/sbin and I see that
shutdown has permissions
rwxr-xr-x. Doesn't this mean that anyone can execute it?
Anyone can execute
shutdown, but triggering a system shutdown requires root privileges. But
shutdown is not setuid, and so only root can successfully execute it. The
shutdown program is nice enough to check your privileges and let you know if there is a problem, but even if it naively tried a system shutdown, nothing would happen.
GLENDOWER: I can call spirits from the vasty deep.
HOTSPUR: Why, so can I, or so can any man; But will they come when you do call for them?
(from Henry IV)
shutdown is no different from
/bin/rm. Everyone can execute it, but a regular user cannot remove
/etc, or another user's home directory.
Specifically: Only a process running with root privileges (effective UID 0) can direct the init system to stop system services, terminate all user processes, and issue the system call that actually stops the machine. (If
shutdown was setuid, it would run as root no matter who invokes it; but it is not.)
What about calling
shutdown from a GUI, e.g. with control-alt-del? It's important to realize that in that case,
shutdown is started directly by
init and it runs with root privileges. So everyone who walks up to the console could potentially shut it down. If this is not desirable, control-alt-delete will actually run
shutdown -a. (See the documentation that @some1 quoted in their answer). That tells
shutdown to check whether the currently logged in user is authorized to run it. But this is only relevant because
shutdown is running as root in this scenario.
shutdown itself checks if your UID is 0.
See the strace output of:
strace /sbin/shutdown -r -h now ... ... geteuid() = 10001 setuid(10001) = 0 getuid() = 10001 write(2, "shutdown: Need to be root\n", 26shutdown: Need to be root ) = 26 exit_group(1) = ?
Yes ! Everybody can run that command. As you said, you're able to run it but you're faced with a "Need to be root" message, not a
permission denied. The
shutdown command checks your
UID to see if you're root, or not.
It appears that shutdown will check an access list if you flag it with -a:
ACCESS CONTROL shutdown can be called from init(8) when the magic keys CTRL-ALT-DEL are pressed, by creating an appropriate entry in /etc/inittab. This means that every‐ one who has physical access to the console keyboard can shut the system down. To prevent this, shutdown can check to see if an authorized user is logged in on one of the virtual consoles. If shutdown is called with the -a argument (add this to the invocation of shutdown in /etc/inittab), it checks to see if the file /etc/shutdown.allow is present. It then compares the login names in that file with the list of people that are logged in on a virtual console (from /var/run/utmp). Only if one of those authorized users or root is logged in, it will proceed. Otherwise it will write the message shutdown: no authorized users logged in to the (physical) system console. The format of /etc/shutdown.allow is one user name per line. Empty lines and comment lines (prefixed by a #) are allowed. Currently there is a limit of 32 users in this file.
Since you're currently calling it without the -a flag, it's defaulting to allowing root shutdowns only.
If you want additional users to be able to run the command, configure that file and use the flag.
Why can't I execute shutdown when the permission is rwxr-xr-x?
Permission bits don't necessarily exclude access control based on a user or group.
protected by Michael Mrozek♦ Dec 7 '13 at 0:02
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?