10

In 12.04 it was possible to prevent system shutdown or reboot from the login screen by adding the following restrictions in /etc/polkit-1/localauthority/50-local.d (adapted from here):

[Disable lightdm PowerMgmt]
Identity=unix-user:lightdm
Action=org.freedesktop.consolekit.system.restart;org.freedesktop.consolekit.system.stop
ResultAny=no
ResultInactive=no
ResultActive=no

With 14.04, this rule seems to have no effect anymore. Any advice how to implement the restriction?

Community
  • 1
Alex
  • 201

1 Answers1

10

I think I've found the cause: the action seems to have changed to "org.freedesktop.login1.reboot" (and the-like).

Adding the following lines as /etc/polkit-1/localauthority/50-local.d/restrict-login-powermgmt.pkla works:

[Disable lightdm PowerMgmt]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot;org.freedesktop.login1.reboot-multiple-sessions;org.freedesktop.login1.power-off;org.freedesktop.login1.power-off-multiple-sessions;org.freedesktop.login1.suspend;org.freedesktop.login1.suspend-multiple-sessions;org.freedesktop.login1.hibernate;org.freedesktop.login1.hibernate-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

You still see a confirmation dialog but there are not buttons to confirm. Looks ugly, but works ;)

Unfortunately this applies to all users, not only the lightdm session, so you have to add a second rule to white-list them if desired.

Note that this method block solely reboot/etc commands issued from GUI. To block reboot/etc commands from command line one may use molly-guard - as explained in Disabling shutdown command for all users, even root - consequences?

Community
  • 1
Alex
  • 201
  • I appreciate this is old, but it is still useful! Followup question - another post:

    https://askubuntu.com/questions/137336/how-do-i-remove-the-shutdown-button-only-on-the-login-screen?noredirect=1&lq=1

    Talks about just removing the buttons on the pre-login screen. Is there a way of combining the two posts to re-enable the button on the login screen, but not having it when users are logged in (useful for remote accessed systems where being able to shutdown from the console would be good)

     – Michael Firth Nov 28 '17 at 15:11
  • 1
    As another data point, I just used this successfully on the new Ubuntu 18.04.1 LTS, to disallow shutdown and reboot (but allow hibernate and suspend). Note that I needed to use these 'login1' names; that I also disabled 'halt' and 'halt-multiple-sessions'; that I did that because I found those actions in /usr/share/polkit-1/actions/org.freedesktop.login1.policy; and finally, that in Ubuntu 18.04's gdm3 UI, the buttons in the confirmation dialog are not hidden, but they simply have no effect. – MarnixKlooster ReinstateMonica Aug 07 '18 at 19:12