User access to these actions are controlled by polkit. In particular, they correspond to the following actions:
All of these actions are allowed by default for active local users (although
consolekit further restricts the first two permissions to only work when there is a single user logged into the system).
If you want to disable these actions create a file
/etc/polkit-1/50-local.d/disable-shutdown.pkla containing something like:
This should prevent those actions from completing. More information on these policy files can be found by running
If you are trying to restrict
root though, this will only be a minor inconvenience. By definition,
root is an unrestricted account according to the traditional UNIX discretionary access control system. If you can't trust users you've given full
root access to, then you've got bigger problems than them just shutting down the system.