1

I want to disable "shutdown" and "poweroff" CLI commands in Ubuntu for a specific user. How to do it?

1
  • 3
    Don't give that user sudo. Remove her/him from the sudo and admin groups.
    – kba
    Feb 17, 2016 at 16:28

1 Answer 1

2

If you are just on the command line, removing the user from the sudo/admin/wheel group may be enough since shutdown, poweroff and reboot need root privileges.

If we are talking about desktop sessions (or sessions otherwise handled by login managers such as consolekit or logind), this may become a little more complicated. In this case adjust your system's polkit rules as described here (or create them if they don't exist): https://askubuntu.com/questions/93542/how-to-disable-shutdown-reboot-suspend-hibernate

But make sure, the user you want to restrict has no other method of gaining root access (i.e. you also need to prevent him from using sudo). Otherwise he can just override or change these settings.

Edit: for a more up to date example with new JS config format, see https://wiki.archlinux.org/index.php/Polkit#Disable_suspend_and_hibernate

If you are using systemd (probably not when this is about Ubuntu), the action ids may also be different (starting with org.freedesktop.login1.xxx instead of org.freedesktop.consolekit.xxx). For a list of logind actions, have a look at https://www.freedesktop.org/wiki/Software/systemd/logind/

3
  • A quick way know what the actions would be: pkaction | grep shutdown, etc.
    – muru
    Feb 17, 2016 at 20:57
  • Actually I want the user to be able to issue all other commands except shutdown, poweroff and reboot on Ubuntu
    – asm_nerd1
    Feb 18, 2016 at 13:19
  • As I said, you can disable those commands for him with polkit if the user cannot gain root privileges. If he can, he'd be able to circumvent or completely disable any restrictions. On the other hand, , you can also grant certain other privileges to non-root users if there is a daemon that implements the needed polkit actions. Feb 18, 2016 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.