The Finder allows a non privileged user to perform a shutdown assuming there are no other users logged in, however shutdown is a privileged UNIX command. Does anyone know by what mechanism it does this?

1 Answer 1


Please clarify how Finder lets you do a shutdown. On my 10.7.3 system "shut down" is part of the Apple menu and always present, it is not part of the Finder menu.

/sbin/shutdown is indeed a restricted command, the Menu "Shut Down" feature may use a different mechanism (or it may not). I'd imagine the exact mechanism exploits the Unix suid bit feature in some way. Suid allows a command to be run as though the file owner were running it, e.g. the command is owned by root but can be executed by non-root users. This is a common (and risky) method to enable non-privileged users to run privileged commands.

  • That sounds like what I'm asking, but I suppose an elevated user or daemon like launchd listens for an apple event, and then executes shutdown if the front end provides the correct credentials.
    – awiebe
    Feb 3, 2012 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .