man(8)

📦
version 0.14.0 · 3 versions
, in alpine 3.24, arch rolling, fedora 44, ubuntu resolute

✨ man(8) — the malcontent-client era ✨

okay bestie, sit DOWN, we're reading the malcontent-client manual page together and it's gonna be a whole vibe 💅 this is the malcontent-client man page, section 8, and honestly? it's giving parental-controls-superpowers 🦋

🌸 NAME 🌸

malcontent-client — Parental Controls Access Utility 💖

🎀 SYNOPSIS 🎀

malcontent-client get-app-filter [-q] [-n] [USER]

malcontent-client check-app-filter [-q] [-n] [USER] ARG

malcontent-client set-app-filter [-q] [-n] [USER] ARG

malcontent-client oars-section [-q] [-n] [USER] SECTION

malcontent-client get-session-limits [-q] [-n] [USER]

malcontent-client set-session-limits [-q] [-n] [USER] LIMIT-TYPE

malcontent-client monitor [-q] [USER]

malcontent-client record-usage [-q] USAGE-ENTRIES

malcontent-client query-usage [-q] USER RECORD-TYPE IDENTIFIER

malcontent-client get-estimated-times [-q] RECORD-TYPE

malcontent-client request-extension [-q] RECORD-TYPE IDENTIFIER
[DURATION]

malcontent-client get-web-filter [-q] [-n] [USER]

malcontent-client set-web-filter [-q] [-n] [USER] ARG

malcontent-client update-web-filters [-q] [-n] [USER]

malcontent-client dump-web-filters [-q] [-n] [USER]

🫶 DESCRIPTION 🫶

so malcontent-client is literally the utility for querying and updating the parental controls settings for users on the system ✨ and here's the tea: if you wanna do anything more than just look at the current user's parental controls, it will typically require administrator access. no cap 👑

it talks to accounts-service, which is the thing that actually stores the parental controls data. middle-man energy, but make it iconic 💅

its first argument is a command to run, and every supported command is documented below, so keep scrolling bestie 🎀

🚨 the command line API and output format are UNSTABLE and likely to change in future versions of malcontent-client. it's giving "we're still figuring ourselves out" 😭

💖 get-app-filter OPTIONS 💖

get the app filter for a user, slay. for example:

# malcontent-client get-app-filter timmy
  • USER — username or ID of the user to get the app filter for. if you don't specify it, the current user gets used by default 💫
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if that's needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈

🔥 check-app-filter OPTIONS 🔥

check if a given program, content type or flatpak ref is permitted to be used by a user, according to their current app filter. vibe check, essentially. for example:

# malcontent-client check-app-filter timmy $(which
gnome-calculator)

# malcontent-client check-app-filter timmy x-scheme-handler/http

# malcontent-client check-app-filter timmy
app/com.realm667.WolfenDoom_Blade_of_Agony/x86_64/stable
  • USER — username or ID of the user to get the app filter for. if not specified, the current user is used by default 💫
  • ARG — path to a program, content type or flatpak ref to check against the app filter, to see if it's allowed for the specified user 👀
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈

⭐ set-app-filter OPTIONS ⭐

set the app filter for a user, replacing all previous values in it — yes, ALL of them, it's a full glow-up makeover 💅 for example:

# malcontent-client set-app-filter timmy \
      --disallow-user-installation \
      $(which gnome-calculator) \
      x-scheme-handler/http \
      app/com.realm667.WolfenDoom_Blade_of_Agony/x86_64/stable
  • USER — username or ID of the user to set the app filter for. if not specified, the current user is used by default 💫
  • ARG — item to filter in the user's app filter. this could either be an absolute path or flatpak ref of a program to block; a content type to block all programs handling that type; or an OARS section=value pair to block installation of apps with a more extreme rating for that OARS section. multiple items may be specified, and they will replace the user's current app filter in its entirety ✨ if zero items are specified, the app filter is cleared 🧹
  • --allow-user-installation — allow the user to install flatpaks to their user repository 🫶
  • --disallow-user-installation — disallow the user from installing flatpaks to their user repository 🚫
  • --allow-system-installation — allow the user to install flatpaks to the system repository 🫶
  • --disallow-system-installation — disallow the user from installing flatpaks to the system repository 🚫
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈

🦋 oars-section OPTIONS 🦋

get the value set for a specific OARS section from the app filter of the given user. very specific, very demure. for example:

# malcontent-client oars-section timmy language-profanity
  • USER — username or ID of the user to get the OARS filter for. if not specified, the current user is used by default 💫
  • SECTION — OARS section to get the restriction level of the given user for. for example, language-profanity 🤬
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈

