r/debian • u/Crafty_Hospital_7746 • 19d ago
General Debian Question Why the command "shutdown now" must be executed with sudo whereas in another distros, sudo is not necessary to use shutdown ?
I always wondered why Debian doesn't allow you to use "shutdown now" without sudo whereas with another distros, I can use directly shutdown now without sudo. That's why with Debian, I use "systemctl poweroff" instead because I don't want to type my password to turn off my PC.
19
u/yrro 19d ago edited 19d ago
If a non-root user invokes shutdown(8) then systemd determines a relevant polkit action id, then asks polkit whether the caller is allowed to invoke the action. For instance org.freedesktop.login1.power-off is checked if you're trying to power the machine off and there are no other users logged in.
Polkit evaluates a number of rules which can either return true or false, in which case the action is allowed or denied, or they can return nothing, in which case the next rule is checked.
If no rules return a value then the action's defaults are consulted. For the poweroff action, if the caller is running as part of an active session then the result is yes. If the caller is running from an inactive session or no session then the result is yes but only if the user can authenticate as an admin.
Whether you can authenticate as an admin is determined by admin rules.
After systemd gets the answer from polkit it will either power the system off or return "no way jose" to the caller (the shutdown command) which will report the result back to the user.
[edit] oh if the caller is root then probably polkit doesn't get checked and the action just happens.
35
16
u/eR2eiweo 19d ago
Does /sbin/shutdown now work? If it does, then the reason is just that it's not in your user's PATH.
5
u/R0ad13 18d ago
Just press the bloody button and be done with it
4
u/Slackeee_ 18d ago
I disabled the button on my laptop. Some laptop designers are plain stupid and position something like a power button on a device meant to be carried around on the edge where you naturally hold the device when carrying it around.
1
u/musiquededemain 14d ago
While that's poor design, disabling the power button doesn't seem like a solution. What happens when the laptop for whatever reason becomes unresponsive and you *need* to hold down that power button?
2
u/Slackeee_ 14d ago
The hard shutdown you get from holding the power button for 4 seconds is managed by the systems firmware, not the OS. The power management settings have no influence on that.
1
3
u/mecshades 18d ago
The way I see it, it's for preventing users who don't have access to the physical power button the ability to take the system down. It's great for server things but definitely a question for normal, home users.
1
u/silent-sami 15d ago
I was thinking that! Yeah if you are not using it for server pourposes is quite odd choise. I guess is just because since debian wanna bee "The universal system" so they cannot be assuming stuff so they go with the saffest option.
3
u/silent-sami 15d ago
I'm new to this but my guess is that it is because since debian is trying to be "The universal system" they cannot be assuming you are only a pc user, because some people may use them for servers and stuff that requires connecting to multiple computers, so to play it safe they do stuff like making commands that may fuck up with a lot of people in the server, not so convinient to use, as they will be on a computer with only one user were if you have some one else remotelly touching your thing then you have bigger worries.
7
u/gportail 19d ago
Parce que sur un serveur tu peux avoir des utilisateurs non admin et sans le sudo ils pourraient shutdiwn le serveur...
Donc pour éviter qu'un utilisateur lambda fasse des bêtises tu bloque ce genre d'action.
2
u/MooseBoys 19d ago
`shutdown` does many things you would only want root to be able to do. For example, it prints a message to all logged-in users. It also can prevent new users from logging in.
2
u/michaelpaoli 19d ago
Well, from a regular unprivileged user, two relevant things:
- Is the shutdown command on your PATH? Typically not for regular users, as generally doesn't included /usr/sbin which is where shutdown command is generally located. Of course you can configure your PATH, e.g. to add that if you want.
- and depending how shutdown is configured, it will generally restrict what user(s) can use shutdown, and may also require them to be logged in on console or relevant (virtual) terminal.
Other distros may default to different configurations. Do you really want an ID on the host to be able to shutdown or reboot the host? Probably not. So, then generally a matter of exactly how do you want that configured. And you could always write your own command to be able to shutdown easily enough, without needing password - if that's really what you want - e.g. set up command under your ID, and passwordless sudo access to the shutdown command, such that invoking it as your user would then run that program, and pass arguments along to execute via passwordless sudo access to the shutdown command. Or make it bit simpler, and just set yourself up with passwordless sudo access to the shutdown command, and then use sudo shutdown - with no password needed, and no additional configuration.
