Alright, I've got a solution that works nicely, for me at least. I'm running Ubuntu 14.04. I haven't extensively tested it, but it seems to do the job. Comment if you see issues.
Create Polkit rules
Run this command in a terminal:
gksudo gedit /etc/polkit-1/localauthority/50-local.d/disable-shutdown.pkla
And copy this into it:
[Disable shutdown/reboot]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot;org.freedesktop.login1.reboot-multiple-sessions;org.freedesktop.login1.power-off;org.freedesktop.login1.power-off-multiple-sessions;
ResultAny=no
ResultInactive=no
ResultActive=no
Save and close, then also run this:
gksudo gedit /etc/polkit-1/localauthority/50-local.d/disable-suspend.pkla
And paste this into it:
[Disable suspend/hibernate]
Identity=unix-user:*
Action=org.freedesktop.upower.suspend;org.freedesktop.upower.hibernate;org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions;org.freedesktop.login1.hibernate;org.freedesktop.login1.hibernate-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no
Save and close.
These two files will tell Ubuntu to not let any user initiate a shutdown, reboot, suspend or hibernate action. These can be modified to only disable some of these action, if desired.
Edit powerbtn.sh
Run this command to edit the script that gets run when the power button is pressed:
gksudo gedit /etc/acpi/powerbtn.sh
On about line 6, insert the following:
initctl emit power-button-press
The top of the file should now look like this:
#!/bin/sh
# /etc/acpi/powerbtn.sh
# Initiates a shutdown when the power putton has been
# pressed.
initctl emit power-button-press
[ -r /usr/share/acpi-support/power-funcs ] && . /usr/share/acpi-support/power-funcs
# If logind is running, it already handles power button presses; desktop
# environments put inhibitors to logind if they want to handle the key
# themselves.
if pidof systemd-logind >/dev/null; then
exit 0
fi
What this does is emit a signal that Upstart will use (which we are getting to next) to change the permissions on the shutdown operation. It won't inhibit the normal power button press procedure, so you will still see the usual Ubuntu Unity shutdown menu (or at least I did :P )
Save and close gedit.
Create Upstart jobs
I read somewhere that Ubuntu will be moving to systemd instead of Upstart some time in the next few releases, so this will work for 14.04 but might not for releases after this
Run this command in a terminal:
gksudo gedit /etc/init/power-button-pressed.conf
This will create a new file, which will become a task that runs when you press the power button.
Copy the following into it:
description "Allow shutdown when power button is pressed"
start on power-button-press
stop on shutdown
emits power-button-timeout
task
script
mv /etc/polkit-1/localauthority/50-local.d/disable-shutdown.pkla /etc/polkit-1/localauthority/50-local.d/disable-shutdown.ignore 2> /dev/null
mv /etc/polkit-1/localauthority/50-local.d/disable-suspend.pkla /etc/polkit-1/localauthority/50-local.d/disable-suspend.ignore 2> /dev/null
sleep 1m
initctl emit power-button-timeout
end script
pre-stop script
initctl emit power-button-timeout
end script
Save and close this, and then run:
gksudo gedit /etc/init/power-button-restore.conf
And paste this into it:
description "Re-disable shutdown, on boot or when signalled"
start on (power-button-timeout or local-filesystems)
task
script
mv /etc/polkit-1/localauthority/50-local.d/disable-shutdown.ignore /etc/polkit-1/localauthority/50-local.d/disable-shutdown.pkla 2> /dev/null
mv /etc/polkit-1/localauthority/50-local.d/disable-suspend.ignore /etc/polkit-1/localauthority/50-local.d/disable-suspend.pkla 2> /dev/null
end script
These will temporarily rename the security policy files so that they are ignored, thus enabling user shutdown, restart, suspend and hibernate. This can, of course, be modified as you please to only enable some of these. After one minute, the files will be renamed back to what they should be, thus disabling user power management once more. The pre-stop section should restore the permissions on shutdown. If not, the second Upstart job will run on boot to restore the policy.
That's all there is to it! For the users on this machine, I've also hidden the shutdown option from the device menu, so users only see a "log out" option. Run dconf-editor
, navigate to "apps" > "indicator-session" and tick "suppress-restart-menuitem" and "suppress-shutdown-menuitem". This does nothing for the permissions, it just helps to not confuse people when they press "Shut Down" and it doesn't work.
So, to clarify, now when the power button is pressed, the user will be presented with the Ubuntu power menu, which if shutdown and reboot have been supressed will only show a log out option. Choose to log out, and then from the login screen the shutdown menu will work and the computer can be turned off, for one minute only.