Lock RetroArch settings with Kiosk Mode on Android without locking out the owner
Back up the active RetroArch configuration, set and record a unique Kiosk Mode password, enable Kiosk Mode, then fully restart RetroArch and test both the restricted menu and the documented unlock action. Kiosk Mode hides frontend settings; it does not authenticate Android, pin the app, encrypt storage, or license any game content.
Do this in order
- 01
Record the RetroArch package source, build, menu driver, active configuration path, and whether configuration is saved on exit.
- 02
Save a known-good copy of `retroarch.cfg` outside any folder exposed to ordinary kiosk users.
- 03
Open Settings → User Interface, set a unique Kiosk Mode password, and store the owner recovery record separately.
- 04
Enable Kiosk Mode, quit RetroArch through its menu, and fully relaunch it so the saved configuration is the one under test.
- 05
Verify that administrative settings are hidden, then use the build's documented disable action and password to restore them.
- 06
Repeat the cold-relaunch test after unlocking; only then add separate Android screen-pinning or device-management controls if required.
Decision and diagnostic table
| Observed result | Likely boundary | Next safe check |
|---|---|---|
| Settings stay hidden after relaunch | Kiosk configuration loaded | Prove password unlock |
| Settings return after relaunch | Configuration was not saved or another profile loaded | Confirm active config path |
| Password is rejected | Wrong value, profile, or build behavior | Restore the known-good config |
| User can still leave RetroArch | Android is outside the frontend boundary | Use Android controls separately |
Kiosk Mode is a menu boundary
Libretro's menu map places Kiosk Mode under the user-interface settings. Its job is to reduce the RetroArch controls exposed to a casual user, not to replace Android authentication, encryption, application pinning, or managed-device policy.
Treat a successful hidden-settings test as proof of the frontend boundary only. If the requirement is to keep a public device inside one app, test the Android layer separately.
Prove recovery before handoff
A restriction is not operationally safe until the owner can reverse it after a full relaunch. Preserve the exact config that was active, record the package and build, and test the password while the device is still under owner control.
If the menu cannot save the change, Libretro's directory guidance explains how Save Current Configuration reveals the active path. Restore the backup instead of guessing at multiple config files.
Keep profiles and permissions separate
Core overrides, per-game remaps, and Android storage grants solve different problems. Do not widen storage access, alter content paths, or erase working overrides merely to make a menu restriction persist.
A public cabinet profile should contain the minimum frontend settings it needs and a separately held owner recovery copy.
Kiosk Mode does not authorize public exhibition or distribution. Use only ROM, BIOS, CHD, artwork, music, overlays, and other assets you are permitted to use, and do not place owner credentials in a shared configuration bundle.