18

For whatever reason, we do no longer need to be root (or using sudo) to run /sbin/shutdown, /sbin/reboot etc.

This seems to be because those executables are now symlinks to /bin/systemctl which handles everything as normal user.

However, what if I want shutdown and reboot to require root authentication again? How can I achieve this?

4
  • 3
    I'd guess polkit rules. Modify askubuntu.com/a/570969/158442 as per need (use pkaction | grep login1 for other rules of interest)
    – muru
    Jun 19, 2016 at 19:17
  • 3
    (an example of rules for requiring admin privileges: askubuntu.com/a/744094/158442)
    – muru
    Jun 19, 2016 at 19:38
  • 1
    Isn't this a only if you are the only person logged in. If there is anyone else logged in the system you will be asked to put in the root password.
    – ognjen011
    Jul 21, 2016 at 11:51
  • That may be not the answer you are expecting, but a similar behaviour can be caused by another admin user having editted your '/etc/sudoers'. If this is what is causing your issue then you can change it back by typing sudo visudo and check if there is a line with the path to these executables.
    – Damien
    Feb 4, 2017 at 17:00

5 Answers 5

5

Systemd does indeed handle the shutdown, reboot and other commands, and the default privileges assigned are permissive. To change this, you need to create a Polkit rule. Create a .pkla file in /etc/polkit-1/localauthority/50-local.d (say, confirm-shutdown.pkla) containing:

[Confirm shutdown]
Identity=unix-user:*
Action=org.freedesktop.login1.*
ResultActive=auth_admin_keep

The various shutdown, reboot, etc. commands are, in Polkit terms, actions in org.freedesktop.login1, for example, org.freedesktop.login1.power-off, org.freedesktop.login1.reboot, etc. The specific problem here is the default configuration, which is in /usr/share/polkit-1/actions/org.freedesktop.login1.policy:

<action id="org.freedesktop.login1.power-off">
        <description>Power off the system</description>
        ...
        <defaults>
                <allow_any>auth_admin_keep</allow_any>
                <allow_inactive>auth_admin_keep</allow_inactive>
                <allow_active>yes</allow_active>
        </defaults>

Note that it allows the active user to power off, reboot, etc.

0

You can use chmod command.

  • If you want to give access to only root, you can write:

    chmod 700 directory/to/the/file
    
  • If you want to give permisson to the root and the sudo group then you can write:

    chmod 770 directory/to/the/file
    
  • If you want to change the group of the file from sudo to an another (like a user or admins) you need to type in:

    chown owner:group directory/to/the/file
    
  • If you want to revert back, run:

    chown root:sudo filedirectory 
    

Note: you may have to use sudo to these command, or have logged in the root account

2
  • Note that attempting to change the permissions of the link will change the permissions of the target (in this case /bin/systemctl) so running chmod /sbin/shutdown will impact all the links pointing to /bin/systemctl as the permissions to bin/systemctl will be changed as confirmed by the command $ ll /bin/systemctl -rwx------ 1 root root 659848 Jan 18 16:04 /bin/systemctl*
    – Elder Geek
    Feb 13, 2017 at 19:08
  • If you need to change it back, the default permissions are -rwxr-xr-x 1 root root 659848 Jan 18 16:04 /bin/systemctl
    – Elder Geek
    Feb 13, 2017 at 20:36
0

As changing permissions of a symlink on a Linux system doesn't change the permissions of the link but instead the file it points to (In Ubuntu at least). I would think the safest way to accomplish this would be to remove the link, and recreate it with the required umask to obtain the result you desire.

Another related post can be found here

-1

You can make a script that checks if user is running it with root permissions or not.
Then it will run systemctl command or return error.

#!/bin/bash
if [ "$(whoami)" != "root" ]; then
    echo "Sorry, you are not root."
    exit 1
else
    (systemctl shutdown command)
fi

Source

1
  • 4
    What's to stop a non-root user from simply bypassing this script? Jul 19, 2016 at 23:12
-1

Try to change its permissions in terminal. You could make it executable only by by a certain group, such as wheel or admin. Sadly (or perhaps fortunately), a file can only have one group ownership so chown simply wouldn't work by itself. Try "sudo chown root:wheel /sbin/shutdown" and then "sudo chmod g+x /sbin/shutdown". This will make the file executable only by root and admins(shudders) and sudoers will be required to enter their passwords.

3
  • 2
    The "wheel" group is a thing of Arch Linux and maybe other distributions, but definitely not on Ubuntu btw.
    – Byte Commander
    Jul 14, 2016 at 7:01
  • 2
    This is not effective. A user can just download a systemctl binary from somewhere else, and run that instead. Jul 19, 2016 at 23:13
  • @Robie, you could do that with any solution. You could hold down the power button. My solution works for what he asks.
    – chevydog
    Jul 26, 2016 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .