How can I set that only root + a given user can shut down my pc?

Question

If I'm using Ubuntu 11.04, how can I configure it such that that only two users can shut down/suspend/hibernate my PC: the root user and one regular user?

Answer 1

The shutdown binary will only work for the root user. The typical approach to this is to set up sudo rules to allow the user to execute shutdown as root. Assuming the user doesn't already have full sudo permissions (the first user on an Ubuntu desktop system does, for example) you might add the following line to /etc/sudoers (using the visudo utility, for safety):

joe    hostname=(root) /sbin/shutdown -h now

If you want them to be able to shut down without being prompted for their password, then add the NOPASSWD option, like this:

joe    hostname=(root) NOPASSWD: /sbin/shutdown -h now

You can modify the way they can run shutdown by using wildcards or explicit declarations. For example shutdown -h now allows an immediate halt of the system, it will not reboot. You could allow -r instead to reboot the system.

After you configure sudoers, joe can run the following command to reboot the system:

sudo /sbin/shutdown -h now

As joe, you can run the following command to see what commands you have access to run using sudo:

sudo -l

Answer 2

To disable shutdown from the login menu, edit the /etc/gdm/gdm.conf-custom file and in the [greeter] section add SystemMenu=false. This won't affect the panel menu, though, I am not sure how to disable that without disabling it for all users, but if you disable it for all users you should be able to work around it by using the shutdown command from a terminal instead. To disable for all users, see this link; I have not verified that these instructions work on Ubuntu.

Note that there is no way to stop them from just unplugging it or pressing the power button on the front of the PC, so the trend in linux distributions for home use has been to allow these functions to all users sitting physically at the computer with no obvious way to disable it.

Answer 3

For the power button, you might want to look into /etc/acpi/events/power_button . While you are at it, you might also want to look in /etc/inittab for ctrlaltdel .