Question

20

What is the most "Ubuntu" way of preventing certain users from shutting down, suspending etc?

rated 0 times [ 20] [ 0] / answers: 1 / hits: 3979 / 2 Years ago, wed, december 8, 2021, 7:18:06

On a traditional Unix system, non-root users cannot do this. What is it that gives users this ability in modern desktop environments and how would I go about disabling this on a per-user or per-group basis?

I've seen a great method to prevent anybody from shutting down/suspending, but ideally what I'm looking for is to prevent certain users (such as, by adding/removing them from a certain usergroup) from being able to execute a shutdown, restart, suspend.

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

rtbrbab

Add To Favorites

Follow

Total Points: 461

Total Questions: 126

Total Answers: 117

Location: Saudi Arabia

Member since Fri, Jul 1, 2022

2 Years ago

rtbrbab questions

1 Lenovo V15-IIL touchpad not detected in ubuntu 22.04

Fri, May 5, 23, 14:22, 1 Year ago

1 How to make alias to systemctl with autocomplete

Tue, Nov 16, 21, 14:41, 2 Years ago

1 Google drive option won't show up in my File Manager

Thu, Mar 23, 23, 20:47, 1 Year ago

1 How to delete ZFS snapshots in bulk and upgrading to non LTS version?

Thu, Mar 23, 23, 18:06, 1 Year ago

1 How do I zoom 200% in feh without having to use fullscreen?

Sat, Jun 18, 22, 21:36, 2 Years ago

View All

answered 2 Years ago ithriv · Accepted Answer

As mentioned in the other question, you can control these actions via PolicyKit's local authority system.

If you create a file /etc/polkit-1/50-local.d/restrict-shutdown.pkla with content like:

[Disable shutdown/etc for group restricted]

Identity=unix-group:restricted

Action=org.freedesktop.consolekit.system.stop;org.freedesktop.consolekit.system.restart;org.freedesktop.upower.suspend;org.freedesktop.upower.hibernate

ResultAny=no

ResultInactive=no

ResultActive=no

This will prevent any member of the group restricted from performing the matched actions. Alternatively, if you want to restrict individual users, replace unix-group:restricted with unix-user:user1;unix-user:user2;.... Any user not matched by this policy should end up with the default behaviour.