4

Setting aside pushing a physical power button, can I prevent non-administrator users from initiating a software shutdown?

In Mac OS X Lion all users are allowed to shut down the workstation. How do I allow only the administrator to shut down the workstation?

Improve this question
2
  • I believe if other accounts are currently logged in (like the administrator account), an administrator password is required to shutdown the machine. Maybe that is a solution?
    – Gerry
    Jul 31, 2012 at 13:47
  • Gerry not really. I am looking for a simple policy to allow only Administrators this right.
    – Dragos
    Jul 31, 2012 at 13:53

2 Answers 2

Reset to default
4

You can use Workgroup Manager and OS X's managed preferences (MCX) to restrict access to the Restart and Shut Down commands in the Finder:

WGM 10.6

..then use the Accounts prefpane to show or hide the Restart, Sleep, and Shut Down buttons at the loginwindow:

enter image description here

Improve this answer
4
  • da4 this is only obfuscation ? Without setting an ACL on /sbin/shutdown and /sbin/reboot there a normal user could still issue shutdown from terminal ?
    – Dragos
    Aug 1, 2012 at 7:34
  • I wouldn't call it obfuscation; you could also prevent opening the Terminal using MCX and disabling SSH access for non-admin users. Basically I'd rather use the given tools rather than trying to apply policies to system components that may or may not remain intact/working after further OS and security updates.
    – da4
    Aug 1, 2012 at 15:28
  • Yes, you are right. Either ways Mac is not very good for multi-user environments.
    – Dragos
    Aug 2, 2012 at 7:52
  • How can I do the exact opposite of this? That is allow anyone on the local console to shutdown the machine?
    – adib
    Jun 1, 2015 at 11:42
1

This seems drastic, and I wouldn't want to test it on my system, but if one were really determined to prevent non-administrative users from properly shutting down the system, one could rename /sbin/shutdown. The program /sbin/shutdown, run on its own, requires administrative privileges, but ordinary users can invoke it through the shutdown command in the GUI. The shutdown command in the GUI does depend on /sbin/shutdown, though, so if the program is not found where it is expected, the GUI shutdown sequence will not complete.

If an administrative user wants to shut down the system, they can invoke the renamed /sbin/shutdown from the command line using sudo.

Note that none of this (or any other software solution) will prevent a user with physical access to the machine from pressing and holding the power button, simply pulling the power cord out of its outlet, tripping the circuit breaker for the circuit giving power to the computer, etc.

Improve this answer
3
  • Thanks Daniel. I think I will add ACL to /bin/shutdown :D
    – Dragos
    Jul 31, 2012 at 13:22
  • 2
    Also you might wish to restrict /sbin/reboot if desired.
    – bmike ♦
    Jul 31, 2012 at 15:02
  • I wanted to change the rights of /sbin/shutdown in root mode in 750, but I got chmod error: Unable to change file mode on shutdown: Operation not permitted.
    – The33Coder
    Jan 9, 2020 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .