/etc/shutdown.allow being ignored

cdhgee · 08-23-2005, 12:34 PM

I want to be able to do

Code:

shutdown -h now

from an unprivileged account (ie as a non-root user). Reading the shutdown man page, it says I can do this by listing the user(s) I want to be permitted to shutdown the machine by putting each username on a separate line in /etc/shutdown.allow, and using the -a argument to shutdown. I have tried this, and it doesn't do anything.

I've got it as follows:

Code:

[root@malvern etc]# ls -al shutdown.allow
-rw-r--r--  1 root root 6 Jul 27 22:54 shutdown.allow
[root@malvern etc]# cat shutdown.allow
david
[root@malvern etc]#

And what happens is:

Code:

[david@malvern ~]$ shutdown -a -h now
shutdown: you must be root to do that!

Can anyone suggest any reason why this shouldn't be working, or have I missed something obvious?

Matir · 08-23-2005, 12:40 PM

You may need to make shutdown setuid root, though I am not sure. (chmod 4755 `which shutdown`)

cdhgee · 08-23-2005, 03:40 PM

Quote:

Originally posted by Matir
You may need to make shutdown setuid root, though I am not sure. (chmod 4755 `which shutdown`)

I did contemplate that, but the man page for shutdown says:

Code:

       Shutdown  wasn’t  designed to be run setuid. /etc/shutdown.allow is not
       used to find out who is executing shutdown, it ONLY checks who is  cur-
       rently logged in on (one of the) console(s).

Matir · 08-24-2005, 01:49 PM

Ah. In that case, are you logged in on a local console when executing this? (Not X, I would think)

cdhgee · 08-25-2005, 03:38 AM

I am logged into X on display :0 (i.e. from the box itself) when I do this, executing it in a gnome-terminal.

Matir · 08-25-2005, 07:39 AM

Yes, but shutdown.allow is not checking who is running it, but is checking who is logged in at a console.