I have a fedora workstation pac connected to the living room tv, running some server duties in the house and playing games over streaming and on the tv it is connected to.
I want to forbid reboot/shutdown from the UI. I want only sudo in the terminal to be able to do that.
I’m no certain of the best way to do that. I cant go just hiding the options on a per UI basis as I’ll be playing whack-a-mole until I’m dead. Instead, Id like things like plasma and steam to understand they aren’t permitted to make that request, but if they try anyway, the OS just ignores them.
They’re gonna tap the power button anyway.
Which you can set to be ignored. Besides, it’s not in the living room. It’s in the basement below it.
Uh keep in mind they could just unplug the computer. Software limits are good, but if they really want to shut it off, they’ll find a way.
Physical access is not the concern I’m focused on here.
You’d probably want to look into dbus or PAM.
Or google, how people fixed that they were not able to shutdown from GUI. That’s a more common occurence than limiting it.
I don’t know if Fedora (or plasma) do things differently but the normal default is that you need sudo to reboot/shutdown/etc.
Then on basically all distros using systemd this behavior is modified via logind session and polkit. So the first thing to look at would be if a shutdown rule exists in
/etc/polkit-1/rules.d/that allow users in a certain group to shutdown/reboot in the first place.Mine looks like this:
/etc/polkit-1/rules.d/50-shutdown.rules
polkit.addRule(function(action, subject) {
if ((action.id == "shutdown" ||
action.id == "reboot") &&
subject.isInGroup("wheel"))
{
return polkit.Result.YES;
}
});So every user in the wheel group can do it without password prompt. Without this UI elements for shutdown/reboot will try assuming they have the right but simply fail.
@muusemuuse@sh.itjust.works this plus the display manager too if there is one since it runs as root. if you’re using gnome, there’s a gdm.conf somewhere in /etc where you can disable the power/reboot.
It’s plasma (normal, big screen and maybe mobile in a future project)
systemd-inhibit seems like the right place to look, but I have a vague feeling that gnome can override it.
https://www.freedesktop.org/software/systemd/man/latest/systemd-inhibit.html
Maybe with some tweaking itll be unoveridable except for root?



