systemd-logind is not honoring polickykit rules for suspend/reboot/shutdown

[William Van Hevelingen]

systemd-logind is not honoring policy-kit rules put in place to prevent users from suspending, hibernatoring, or shuting down machines. These rules worked in Precise.

moss:~# cat /etc/polkit-1/localauthority/20-org.d/20-edu.pdx.cat.power.them.pkla
[deny-them-poweroff]
Identity=unix-group:*;
Action=org.freedesktop.consolekit.*;

ResultActive=no

moss:~# cat /etc/polkit-1/localauthority/20-org.d/20-org.freedesktop.upower.suspend.pkla
[deny-them-suspend]
Identity=unix-group:*;
Action=org.freedesktop.consolekit.*;

ResultActive=no

moss:~# cat //etc/polkit-1/localauthority/20-org.d/20-org.freedesktop.upower.hibernate.pkla
[deny-them-hibernate]
Identity=unix-group:*;
Action=org.freedesktop.consolekit.*;

ResultActive=no

[Martin Pitt (pitti)]

These actions were for ConsoleKit. logind has its own rules, so you need to rewrite them to enumerate org.freedesktop.login1.suspend and org.freedesktop.login1.hibernate (see /usr/share/polkit-1/actions/org.freedesktop.login1.policy).

Don't deny *all* methods of logind to users, though; that'll break some stuff and forbid way more than you intend.

[Gabriel A. Devenyi (gadevenyi)]

What *should* the rules be for trusty.