Setting Up Parental Controls and App Restrictions on elementary OS

For many Australian households, the family computer is a shared workhorse that doubles as a homework station, a video call hub for relatives in regional areas, and an entertainment centre after school. elementary OS, with its calm Pantheon desktop and curated application ecosystem, often appeals to parents who want a straightforward, distraction-light environment for their kids. The challenge is that elementary OS does not ship with a single parental control panel like Windows or macOS. Instead, the platform relies on a combination of user account privileges, Flatpak permissions, scheduled sessions, and external filtering services. Stitching those pieces together takes a bit of planning, but the result is a system that respects a parent's authority while still giving children room to learn.

The timing matters too. The Australian eSafety Commissioner has been vocal about online harms and screen time for school-aged children, and the ACMA continues to push ISPs toward better default filtering. Many families here receive their internet through the NBN, with widely varying router options, so the cleanest place to enforce limits is often on the device itself. Whether you are configuring a laptop for a primary student in suburban Brisbane or a teenager doing Year 11 subjects by distance in the Northern Territory, the same elementary OS foundations apply.

Planning a Family-Friendly Setup on Pantheon

Before touching any system settings, it helps to sketch out what you actually want to restrict. Some Australian parents are mainly worried about adult content reaching a curious eight-year-old. Others want to block specific games or chat applications during homework hours. A few need to enforce bedtime cut-offs because the child's room doubles as a study nook. Writing these goals down keeps the configuration focused and avoids the trap of disabling so much that the computer becomes frustrating to use.

elementary OS is built on Ubuntu, which means almost every parental control strategy available on Linux can be applied here, but you have to pick the layer that matches your goal. Operating-system-level controls handle who can install software, who can change settings, and when the session is allowed to run. Application-level controls govern which Flatpak or .deb packages a child can launch. Network-level controls intercept DNS or HTTP requests before they ever reach the browser. A thoughtful setup usually combines at least two of these layers so that a determined teenager cannot simply bypass one of them.

It is also worth thinking about how the device is used. A shared desktop in the kitchen is a different beast from a personal laptop that travels to school. In Australia, many families rely on a single shared PC, which makes account switching and visible session boundaries much more important than they would be on a per-user device.

Creating Standard and Restricted User Accounts

The single most effective step in elementary OS is to stop giving children administrator access. Open System Settings, head to Users & Groups, and create a standard account for each child. The standard account type prevents the installation of system packages, blocks changes to network and firewall settings, and removes the ability to add new user accounts. For younger children, a guest-style session with even fewer permissions can be configured through the same panel, and the password for the administrative account should be kept somewhere outside their reach.

If your family follows the common Australian pattern of one desktop per household rather than one per child, password hygiene matters even more. A short PIN-style password that the kids have observed you typing is essentially no password. Switch to a passphrase you can remember but they cannot easily guess, and consider enabling auto-logout after a period of inactivity so the next family member starts from a clean session. elementary OS inherits the GNOME screen lock behaviour, which can be tightened from the Privacy settings panel.

For older students, a standard account is usually enough. They can still run applications, save homework to their home folder, and customise their own desktop without affecting system files. If they need occasional admin powers — for example to install a USB driver for a STEM kit — they can ask you to enter the administrative password at the prompt rather than holding it permanently. This pattern is encouraged in many Australian school IT policies and is the same model used by state education departments for managed devices.

Managing Flatpak and App Permissions

Most modern applications on elementary OS arrive through Flatpak, and this is where parental controls become more granular than the user-account layer alone. Flatpak sandboxes each application and exposes a permission model through Flatseal and through the command-line flatpak override tool. By default, an application has access only to the resources it strictly needs, but many apps request broader access to make installation easier. Reviewing those overrides is a healthy habit, particularly for anything aimed at children.

Flatseal, available from AppCenter, presents a graphical list of every installed Flatpak and its current permissions. You can strip a game of its access to the home folder, remove microphone rights from a chat application, or revoke network access from a sandbox toy that should not be phoning home. For families in Australia who are conscious of telemetry flowing back to overseas servers, this is a meaningful control. A music app for a nine-year-old does not need Bluetooth, and a drawing program does not need location data.

