I want to disable "shutdown" and "poweroff" CLI commands in Ubuntu for a specific user. How to do it?
1
1 Answer
If you are just on the command line, removing the user from the sudo/admin/wheel group may be enough since shutdown, poweroff and reboot need root privileges.
If we are talking about desktop sessions (or sessions otherwise handled by login managers such as consolekit or logind), this may become a little more complicated. In this case adjust your system's polkit rules as described here (or create them if they don't exist): https://askubuntu.com/questions/93542/how-to-disable-shutdown-reboot-suspend-hibernate
But make sure, the user you want to restrict has no other method of gaining root access (i.e. you also need to prevent him from using sudo). Otherwise he can just override or change these settings.
Edit: for a more up to date example with new JS config format, see https://wiki.archlinux.org/index.php/Polkit#Disable_suspend_and_hibernate
If you are using systemd (probably not when this is about Ubuntu), the action ids may also be different (starting with org.freedesktop.login1.xxx instead of org.freedesktop.consolekit.xxx). For a list of logind actions, have a look at https://www.freedesktop.org/wiki/Software/systemd/logind/
-
A quick way know what the actions would be:
pkaction | grep shutdown, etc.– muruFeb 17, 2016 at 20:57 -
Actually I want the user to be able to issue all other commands except shutdown, poweroff and reboot on Ubuntu Feb 18, 2016 at 13:19
-
As I said, you can disable those commands for him with polkit if the user cannot gain root privileges. If he can, he'd be able to circumvent or completely disable any restrictions. On the other hand, , you can also grant certain other privileges to non-root users if there is a daemon that implements the needed polkit actions. Feb 18, 2016 at 13:39
sudo. Remove her/him from thesudoandadmingroups.