User access to these actions are controlled by polkit. In particular, they correspond to the following actions:
All of these actions are allowed by default for active local users (although
consolekit further restricts the first two permissions to only work when there is a single user logged into the system).
If you want to disable these actions create a file
/etc/polkit-1/50-local.d/disable-shutdown.pkla containing something like:
This should prevent those actions from completing. More information on these policy files can be found by running
If you are trying to restrict
root though, this will only be a minor inconvenience. By definition,
root is an unrestricted account according to the traditional UNIX discretionary access control system. If you can't trust users you've given full
root access to, then you've got bigger problems than them just shutting down the system.
Note that in later Ubuntu versions somebody decided to break compatibility. As answered in How to disable shutdown/reboot from lightdm in 14.04? the action seems to have changed to "org.freedesktop.login1.reboot" (and the-like).
For example in 14.04 adding the following lines as
[Disable lightdm PowerMgmt]
In addition note that this method block solely reboot/etc commands issued from GUI. To block reboot/etc commands from command line one may use molly-guard - as explained in Disabling shutdown command for all users, even root - consequences?