5

I have a laptop with Ubuntu 16.06. I am able to execute reboot command as a non-root user without sudo. How can I change this behaviour so that I am not able to run reboot without sudo? I tried checking where reboot actually points:

user:~$ which reboot
/sbin/reboot
user:/sbin$ ls -l reboot
reboot -> /bin/systemctl

But I do not know how to change systemctl behaviour.

Improve this question
7
  • post results for ls -l /bin/systemctl it is probably in a group with the bit suid active for your personal user.
    – Luciano Andress Martini
    Aug 1, 2017 at 14:24
  • @LucianoAndressMartini this is a regular executable file.
    – Mikhail
    Aug 1, 2017 at 14:24
  • Because that you need to post the ls -l for it.
    – Luciano Andress Martini
    Aug 1, 2017 at 14:25
  • user:/sbin$ ls -l /bin/systemctl returns -rwxr-xr-x 1 root root 659848 feb 15 16:11 /bin/systemctl
    – Mikhail
    Aug 1, 2017 at 14:31
  • Try that: chmod o-x /bin/systemctl and guarantee your user are not in the group root.
    – Luciano Andress Martini
    Aug 1, 2017 at 14:41

2 Answers 2

Reset to default
5

This is not a matter of changing systemctl. That is a red herring. systemctl queries the "Policy Kit" to determine whether a particular user, logged on in particular way, is allowed to reboot the system. You need to change, in Policy Kit, who is permitted to run the org.freedesktop.login1.reboot action. You probably want to change the rules for the three classes of log-on from yes to auth_admin (or auth_admin_keep).

Further reading

Improve this answer
2
  • Could you expand in your answer on how exactly should I change the rules for the three classes? I have visited all three links you provided, but there is no explanation or examples of how actually do what I want.
    – Mikhail
    Aug 3, 2017 at 8:36
  • I can't believe how complicated it is to configure the system to disallow non-root users from being able to reboot or shutdown.
    – Michael Burr
    Sep 5, 2020 at 11:33
0

My trick is to add the following alias in the .bashrc

alias reboot='echo "Your account is not allowed to run the reboot command without sudo"'

Improve this answer
1
  • 1
    This easy solution worked for me. Note: I am not trying to make it impossible to run reboot for security reasons, simply I like to accidentally type reboot and lose all my work without expecting it!
    – benathon
    Jul 3, 2020 at 6:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .