[CentOS-devel] Using virt-viewer in kiosk mode...how to lock down the host?

I just received a new computer which cannot install or run Windows 7.
So...of course I immediately thought of KVM and virt-viewer in kiosk
mode.  I've searched and cannot find any setup instructions or advice
for how to do several things.  Any assistance or pointers would be
appreciated.  Let me know if someone has already created the wheel
or if there is a better way to manage this.

1) Configure the host so that users cannot escape the virt-viewer app
or other do anything to the host.  Perhaps disable GDM or use a different
windows manager?

My plan is to have the hosts boot in run level 5, start the guest, auto-
matically log in as the kiosk user, then auto-lauch virt-viewer. Upon
shutdown of the guest, the guest would be restarted.

2) Configure a read-only image with Windows 7 that can automatically
update its computer name and hostname.

If needed I would consider having a generic image which I'll need to
make a custom copy for each of several similar computers.

3) Remove the pointer on the host so only the guest pointer is visible.

Also, it's likely that I will use ansible to manage configuration files
and set up times when the guest is started in read-write mode to
update Windows and various apps.  Although I'm hoping to be able
to update a single image and roll it out without needing to touch
each host.

Thanks for any guidance!

c