I have a laptop with Ubuntu 16.06. I am able to execute reboot command as a non-root user without sudo. How can I change this behaviour so that I am not able to run reboot without sudo? I tried checking where reboot actually points:

user:~$ which reboot
user:/sbin$ ls -l reboot
reboot -> /bin/systemctl

But I do not know how to change systemctl behaviour.

  • post results for ls -l /bin/systemctl it is probably in a group with the bit suid active for your personal user. – Luciano Andress Martini Aug 1 '17 at 14:24
  • @LucianoAndressMartini this is a regular executable file. – Mikhail Aug 1 '17 at 14:24
  • Because that you need to post the ls -l for it. – Luciano Andress Martini Aug 1 '17 at 14:25
  • user:/sbin$ ls -l /bin/systemctl returns -rwxr-xr-x 1 root root 659848 feb 15 16:11 /bin/systemctl – Mikhail Aug 1 '17 at 14:31
  • Try that: chmod o-x /bin/systemctl and guarantee your user are not in the group root. – Luciano Andress Martini Aug 1 '17 at 14:41

This is not a matter of changing systemctl. That is a red herring. systemctl queries the "Policy Kit" to determine whether a particular user, logged on in particular way, is allowed to reboot the system. You need to change, in Policy Kit, who is permitted to run the org.freedesktop.login1.reboot action. You probably want to change the rules for the three classes of log-on from yes to auth_admin (or auth_admin_keep).

Further reading

  • Could you expand in your answer on how exactly should I change the rules for the three classes? I have visited all three links you provided, but there is no explanation or examples of how actually do what I want. – Mikhail Aug 3 '17 at 8:36

My trick is to add the following alias in the .bashrc

alias reboot='echo "Your account is not allowed to run the reboot command without sudo"'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.