I have various Mac Minis that I use as kiosks. I set them up to have an admin account and a user account managed with Parental Controls, which the machine auto-logs into and runs my native app full screen.
I generally use the "Limit Applications" feature to whitelist the only app(s) I need. The problem is, after I deploy the kiosk, over the course of the next 24 to 36 hours, various helper sorts of apps that don't show up in the Parental Controls app list will attempt to run and ask for authentication: virus control, browser/software update stuff, "menulet" apps...I generally have to let the kiosk run for a while and/or restart several times to make sure I've given permissions to all the background/helper apps that attempt to run.
Is there a better strategy for whitelisting than this? Is there a way I can pre-authorize apps that will attempt to run but aren't listed in Parental Controls? Or, assuming I can't guess/figure out what those apps might be, can I set it up so that non-whitelisted apps will be prevented from running without an alert popping up and asking for permission?