Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Finder allows a non privileged user to perform a shutdown assuming there are no other users logged in, however shutdown is a privileged UNIX command. Does anyone know by what mechanism it does this?

share|improve this question
up vote 4 down vote accepted

Please clarify how Finder lets you do a shutdown. On my 10.7.3 system "shut down" is part of the Apple menu and always present, it is not part of the Finder menu.

/sbin/shutdown is indeed a restricted command, the Menu "Shut Down" feature may use a different mechanism (or it may not). I'd imagine the exact mechanism exploits the Unix suid bit feature in some way. Suid allows a command to be run as though the file owner were running it, e.g. the command is owned by root but can be executed by non-root users. This is a common (and risky) method to enable non-privileged users to run privileged commands.

share|improve this answer
That sounds like what I'm asking, but I suppose an elevated user or daemon like launchd listens for an apple event, and then executes shutdown if the front end provides the correct credentials. – awiebe Feb 3 '12 at 1:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.