3

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host.

In OpenBSD, I use polkit org.xfce.session.policy with a rule file to prevent such actions.

I need to find how to do this in Debian Testing (aka Buster).
I found org.freedesktop.login1.policy with actions

  • org.freedesktop.login1.power-off
  • org.freedesktop.login1.power-off-multiple-sessions.

and made rule files for these actions but it does not block shutdown or restart.
It seems to me that polkit is not responsible alone for these actions.

I don't know where to look for this; perhaps systemd or PAM ?

EDIT

On OpenBSD and NetBSD, by default, nobody is allowed to shutdown or reboot from GUI.
You must create a rule file in /usr/local/share/polkit-1/rules.d/ like this one :

polkit.addRule (function (action, subject) {
    if (action.id == "org.xfce.session.xfsm-shutdown-helper")
    {
        return polkit.Result.YES;
    }
});

On Debian, by default, all users can shutdown or reboot from GUI.
There is no rule file for org.xfce.session.xfsm-shutdown-helper or org.freedesktop.login1.power-off.

I try to add my rule file with return polkit.Result.NO; with no avail
On debian, i use lightdm and on BSD, i use xdm.

4
  • What kind of rule files are you using ? polkit uses js syntax as opposed to the older policykit ini-style... Commented Dec 26, 2018 at 21:26
  • 1
    I use js syntax pkexec version 0.105
    – ctac_
    Commented Dec 26, 2018 at 21:52
  • If you have the right rules there's nothing else. logind executes those actions as long as the polkit authorization allows it Commented Dec 26, 2018 at 21:53
  • @K7AAY - what is the point of linking to wikipedia articles ? Those projects have their own sites, you know... Commented Dec 26, 2018 at 21:56

1 Answer 1

1

Debian Testing Buster use polkit 1.05, so there is no rule files and no js syntax.
You must use the old policykit ini-style.
To prevent users to start shutdown or reboot when another user is logged in,
you must create two pkla files in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_power-off-multiple-sessions.pkla 
[Reject all users to use login1_power-off-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.power-off-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_reboot-multiple-sessions.pkla
[Reject all users to use login1_reboot-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

But, it is not enough, because xfce too install a action to shutdown or reboot in /usr/share/polkit-1/actions/org.xfce.session.policy.
You must also create a pkla file for this action in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_Use_Xfce_Session_Policy.pkla 
[Reject all users to use xfce_session_policy]
Identity=unix-user:*
Action=org.xfce.session.xfsm-shutdown-helper
ResultAny=no
ResultInactive=no
ResultActive=no
1
  • Do you need to restart polkitd afterwards?
    – Nils
    Commented Oct 17, 2022 at 14:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .