I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host.
In OpenBSD, I use polkit org.xfce.session.policy
with a rule file to prevent such actions.
I need to find how to do this in Debian Testing (aka Buster).
I found org.freedesktop.login1.policy
with actions
org.freedesktop.login1.power-off
org.freedesktop.login1.power-off-multiple-sessions
.
and made rule files for these actions but it does not block shutdown or restart.
It seems to me that polkit is not responsible alone for these actions.
I don't know where to look for this; perhaps systemd or PAM ?
EDIT
On OpenBSD and NetBSD, by default, nobody is allowed to shutdown or reboot from GUI.
You must create a rule file in /usr/local/share/polkit-1/rules.d/
like this one :
polkit.addRule (function (action, subject) {
if (action.id == "org.xfce.session.xfsm-shutdown-helper")
{
return polkit.Result.YES;
}
});
On Debian, by default, all users can shutdown or reboot from GUI.
There is no rule file for org.xfce.session.xfsm-shutdown-helper
or org.freedesktop.login1.power-off
.
I try to add my rule file with return polkit.Result.NO;
with no avail
On debian, i use lightdm
and on BSD, i use xdm
.
polkit
usesjs
syntax as opposed to the olderpolicykit
ini-style...logind
executes those actions as long as the polkit authorization allows it