First off, do note that this is not universal behavior. Not all Linux systems are configured this way, and in fact I can't name any distributions that do configure things this way by default without doing some serious research. In most cases, any given Linux system will either require root privileges regardless (this is what most systems do), or will let anyone in a particular group do it, or will just let everyone do it (though this is rare, as it's a pretty significant security hole allowing for a trivial DoS attack if a network service is compromised).
The why is pretty simple, it's very easy to accidentally shut down the system remotely when someone is trying to use it. By requiring either physical presence at the console (what you're calling a normal session) or proof of authority over the system (by authenticating via
sudo to get root privileges), the system is making it much more difficult for such a situation to happen. The implication is that by being physically present at the system or providing root credentials, you have sufficient authority that it doesn't matter if someone else is using the system.
This is somewhat more difficult to answer without knowing a lot more about the system in question, but a couple of methods come to mind:
- You can do some rather neat trickery with filesystem capabilities to allow for this, but you have to redo this every time the commands get updated.
- In the case of systemd,
poweroff are all provided by systemd, and end up being equivalent to various
systemctl subcommands. Because of this and the session tracking done by
logind, it should be possible to impose restrictions like this pretty easily.