18

For whatever reason, we do no longer need to be root (or using sudo) to run /sbin/shutdown, /sbin/reboot etc.

This seems to be because those executables are now symlinks to /bin/systemctl which handles everything as normal user.

However, what if I want shutdown and reboot to require root authentication again? How can I achieve this?

  • 3
    I'd guess polkit rules. Modify askubuntu.com/a/570969/158442 as per need (use pkaction | grep login1 for other rules of interest) – muru Jun 19 '16 at 19:17
  • 3
    (an example of rules for requiring admin privileges: askubuntu.com/a/744094/158442) – muru Jun 19 '16 at 19:38
  • 1
    Isn't this a only if you are the only person logged in. If there is anyone else logged in the system you will be asked to put in the root password. – ognjen Jul 21 '16 at 11:51
  • That may be not the answer you are expecting, but a similar behaviour can be caused by another admin user having editted your '/etc/sudoers'. If this is what is causing your issue then you can change it back by typing sudo visudo and check if there is a line with the path to these executables. – Damien Feb 4 '17 at 17:00
5

Systemd does indeed handle the shutdown, reboot and other commands, and the default privileges assigned are permissive. To change this, you need to create a Polkit rule. Create a .pkla file in /etc/polkit-1/localauthority/50-local.d (say, confirm-shutdown.pkla) containing:

[Confirm shutdown]
Identity=unix-user:*
Action=org.freedesktop.login1.*
ResultActive=auth_admin_keep

The various shutdown, reboot, etc. commands are, in Polkit terms, actions in org.freedesktop.login1, for example, org.freedesktop.login1.power-off, org.freedesktop.login1.reboot, etc. The specific problem here is the default configuration, which is in /usr/share/polkit-1/actions/org.freedesktop.login1.policy:

<action id="org.freedesktop.login1.power-off">
        <description>Power off the system</description>
        ...
        <defaults>
                <allow_any>auth_admin_keep</allow_any>
                <allow_inactive>auth_admin_keep</allow_inactive>
                <allow_active>yes</allow_active>
        </defaults>

Note that it allows the active user to power off, reboot, etc.

0

You can use chmod command.

  • If you want to give access to only root, you can write:

    chmod 700 directory/to/the/file
    
  • If you want to give permisson to the root and the sudo group then you can write:

    chmod 770 directory/to/the/file
    
  • If you want to change the group of the file from sudo to an another (like a user or admins) you need to type in:

    chown owner:group directory/to/the/file
    
  • If you want to revert back, run:

    chown root:sudo filedirectory 
    

Note: you may have to use sudo to these command, or have logged in the root account

  • Note that attempting to change the permissions of the link will change the permissions of the target (in this case /bin/systemctl) so running chmod /sbin/shutdown will impact all the links pointing to /bin/systemctl as the permissions to bin/systemctl will be changed as confirmed by the command $ ll /bin/systemctl -rwx------ 1 root root 659848 Jan 18 16:04 /bin/systemctl* – Elder Geek Feb 13 '17 at 19:08
  • If you need to change it back, the default permissions are -rwxr-xr-x 1 root root 659848 Jan 18 16:04 /bin/systemctl – Elder Geek Feb 13 '17 at 20:36
0

As changing permissions of a symlink on a Linux system doesn't change the permissions of the link but instead the file it points to (In Ubuntu at least). I would think the safest way to accomplish this would be to remove the link, and recreate it with the required umask to obtain the result you desire.

Another related post can be found here

-1

You can make a script that checks if user is running it with root permissions or not.
Then it will run systemctl command or return error.

#!/bin/bash
if [ "$(whoami)" != "root" ]; then
    echo "Sorry, you are not root."
    exit 1
else
    (systemctl shutdown command)
fi

Source

  • 4
    What's to stop a non-root user from simply bypassing this script? – Robie Basak Jul 19 '16 at 23:12
-1

Try to change its permissions in terminal. You could make it executable only by by a certain group, such as wheel or admin. Sadly (or perhaps fortunately), a file can only have one group ownership so chown simply wouldn't work by itself. Try "sudo chown root:wheel /sbin/shutdown" and then "sudo chmod g+x /sbin/shutdown". This will make the file executable only by root and admins(shudders) and sudoers will be required to enter their passwords.

  • 2
    The "wheel" group is a thing of Arch Linux and maybe other distributions, but definitely not on Ubuntu btw. – Byte Commander Jul 14 '16 at 7:01
  • 2
    This is not effective. A user can just download a systemctl binary from somewhere else, and run that instead. – Robie Basak Jul 19 '16 at 23:13
  • @Robie, you could do that with any solution. You could hold down the power button. My solution works for what he asks. – chevydog Jul 26 '16 at 15:27

protected by Byte Commander Feb 4 '17 at 18:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.