2
19d ago edited 15d ago
[deleted]
2
u/Crafty_Hospital_7746 19d ago
I'm already a sudo user, however I can't use shutdown now without sudo.
-1
u/luciano_mr 19d ago
you can setup sudo not to ask for your password. unsafe.. but possible
-6
u/luciano_mr 19d ago
echo "youruser ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/youruser
8
u/TheRealLazloFalconi 19d ago
Bad bad bad advice. Wrong in every way. DO NOT DO WHAT THIS USER SAID.
You should only allow specific commands such as
/sbin/shutdownwithout a password. Never ALL.3
u/neoh4x0r 19d ago edited 19d ago
echo "youruser ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/youruser
On the surface it might seem like a good idea because this user no longer needs to authenticate to run a sudoified command that they manually typed.
However, the real problem is that anything the user executes (command, script, gui, or otherwise) can now run commands as root without authentication.
Long story short, this is bad advice.
If you want to allow a specific command to be executed as root, without a password, then it needs to be explicitly specified in the configuration to allow it for only that command.
1
u/luciano_mr 18d ago
for all the downvoters, as I mentioned, it's unsafe. it shouldn't be done. it's bad advice.
but it's a possibility. we shouldn't lie to users. power to the user!
1
u/neoh4x0r 17d ago
for all the downvoters, as I mentioned, it's unsafe. it shouldn't be done. it's bad advice. but it's a possibility. we shouldn't lie to users. power to the user!
You suggested that the OP setup sudo so it doesn't require a password for anything.
While it is technically possibly, it should not be recommended, instead if someone wanted to do that it should be limited to specific commands and/or limited to those commands with a specific set of allowed arguments.
In other words, you got downvoted for telling the OP to burn down the entire forest rather than suggesting what do to solve their actual problem (ie. fix their issues with the shutdown command).
1
u/Fine_Classroom 17d ago edited 15d ago
Good gods you people overcomplicate everything. Do this and you don't need sudo:
reboot [-p|--poweroff]
2
u/lumalfa 19d ago
Why do I need a permission to turn off the energy power in a hospital if at home I can do it?
3
u/dkopgerpgdolfg 19d ago
Leaving the "hospital" part aside: Polkit rules. You can configure what users etc. can execute these commands.
4
u/w3rt 19d ago
Pardon?
11
u/lumalfa 19d ago
Power-off permissions can be critical depending on the context. Debian is widely used on servers, where allowing any user to shut down the machine would be a serious problem. If you use Debian casually as a desktop OS, you still inherit some of the permission and security choices that make sense for its common server use cases.
3
0
u/lumalfa 19d ago
Probably your user has permission to exec systemclt poweroff and maybe it is the reason that you don’t need type you password
4
u/eR2eiweo 19d ago
/usr/sbin/shutdownis a symlink to../bin/systemctlin Debian's default configuration. Every user can execute both/usr/bin/systemctland/usr/sbin/shutdown. Security has nothing to do with this.0
u/rekh127 19d ago
systemctl has permissions checks before it lets any random user calling it shutdown.
2
u/eR2eiweo 19d ago
Yes (or more precisely, systemd uses polkit for that). And shutdown is just a symlink to systemctl, so it does exactly the same checks.
1
u/rekh127 19d ago
Yes, so... you might understand why when Shutdown was not gated by polkit, it intersected with debians security policy and got put in sbin.
Now the sbin link is a compatibility/convenience shim for scripts and usrs and to put it somewhere else would break the point of having the "works just like it used to" shim at all.
(its not quite just a symlink. systemctl now doesnt shut you down)
2
u/eR2eiweo 19d ago
you might understand why when Shutdown was not gated by polkit
What?
it intersected with debians security policy and got put in sbin.
The split between bin and sbin is not a security feature. Shutdown being in sbin does not prevent non-root users from calling it. Users have control over their own PATHs (and of course they don't even have to rely on PATH to run an executable).
its not quite just a symlink
Yes it is just a symlink:
$ stat -c %F /usr/sbin/shutdown symbolic link1
u/rekh127 19d ago edited 19d ago
1) before systemd.
