3

I want to disable "shutdown" and "poweroff" CLI commands in Ubuntu for a specific user. How to do it?

Gilles 'SO- stop being evil'
  • 829,060
asm_nerd1
  • 195

1 Answers1

3

If you are just on the command line, removing the user from the sudo/admin/wheel group may be enough since shutdown, poweroff and reboot need root privileges.

If we are talking about desktop sessions (or sessions otherwise handled by login managers such as consolekit or logind), this may become a little more complicated. In this case adjust your system's polkit rules as described here (or create them if they don't exist): https://askubuntu.com/questions/93542/how-to-disable-shutdown-reboot-suspend-hibernate

But make sure, the user you want to restrict has no other method of gaining root access (i.e. you also need to prevent him from using sudo). Otherwise he can just override or change these settings.

Edit: for a more up to date example with new JS config format, see https://wiki.archlinux.org/index.php/Polkit#Disable_suspend_and_hibernate

If you are using systemd (probably not when this is about Ubuntu), the action ids may also be different (starting with org.freedesktop.login1.xxx instead of org.freedesktop.consolekit.xxx). For a list of logind actions, have a look at https://www.freedesktop.org/wiki/Software/systemd/logind/

Janek Bevendorff
  • 1,115
  • A quick way know what the actions would be: pkaction | grep shutdown, etc. – muru Feb 17 '16 at 20:57
  • Actually I want the user to be able to issue all other commands except shutdown, poweroff and reboot on Ubuntu – asm_nerd1 Feb 18 '16 at 13:19
  • As I said, you can disable those commands for him with polkit if the user cannot gain root privileges. If he can, he'd be able to circumvent or completely disable any restrictions. On the other hand, , you can also grant certain other privileges to non-root users if there is a daemon that implements the needed polkit actions. – Janek Bevendorff Feb 18 '16 at 13:39