shutdown without su priv

[colmax]

found anyone can pass shutdown commands with switches to ubuntu 16.04 without su
just seems a big control issue

shutdown -r now
shutdown -h now

Cheers c

[ajgreeny]

I admit I was surprised to see your post and immediately tried this out, and you are correct, with no query of "Are you sure?" or anything like that.

I will investigate further.

[ian-weisser]

Not seeing any systemd bugs in Launchpad that match this description.
Perhaps you are the first to discover....

[ajgreeny]

Here you go. It seems it is a feature, not a problem.

http://askubuntu.com/questions/77474...s-in-ubuntu-16
http://askubuntu.com/questions/78905...again-in-16-04

It doesn't tell us why, but does seem to suggest it is a deliberate decision.

[mc4man]

found anyone can pass shutdown commands with switches to ubuntu 16.04 without su
just seems a big control issue

Why? Can't see any reason why shutting down or restarting should require root auth.

[halogen2]

Why? Can't see any reason why shutting down or restarting should require root auth.

You're thinking of a "typical" client desktop computer. I can think of several situations this could be quite bad on a server.

[ajgreeny]

And if more than one user was logged in it could be a problem in a desktop.

Thinking about that; can more than one user be logged in at the same time? I have only one user on any of my computers so I don't know the answer to that question.

[mc4man]

And if more than one user was logged in it could be a problem in a desktop.

Thinking about that; can more than one user be logged in at the same time? I have only one user on any of my computers so I don't know the answer to that question.

If another user is logged in the command won't complete & you're informed of such. It does also provide & inform of a systemctl command to override & do a shutdown/reboot if desired.
It would be impracticable to require root auth to restart or shut down, how would a non admin user do so, wait until admin user was available?

[ajgreeny]

<Snip>
It would be impracticable to require root auth to restart or shut down, how would a non admin user do so, wait until admin user was available?

The GUI allows shutdown and restart with no root authorisation, and always has done so, as far as I'm aware, but doing so in terminal or command-line TTYs, and perhaps therefore in most servers, has always in the past needed authorisation.

[kpatz]

I just tried it in my 16.04 VM. If I launch a terminal from the desktop and run "shutdown -r now" it shuts down with no superuser privileges required.

If I access a shell via ssh and run "shutdown -r now" it doesn't work without sudo.

So, it's only when you're on the desktop itself that you can shutdown without privileges. Remote access still requires sudo.