🌈 get-session-limits OPTIONS 🌈

get the session limits set for a user. for example:

# malcontent-client get-session-limits timmy
  • USER — username or ID of the user to get the session limits for. if not specified, the current user is used by default 💫
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈
  • --now yyyy-mm-ddThh:mm:ssZ — check session limits (in particular, session expiry time) against the given date/time, provided in ISO 8601 format. (default: current date/time.) ⏰

🍓 set-session-limits OPTIONS 🍓

set the session limits for a user, replacing its previous value completely. full reset, no leftovers 💅 for example:

# malcontent-client set-session-limits timmy \
      daily-schedule \
      --start-time 16:00 --end-time 18:00
  • USER — username or ID of the user to set the app filter for. if not specified, the current user is used by default 💫
  • LIMIT-TYPE — the type of session limit to use for this user. possible values are:
    • none — no session limits. ✨
    • daily-schedule --start-time HH[:MM[:SS]] --end-time HH[:MM[:SS]] — daily schedule with fixed start and end times. these must be provided as two arguments giving the time of day when the schedule starts and ends. 🕓
    • daily-limit --daily-limit SECONDS — daily limit on the overall active time using the computer for the day. this must be provided as a limit length in seconds. ⏳
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈

👑 monitor OPTIONS 👑

monitor changes to any of the parental controls settings for a specific user. it's literally just standing there watching, main character surveillance energy 👀 for example:

# malcontent-client monitor timmy
  • USER — username or ID of the user to monitor the parental controls for. if not specified, the current user is used by default 💫
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫

💜 record-usage OPTIONS 💜

record session or app usage times for the current user. receipts, basically 🧾 for example:

# malcontent-client record-usage 2025-04-22T08:00:00Z
2025-04-22T16:00:00Z login-session

# malcontent-client record-usage 2025-04-22T08:00:00Z
2025-04-22T16:00:00Z app "org.gnome.gedit"
  • USAGE-ENTRIES — one or more usage entries to add. each entry is a set of four arguments:
    • the start date and time of the usage period (in ISO 8601 format) ⏱️
    • the end date and time of the usage period (also in ISO 8601 format) ⏱️
    • the record type (login-session or app) and
    • the record identifier (this must be the empty string for login-session records, and the app ID for app records) 🆔

the final record identifier in the arguments list can be omitted if it's empty ✨

  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫

🧚 query-usage OPTIONS 🧚

query session or app usage times for a given user. for example:

# malcontent-client query-usage bob login-session ""

# malcontent-client query-usage bob app "org.gnome.gedit"
  • USER — username or ID of the user to get the usage information for 🔍
  • RECORD-TYPE IDENTIFIER — the record type and identifier to query for records of. see the documentation for the record-usage command for valid values 👀
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (default: output informational messages.) 🤫
  • -n, --no-interactive — do not allow interactive authorization with polkit. if this is needed to complete the operation, the operation will fail. (default: allow interactive authorization.) 🙈
🌟 and that's only part 1, bestie — hold on, there's more coming 💖

✨ get-estimated-times OPTIONS ✨

Bestie this one is the fortune teller of the family 💖 It peeks at the usage and session limits for the current user and does the math on how much time is left — either in their session, or for using apps. Obsessed.

For example:

# malcontent-client get-estimated-times login-session

RECORD-TYPE — which kind of usage record you're querying for, girly. This can be login-session or app.

  • -q, --quiet — only spit out error messages, no informational ones while the operation is doing its thing. (Default: informational messages do get output, fr.)

✨ request-extension OPTIONS ✨

Okay so this is the "pls pls pls can I have five more minutes" command 😭🙏 It requests an extension to the screen time limit for the current user — either for their session, or for the app you name.

For example:

# malcontent-client request-extension login-session ""

RECORD-TYPE IDENTIFIER — the record type and the identifier you're requesting an extension for. Wanna know the valid values? Go read the docs for the record-usage command, they're all listed there 💅

DURATION — how long an extension you're asking for, in seconds. Or zero, which lets the parent pick the duration (typically that means until the end of today). (Default: Zero.)

  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (Default: Output informational messages.)

✨ get-web-filter OPTIONS ✨

Gets the web filter for a user. Simple as that, no cap 🦋

For example:

# malcontent-client get-web-filter timmy

USER — the username or ID of the user to get the web filter for. If you don't specify it, the current user gets used by default.

  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (Default: Output informational messages.)
  • -n, --no-interactive — do not allow interactive authorization with polkit. And if that authorization turns out to be needed to complete the operation? The operation just fails, periodt. (Default: Allow interactive authorization.)