You should also think about which Flatpaks are installed at all. AppCenter on elementary OS is intentionally small and curated, which is a quiet form of parental control in itself. Stick to well-known educational Flatpaks, avoid sideloading from random .flatpakref files found through a search engine, and remove any application that a child installed during a moment of curiosity. The smaller the attack surface, the easier the conversation becomes when you sit down to review what is on the machine together.

For a deeper dive into Flatpak permissions and how sandboxing interacts with the Pantheon desktop, the community has published walkthroughs and video guides on the elementary OS multimedia section of this site, which is worth bookmarking before you start pruning permissions.

Screen Time, Session Locking, and Time-of-Day Rules

User accounts control who can use the computer, but they do not, on their own, control when. elementary OS does not include a built-in screen-time scheduler, so families reach for a few well-tested Linux tools. timedatectl handles the system clock, while scheduled tasks are managed through systemd timers or the simpler GNOME Schedule frontend. Parents can create timers that log the session out at a set hour each evening, or that simply disable the display via xset during late-night hours.

A common Australian household pattern is to align the cut-off with dinner or with the nightly news broadcast on the ABC, which still draws a wide family audience. Setting the log-out timer for 19:30 or 20:30 turns the rule into a routine rather than a confrontation. Younger children generally accept the machine shutting down if it happens at the same time every day. Older children, especially those in Years 11 and 12 preparing for the ATAR, will want negotiated exceptions, and it is worth building those into the schedule from the start.

For real-time visibility, the GNOME Usage tool, accessible from the applications grid, shows how much time has been spent in each application over the past week. Sitting down with the child and reviewing those numbers is often more effective than any automated block, because it turns the conversation into a shared decision rather than a rule imposed from above. If a particular application is consuming too many hours, you can simply remove its Flatpak and reinstall it on a weekend if appropriate.

DNS Filtering and Network-Level Safeguards

Even a well-locked-down operating system cannot stop a determined child from typing a URL into a browser. The next layer is DNS filtering, which sits between the computer and the wider internet and blocks entire categories of sites before they resolve. On elementary OS, the easiest way to deploy this is through systemd-resolved, which is the default resolver on most recent Ubuntu-based installations. Pointing its configuration at a family-friendly DNS provider such as OpenDNS Home, CleanBrowsing, or NextDNS applies the filter to every browser and most applications on the device without any per-app configuration.

Families on the NBN will usually have a router that can be configured to apply the same DNS settings to every device in the house, which is a useful safety net. It does, however, mean that any device brought home — a friend's tablet, a console, a smart TV — inherits the filter. Many Australian parents find this trade-off acceptable, particularly in homes where younger children share the Wi-Fi password with schoolmates during weekend playdates.

DNS filtering is not perfect. A child with technical knowledge can sometimes configure their device to use a different DNS server, which is why pairing network filtering with the Flatpak permission model described earlier is wise. If the browser Flatpak has had its network access revoked entirely, the only way to reach the internet is through approved applications, which dramatically reduces the surface area for accidents. Combined with a standard user account, the result is a layered approach where each control reinforces the others.

Comparing Parental Control Approaches on elementary OS

No single tool covers every parent's needs, and the right mix depends on the age of the child, the household's tolerance for friction, and how much time you want to spend maintaining the setup. The table below summarises the most useful options available to elementary OS users.

A practical starting point for most Australian families is the combination of standard accounts, DNS filtering, and a session timer. From there, Flatpak permissions can be added as you become more confident with the system. If a particular child repeatedly pushes against the limits, layering in a dedicated time-management tool such as Timekpr-nExT gives you the kind of hard cut-offs that automated timers alone cannot deliver.

Over time, the configuration you build today will need to be revisited. Children grow, the threats change, and the apps they rely on will evolve. Treating the setup as a living document rather than a one-off project is the habit that keeps it useful. A short monthly check — reviewing Flatpak permissions, glancing at Usage statistics, and confirming the DNS filter is still active — is usually enough to keep things running smoothly, and it gives you a regular, low-stakes reason to sit down with your child and talk about how they are using the computer. That conversation, more than any single technical control, is what makes elementary OS a genuinely family-friendly desktop.