Debian – How to Block Shutdown or Reboot in Xfce When Other Users Logged In

linuxpampolkitsystemdxfce

I want to prevent users to start shutdown or reboot when another user is logged in. Users can be a TTY user (Ctrl+Alt+F3) or a ssh user from a client host.

In OpenBSD, I use polkit org.xfce.session.policy with a rule file to prevent such actions.

I need to find how to do this in Debian Testing (aka Buster).
I found org.freedesktop.login1.policy with actions

  • org.freedesktop.login1.power-off
  • org.freedesktop.login1.power-off-multiple-sessions.

and made rule files for these actions but it does not block shutdown or restart.
It seems to me that polkit is not responsible alone for these actions.

I don't know where to look for this; perhaps systemd or PAM ?

EDIT

On OpenBSD and NetBSD, by default, nobody is allowed to shutdown or reboot from GUI.
You must create a rule file in /usr/local/share/polkit-1/rules.d/ like this one :

polkit.addRule (function (action, subject) {
    if (action.id == "org.xfce.session.xfsm-shutdown-helper")
    {
        return polkit.Result.YES;
    }
});

On Debian, by default, all users can shutdown or reboot from GUI.
There is no rule file for org.xfce.session.xfsm-shutdown-helper or org.freedesktop.login1.power-off.

I try to add my rule file with return polkit.Result.NO; with no avail
On debian, i use lightdm and on BSD, i use xdm.

Best Answer

Debian Testing Buster use polkit 1.05, so there is no rule files and no js syntax.
You must use the old policykit ini-style.
To prevent users to start shutdown or reboot when another user is logged in,
you must create two pkla files in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_power-off-multiple-sessions.pkla 
[Reject all users to use login1_power-off-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.power-off-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_login1_reboot-multiple-sessions.pkla
[Reject all users to use login1_reboot-multiple-sessions]
Identity=unix-user:*
Action=org.freedesktop.login1.reboot-multiple-sessions
ResultAny=no
ResultInactive=no
ResultActive=no

But, it is not enough, because xfce too install a action to shutdown or reboot in /usr/share/polkit-1/actions/org.xfce.session.policy.
You must also create a pkla file for this action in /etc/polkit-1/localauthority/50-local.d/

cat /etc/polkit-1/localauthority/50-local.d/Reject_All_Users_To_Use_Xfce_Session_Policy.pkla 
[Reject all users to use xfce_session_policy]
Identity=unix-user:*
Action=org.xfce.session.xfsm-shutdown-helper
ResultAny=no
ResultInactive=no
ResultActive=no
Related Question