The relevant polkit policies should be defined here: https://github.com/systemd/systemd/blob/main/src/login/org.freedesktop.login1.policy
Disabling is done with some rules like this: https://bbs.archlinux.org/viewtopic.php?id=152565
polkit.addRule(function(action, subject) {
if (action.id.indexOf("org.freedesktop.login1.power-off") == 0) {
return polkit.Result.AUTH_ADMIN;
}
});
Some other examples: https://gist.github.com/grawity/3886114
Is it common for cups to run as root? It should have its own user, but that is still not good.
Hmm, never had cups-browsed enabled as I do not need network printing with LDAP or legacy cups. Discovery using DNS-SD/mDNS and driverless printing work perfectly fine without it.
I am not sure if the driverless discovery ever can generate a PPD with arbitrary commands.
For Linux maybe timekpr-next and some custom scripts to sync the time with the time limit server?
ReactOS is probably a good indicator how far you can get with some limited generic drivers.
As a CLI there is gifsicle or imagemagick.
As a gui maybe gifcurry, tupitube or some other 2d animation tool https://en.wikipedia.org/wiki/List_of_2D_animation_software
Curtail is a wrapper around tools like pngquant, jpgoptim and oxipng. In lossless mode it optimizes and reorders e.g the compression tables. I know of no tool that does that for video data and I am not even sure that is feasable. Video is not stored as a simple sequence of images.