Scientific Linux Forum.org



  Reply to this topicStart new topicStart Poll

> Default user right to reboot?
lionelguy
 Posted: Feb 18 2015, 02:56 PM
Quote Post


SLF Newbie


Group: Members
Posts: 2
Member No.: 3367
Joined: 18-February 15









Dear SLers,

I'm relatively new to SL, I am used to OpenSUSE.
I just installed a fresh copy of SL7, and was very surprised to be able to run the 'reboot' when logged in with a non-admin user. I tested the shutdown command but got "Must be root" message. I didn't alter the sudo.conf or sudoers files.

Is it really a desired behavior? Shouldn't simple users be prevented to reboot? How do I change this?

Thanks for your help!

Lionel
PM
^
joka
 Posted: Feb 19 2015, 07:18 PM
Quote Post


SLF Geek
****

Group: Members
Posts: 172
Member No.: 107
Joined: 28-April 11









QUOTE (lionelguy @ Feb 18 2015, 03:56 PM)
Dear SLers,

I'm relatively new to SL, I am used to OpenSUSE.
I just installed a fresh copy of SL7, and was very surprised to be able to run the 'reboot' when logged in with a non-admin user. I tested the shutdown command but got "Must be root" message. I didn't alter the sudo.conf or sudoers files.

Is it really a desired behavior? Shouldn't simple users be prevented to reboot? How do I change this?

Thanks for your help!

Lionel

Both commands are now symbolic links to "systemctl" (control tool for system daemon).
I would also expect only a user with an account of type "System Administrator" should be able to reboot.
But surprisingly any user (added by GNOME->Settings->User) seems to be able to reboot. This rule is defined by a policykit rule, I suppose the one in /usr/share/polkit-1/action//org.freedesktop.login1.policy
CODE
       <action id="org.freedesktop.login1.reboot-multiple-sessions">
               <description>Reboot the system while other users are logged in</description>
               <message>Authentication is required for rebooting the system while other users are logged in.</message>
               <defaults>
                       <allow_any>auth_admin_keep</allow_any>
                       <allow_inactive>auth_admin_keep</allow_inactive>
                       <allow_active>yes</allow_active>
               </defaults>
               <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.reboot</annotate>
       </action>

It seems to me that the user of the current active session is allowed to reboot without confirmation.

You may try to change this (and similar) policy kit rules. Another option is to confine an unprivileged user by SELinux with the following command:

CODE
semanage login -a -s user_u my_unprivileged_user


SELinux would then prevent the call of "reboot". But this is working only if you are using SELinux in "enabled" mode.
PM
^
lionelguy
 Posted: Feb 19 2015, 07:55 PM
Quote Post


SLF Newbie


Group: Members
Posts: 2
Member No.: 3367
Joined: 18-February 15









Joka,

Thanks for the tips, I'll look into how to better customize the access to systemctl. Still, I think this is bad practice that any user can reboot the machine (but not do so using the more gentle shutdown). Is it something that has been imported "as is" from RHEL? Should I report this issue to them?

Lionel
PM
^
joka
 Posted: Feb 21 2015, 08:34 PM
Quote Post


SLF Geek
****

Group: Members
Posts: 172
Member No.: 107
Joined: 28-April 11









QUOTE (lionelguy @ Feb 19 2015, 08:55 PM)
Joka,
Is it something that has been imported "as is" from RHEL? Should I report this issue to them?

Lionel

Yes. Since SL is a RHEL clone.

Fedora 21 has the same behavior. If you want to file a bug report, then the chances to get a response are better for Fedora than for RHEL.


PM
^
0 User(s) are reading this topic (0 Guests and 0 Anonymous Users)
0 Members:

Topic Options Reply to this topicStart new topicStart Poll