Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say that you have set up a multi-seat system for use in a school or library, allowing GDM to launch multiple X sessions to run simultaneously with different users/keyboards/monitors.

By default in Debian/Ubuntu in Gnome, you don't have to be root to shutdown or reboot. But this means any user can choose "reboot" or "shutdown" and kick off the other three users.

You have blocked physical access to the server so they can't simply push the power or reset buttons.

What is the correct way of disabling the "shutdown" and "reboot" functionality which is exposed to regular users through GDM/Gnome/whatever window manager you're using?

share|improve this question
What if they pull the plug? – wizlog Nov 7 '11 at 7:20
@wizlog, see "You have blocked physical access to the server". This goes for its power plug too. – thomasrutter Nov 7 '11 at 22:09
up vote 2 down vote accepted

First, note that ConsoleKit's shutdown function considers "single user" and "multiple users" as two different situations – shutting down the system always requires administrator authentication if other users are logged in.

All such actions are managed by PolicyKit. If you want to adjust the policies, you can do so as described in polkit(8) – /etc/polkit-1/rules.d/20-disallow-shutdown.rules:

polkit.addRule(function(action, subject) {
    if (( == "org.freedesktop.consolekit.system.stop" || == "org.freedesktop.consolekit.system.restart") &&
        subject.isInGroup("users")) {
            return ? polkit.Result.AUTH_ADMIN : polkit.Result.NO;

PolicyKit 0.105 and earlier versions document this in pklocalauthority(8)/etc/polkit-1/localauthority/50-local.d/20-disallow-shutdown.pkla:

[Disallow shutdown]

The Actions are listed in the ConsoleKit policy file or by running pkaction.

share|improve this answer

pklocalauthority is deprecated

You need systemd with logind and polkit.

Available actions

pkaction (or /usr/share/polkit-1/actions/)

You should look at /usr/share/polkit-1/actions/org.freedesktop.login1.policy

Let's monitor system messages

journalctl -f

Then create file /etc/polkit-1/rules.d/60-noreboot_norestart.rules (in javascript), it will restrict it to su or users in group power

polkit.addRule(function(action, subject) {
    if ( == "org.freedesktop.login1.reboot" || == "org.freedesktop.login1.reboot-multiple-sessions" || == "org.freedesktop.login1.power-off" || == "org.freedesktop.login1.power-off-multiple-sessions") {
        if (subject.isInGroup("power")) {
            return polkit.Result.YES;
        } else {
            return polkit.Result.AUTH_ADMIN;

Rule should be loaded and it should work





share|improve this answer
Are you sure that needs to be return polkit.Result.NO? I would've thought it'd be polkit.Result.YES to allow users in group "power" – ffledgling Aug 28 '14 at 17:32
@ffledgling That's correct. I've edited the answer to reflect this, and to add a missing curly brace. – Legooolas Nov 5 '14 at 16:25
It's also possible to use "NO" instead of "AUTH_ADMIN" to disable the menu on the login screen entirely, and the "org.freedesktop.login1.suspend" and "org.freedesktop.login1.suspend-multiple-sessions" options for controlling the Suspend menu item. – Legooolas Nov 5 '14 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .