4

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host.

In OpenBSD, I use polkit org.xfce.session.policy with a rule file to prevent such actions.

I need to find how to do this in Debian Testing (aka Buster).
I found org.freedesktop.login1.policy with actions

  • org.freedesktop.login1.power-off
  • org.freedesktop.login1.power-off-multiple-sessions.

and made rule files for these actions but it does not block shutdown or restart.
It seems to me that polkit is not responsible alone for these actions.

I don't know where to look for this; perhaps systemd or PAM ?

EDIT

On OpenBSD and NetBSD, by default, nobody is allowed to shutdown or reboot from GUI.
You must create a rule file in /usr/local/share/polkit-1/rules.d/ like this one :

polkit.addRule (function (action, subject) {
    if (action.id == "org.xfce.session.xfsm-shutdown-helper")
    {
        return polkit.Result.YES;
    }
});

On Debian, by default, all users can shutdown or reboot from GUI.
There is no rule file for org.xfce.session.xfsm-shutdown-helper or org.freedesktop.login1.power-off.

I try to add my rule file with return polkit.Result.NO; with no avail
On debian, i use lightdm and on BSD, i use xdm.

0

Debian Testing Buster use polkit 1.05, so there is no rule files and no js syntax.
You must use the old policykit ini-style.
To prevent users to start shutdown or reboot when another user is logged in,
you must create two pkla files in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_power-off-multiple-sessions.pkla 
[Reject all users to use login1_power-off-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.power-off-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_reboot-multiple-sessions.pkla
[Reject all users to use login1_reboot-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

But, it is not enough, because xfce too install a action to shutdown or reboot in /usr/share/polkit-1/actions/org.xfce.session.policy.
You must also create a pkla file for this action in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_Use_Xfce_Session_Policy.pkla 
[Reject all users to use xfce_session_policy]
Identity=unix-user:*
Action=org.xfce.session.xfsm-shutdown-helper
ResultAny=no
ResultInactive=no
ResultActive=no

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.