
sudo setfacl -x 'u:restricted_user' /usr/bin/gnome-software

# Validate the per-user nftables policy
sudo nft -c -f /etc/restricted_user-minecraft.nft
sudo nft list table inet restricted_user_minecraft
sudo systemctl status restricted_user-minecraft-filter.service --no-pager

# Keep Tailscale routes while leaving system DNS under local control
sudo tailscale set --accept-routes=true --accept-dns=false

Result

The child account has meaningful controls without breaking the administrator account or local family services.