The Finder allows a non privileged user to perform a shutdown assuming there are no other users logged in, however shutdown is a privileged UNIX command. Does anyone know by what mechanism it does this?
Please clarify how Finder lets you do a shutdown. On my 10.7.3 system "shut down" is part of the Apple menu and always present, it is not part of the Finder menu.
/sbin/shutdown is indeed a restricted command, the Menu "Shut Down" feature may use a different mechanism (or it may not). I'd imagine the exact mechanism exploits the Unix suid bit feature in some way. Suid allows a command to be run as though the file owner were running it, e.g. the command is owned by root but can be executed by non-root users. This is a common (and risky) method to enable non-privileged users to run privileged commands.