Crumb
c/linux · by user_naa@lemmy.world · 1y

Desiable shutdown for users

Hello! Halt on Linux is disabled for average user by default. It will try to request sudo/root password and if fails returns:

sasha@fedora:~$ systemctl halt
Call to Halt failed: Access denied

How can I make same behavior for poweroff action? I know it is possible somehow via PolicyKit rulle

24 points · 11 comments · view on lemmy.world

11 Comments

InEnduringGrowStrong@sh.itjust.works · 13 pts · 1y (2 replies)

Edit the sudoers file.

## user is allowed to execute halt and reboot 
whateverusername ALL=NOPASSWD: /sbin/halt, sbin/reboot, /sbin/poweroff
possiblylinux127@lemmy.zip · 5 pts · 1y (1 reply)

Just make sure to use visudo

InEnduringGrowStrong@sh.itjust.works · 1 pts · 1y

Indeed

progandy@feddit.org · 8 pts · 1y (3 replies)

The relevant polkit policies should be defined here: https://github.com/systemd/systemd/blob/main/src/login/org.freedesktop.login1.policy

Disabling is done with some rules like this: https://bbs.archlinux.org/viewtopic.php?id=152565

polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.login1.power-off") == 0) {
    return polkit.Result.AUTH_ADMIN;
  }
});

Some other examples: https://gist.github.com/grawity/3886114

user_naa@lemmy.world · 2 pts · 1y (2 replies)

Thank you, it works! But I got weird behavior:

  1. User sddm also cannot execute poweroff (it is ok) but if I press shutdown button in sddm it will poweroff (not ok).
  2. If I press shut down in KDE Plasma I will get black screen and no sddm (I can restart it with systemctl restart sddm from tty and it will work again) How can I fix this bugs?
progandy@feddit.org · 1 pts · 1y (1 reply)

Sorry, I have no idea.

user_naa@lemmy.world · 1 pts · 1y

SDDM main process is running as root and ignores all policies. So only way is modifying SDDM source code(

BaalInvoker@lemmy.eco.br · 5 pts · 1y (1 reply)

What if you try another interface, like shutdown -P now or poweroff -p?

user_naa@lemmy.world · 5 pts · 1y

They all operates some way through systemd, so if operation is disabled via policy you cannot bypass it.

sasha@fedora:~$ /sbin/halt
Call to Halt failed: Interactive authentication required.
pelya@lemmy.world · 3 pts · 1y

What about systemctl poweroff ?

death_to_carrots@feddit.org · 1 pts · 1y

Well, the logic in polkit is, if you have direct physical access to the machine (not SSH, actual keyboard, and so on), in general nothing stops you from just pressing and holding the power button. So giving a local user the right doesn't make worse.

To disable the behaviour you need to find the appropriate polkit rule in /usr/{lib,share}/polkit-1/rules.d and create a file with the same name in /etc/polkit-1/rules.d pointing to /dev/null.