Lock down the GNOME desktop with Pessulus