✨ set-web-filter OPTIONS ✨

Sets the web filter for a user, and it replaces all previous values in it — like, the whole thing, gone, wiped. Slay but be careful 💅

For example:

# malcontent-client set-web-filter timmy \
      --force-safe-search \
      --filter-type block-list \
      adult=https://v.firebog.net/hosts/Prigent-Adult.txt \
      advertising=https://v.firebog.net/hosts/Prigent-Ads.txt \
      reddit.com \
      ~mastodon.social

USER — the username or ID of the user to set the web filter for. If not specified, the current user will be used by default.

ARG — an item to filter in the user's web filter. This could either be an id=filter-URI pair, or an individual hostname to block. Either type of item may be prefixed with ~ (a tilde) to allow it rather than blocking it. A filter URI must point to a text file in the same format as /etc/hosts, listing websites to filter. The associated ID is an arbitrary alphanumeric string used to track the filter over time, even if its canonical URI changes. Multiple items may be specified, and they will replace the user's current web filter in entirety. And if zero items are specified, the web filter is cleared. 🧚

  • --force-safe-search — force 'safe search' mode to be enabled for known search engines and popular websites.
  • --filter-type — the type of web filter to use for this user. Possible values are:
    • none — No web filtering.
    • block-list — Websites are allowed by default unless listed in one of the block lists. The websites in the allow lists are always allowed.
    • allow-list — Websites are blocked by default unless listed in one of the allow lists. The block lists are ignored.
  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (Default: Output informational messages.)
  • -n, --no-interactive — do not allow interactive authorization with polkit. If this is needed to complete the operation, the operation will fail. (Default: Allow interactive authorization.)

✨ update-web-filters OPTIONS ✨

Downloads and updates the compiled web filters for one specific user, or for everybody 🌈 It reads the current web filter configuration for the user and updates the compiled filter database using that configuration.

For example:

# malcontent-client update-web-filters timmy

And heads up: to update the web filter configuration for a user, you want malcontent-client set-web-filter instead. Different job, bestie.

USER — username or ID of the user to update the web filters for. If not specified, the web filters will be updated for all users who have them set.

  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (Default: Output informational messages.)
  • -n, --no-interactive — do not allow interactive authorization with polkit. If this is needed to complete the operation, the operation will fail. (Default: Allow interactive authorization.)

✨ dump-web-filters OPTIONS ✨

Dumps the compiled web filters for a specific user, or for all users. These are the filter rules which are currently being used — the real live ones, not the config 👑

For example:

# malcontent-client dump-web-filters timmy

USER — username or ID of the user to dump the web filters for. If not specified, the web filters will be dumped for all users who have them set.

  • -q, --quiet — only output error messages, and no informational messages, as the operation progresses. (Default: Output informational messages.)
  • -n, --no-interactive — do not allow interactive authorization with polkit. If this is needed to complete the operation, the operation will fail. (Default: Allow interactive authorization.)

🌸 ENVIRONMENT 🌸

malcontent-client supports the standard GLib environment variables for debugging. These variables are not intended to be used in production, okay? Like, dev-only vibes, fr fr 🙈

$G_MESSAGES_DEBUG

This variable can contain one or more debug domain names to display debug output for. The value all will enable all debug output. The default is for no debug output to be enabled.

💀 EXIT STATUS 💀

malcontent-client may return one of several error codes if it encounters problems. Let's go through them one by one, bestie.

  1. 0 — No problems occurred. The utility ran and successfully queried the app filter. If running the check-app-filter command, the given path, content type or flatpak ref was allowed for the given user. Iconic ✨
  2. 1 — An invalid option was passed to malcontent-client on startup.
  3. 2 — The current user was not authorized to query the app filter for the given user. Rude.
  4. 3 — If running the check-app-filter command, the given path, content type or flatpak ref was not allowed for the given user.
  5. 4 — Malcontent is disabled at the system level, and hence parental controls are not enabled or enforced.
  6. 5 — An operation failed and no more specific error information is available.
  7. 6 — The service was busy; try again shortly. (Not me being impatient 😭)

🐛 BUGS 🐛

Any bugs which are found should be reported on the project website:

https://gitlab.freedesktop.org/pwithnall/malcontent/-/issues

Found something broken? Tell the devs, don't just suffer in silence, bestie 🫶

👑 AUTHOR 👑

Endless Mobile, Inc. Philip Withnall

Copyright © 2018 Endless Mobile, Inc. Copyright © 2025 GNOME Foundation, Inc.

And that's the whole page, babe 💖 This was man(8) version 1.2, dated 20 Mar 2025 — go forth and parentally control responsibly, mwah 💅✨

📦 where this page comes from