limiting shutdown/reboot permissions

2 days ago by muusemuuse to c/linux

I have a fedora workstation pac connected to the living room tv, running some server duties in the house and playing games over streaming and on the tv it is connected to.

I want to forbid reboot/shutdown from the UI. I want only sudo in the terminal to be able to do that.

I'm no certain of the best way to do that. I cant go just hiding the options on a per UI basis as I'll be playing whack-a-mole until I'm dead. Instead, Id like things like plasma and steam to understand they aren't permitted to make that request, but if they try anyway, the OS just ignores them.

Ooops 15 points 2 days ago

I don't know if Fedora (or plasma) do things differently but the normal default is that you need sudo to reboot/shutdown/etc.

Then on basically all distros using systemd this behavior is modified via logind session and polkit. So the first thing to look at would be if a shutdown rule exists in /etc/polkit-1/rules.d/ that allow users in a certain group to shutdown/reboot in the first place.

Mine looks like this:

/etc/polkit-1/rules.d/50-shutdown.rules
polkit.addRule(function(action, subject) {
if ((action.id == "shutdown" ||
action.id == "reboot") &&
subject.isInGroup("wheel"))
{
return polkit.Result.YES;
}
});

So every user in the wheel group can do it without password prompt. Without this UI elements for shutdown/reboot will try assuming they have the right but simply fail.

save

path: 0 25351371, hotness: undefined, score: 15, children: 2

eldavi 6 points 2 days ago

@muusemuuse@sh.itjust.works this plus the display manager too if there is one since it runs as root. if you're using gnome, there's a gdm.conf somewhere in /etc where you can disable the power/reboot.

save

path: 0 25351371 25351707, hotness: undefined, score: 6, children: 1

muusemuuse 1 point 2 days ago

It’s plasma (normal, big screen and maybe mobile in a future project)

save

path: 0 25351371 25351707 25358972, hotness: undefined, score: 1, children: 0

MonkderVierte 8 points 2 days ago

You'd probably want to look into dbus or PAM.

Or google, how people fixed that they were not able to shutdown from GUI. That's a more common occurence than limiting it.

save

path: 0 25355129, hotness: undefined, score: 8, children: 0

CameronDev 5 points 2 days ago

systemd-inhibit seems like the right place to look, but I have a vague feeling that gnome can override it.

https://www.freedesktop.org/...

Maybe with some tweaking itll be unoveridable except for root?

save

path: 0 25351300, hotness: undefined, score: 5, children: 0

limelight79 4 points 2 days ago

Uh keep in mind they could just unplug the computer. Software limits are good, but if they really want to shut it off, they'll find a way.

save

path: 0 25360306, hotness: undefined, score: 4, children: 1

muusemuuse 2 points a day ago

Physical access is not the concern I’m focused on here.

save

path: 0 25360306 25364436, hotness: undefined, score: 2, children: 0

corsicanguppy 3 points 2 days ago

They're gonna tap the power button anyway.

save

path: 0 25360661, hotness: undefined, score: 3, children: 1

muusemuuse 2 points a day ago

Which you can set to be ignored. Besides, it’s not in the living room. It’s in the basement below it.

save

path: 0 25360661 25364434, hotness: undefined, score: 2, children: 0

TrollAccount69 0 points 14 hours ago

You’re barking up the wrong tree and fucking up your life by doing this.

Split the streaming/gaming duty to a different device that can be operated in the way the user expects.

Wherever you disconnect shutdown signals from will be relied upon by something down the road and you’ll end up with a weird messed up broken update when that happens.

save

path: 0 25379122, hotness: undefined, score: 0, children: 0

Rules

Related Communities

Rules

Related Communities