I am using Ubuntu 16.04.

There is a file located at /usr/share/polkit-1/actions/org.freedesktop.login1.policy which seems to control the permissions regarding shutdown/suspend/hibernate options.

In this file, the revelant options are in this format:


corresponding to every action (shutdown, suspend etc.).
Here is the full version of that file.

I want to know the meaning of allow_any, allow_inactive and allow_active options.
What do they mean exactly ?

The reason for my curiosity is that I want to hibernate non-interactively without root (from cron), but am getting authorization errors.

And it seems that those errors can be solved by modifying this file.

2 Answers 2


This link contains the information given by the other answer in a better way.

Especially this part:

The defaults tag is where the permissions or lack thereof are located.
It contains three settings: allow_any, allow_inactive, and allow_active.
Inactive sessions are generally remote sessions (SSH, VNC, etc.) whereas active sessions are logged directly into the machine on a TTY or an X display.
allow_any is the setting encompassing both scenarios.

For each of these settings the following options are available:

no: The user is not authorized to carry out the action. There is therefore no need for authentication.
yes: The user is authorized to carry out the action without any authentication.
auth_self: Authentication is required but the user need not be an administrative user.
auth_admin: Authentication as an administrative user is require.
auth_self_keep: The same as auth_self but, like sudo, the authorization lasts a few minutes.
auth_admin_keep: The same as auth_admin but, like sudo, the authorization lasts a few minutes.

Also, here is the official manual page of polkit.

Hibernation can be made to be turned on from cron by changing the no to yes inside the allow_any tags under the actions org.freedesktop.login1.hibernate and org.freedesktop.login1.hibernate-multiple-sessions.

But this is not a recommended solution as it can be erased during future upgrades.

Instead you can make a file containing the following:

[Enable hibernate to be run via cron]

named com.0.enable-hibernation-from-cron.pkla in the directory /etc/polkit-1/localauthority/50-local.d/ to achieve the same effect.

An even better solution using visudo is given here.

  • This is the better answer than the other one with copy-pasting man page. Great job done!
    – Anwar
    Aug 19, 2016 at 14:19
  • @Anwar Thanks! I accepted that answer because firstly, it made me aware about polkit without which my answer wouldn't have been possible, and secondly, accepting my own answer seemed a bit weird. Aug 19, 2016 at 14:24
  • 1
    In my opinion, the correct and most accurate answer should be accepted. That helps future visitor. Since here only 2 answer is given, I see no problem.
    – Anwar
    Aug 19, 2016 at 14:29

From section DECLARING ACTIONS of polkit - Authorization Framework:


       This element is used to specify implicit authorizations for

       Elements that can be used inside defaults includes:

           Implicit authorizations that apply to any client. Optional.

           Implicit authorizations that apply to clients in inactive
           sessions on local consoles. Optional.

           Implicit authorizations that apply to clients in active
           sessions on local consoles. Optional.

       Each of the allow_any, allow_inactive and allow_active elements can
       contain the following values:

           Not authorized.


           Authentication by the owner of the session that the client
           originates from is required.

           Authentication by an administrative user is required.

           Like auth_self but the authorization is kept for a brief

           Like auth_admin but the authorization is kept for a brief

I hope this makes it clear for you.

  • 1
    What is a session exactly ? What is the difference between active and inactive sessions ? What values do I use to solve the problem I mentioned at the end ? Jun 11, 2016 at 10:22
  • Are you using systemctl hibernate command?
    – coffeMug
    Jun 11, 2016 at 11:17
  • Yes. I am using that. Jun 11, 2016 at 11:20
  • OK I don't have that command in my system to test. What if you try the command when you are the only locally logged in user. Do you get the same error?
    – coffeMug
    Jun 11, 2016 at 11:22
  • As far as I know, I am the only logged in user. I am running it on my personal laptop. I ran w and uptime from cron and got indication of 1 user only. Jun 11, 2016 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.