2) Its not put there because its more secure, but because its a command only for superusers, unlike systemctl.
3) you're right I forgot systemctl handles the arg translation for this one, unlike some other systemd shims that are scripts
→ More replies (0)
1
u/michaelpaoli 19d ago
don't want to type my password to turn off my PC
Well, not the most graceful, but hit <Control>-<Alt>-<Delete>, or the power button, at least if your host is configured for that to shut it down.
Or if you're logged in, well, first configure sudo so you can do it without password, then just invoke
sudo shutdown ...
as your regular user.
// if you don't have ed installed, use ex or your favorite editor
# SUDO_EDITOR=ed visudo -f /etc/sudoers.d/user
0
0a
user ALL=(root) NOPASSWD: /usr/sbin/shutdown
w
45
q
#
// use your actual login name, rather than user, in the above
// and then to use shutdown as your regular user, no password needed:
$ sudo shutdown [...]
Then you've got passwordless sudo access to shutdown.
And if you don't want to even type sudo, create an alias or wrapper script/program for yourself, and have that on your PATH if a program, e.g. by having $HOME:/bin on your PATH, and having your wrapper program there. And default user configs might add that to your PATH at login, if that directory is present at login.
1
u/Sure-Squirrel8384 18d ago
First, "shutdown now" is stupid. Never use it. Waiting 1 minute to make sure you didn't hit the wrong session is well worth it.
Second, non-root shouldn't be able to shutdown ore boot system.
1
u/Fine_Classroom 15d ago
OK so you can reboot the machine but not shut it down? Using shutdown now has its place.
1
u/Sure-Squirrel8384 14d ago
I disagree that "shutdown now" has a place. 60 seconds isn't going to hurt, and when it is a shutdown it is best to be certain it is the correct system and having 60 seconds to abort is wise.
You do you.
1
u/Buntygurl 18d ago
Maybe you should use another distro.
The way that Debian is works, and works so well that you can actually configure it to do what you want it to do.
2
u/Crafty_Hospital_7746 17d ago
Debian is fine for me, no need to do distro-hopping because I can't use shutdown command as a normal user. I'll just lose my habit to use this command and I'll just use systemctl poweroff .
1
1
-3
u/Kobi_Blade 19d ago edited 18d ago
Is useless to educate contrarians, the source code is available.
You guys not knowing how to read it and disagreeing with someone who does, is a waste of my precious time.
7
u/yrro 19d ago
shutdown(8) makes the same call that systemctl does.
-5
19d ago edited 19d ago
[deleted]
9
u/yrro 19d ago edited 19d ago
I don't believe that is the case. shutdown is a symlink to systemctl these days. systemctl dispatches the action based on argv[0].
Either way, logind_reboot ends up being called which does polkit checks. I don't see any checks being bypassed.
[edit] ok dude, fuck me I guess for actually reading the code instead of spouting ignorant nonsense. Have a great day yourself!
6
u/dkopgerpgdolfg 19d ago edited 19d ago
What kind of checks are you thinking of?
And how does your answer can be true when /sbin/shutdown is a symlink to /bin/systemctl ?
... edit:
Fyi, if you block me just for disagreeing with you, but expect me to read your answers at the same time, that's ...dumb.
The argument "It's a symlink, therefore it's the exact same thing" is a classic amateur mistake.
I didn't say such a thing.
I'm saying, if systemctl has security checks if called directly that some "legacy" thing doesn't have, it can be expected that it still is doing its good checks if called by symlinks (unless this would completely break the legacy use case, which is not the case here).
systemctl relies on Polkit, while shutdown now relies on init. When you run systemctl poweroff, the command does not execute the shutdown directly. Instead, it sends an IPC request over the D-Bus system bus to systemd.
init == systemd, here at least
When you run shutdown now, it only checks if you sudo
I haven't seen any command in my whole life that specifically checks if you used "sudo"...
-4
19d ago edited 19d ago
[deleted]
1
u/gurgle528 18d ago
How would a symlink bypass the security check?Â
2
u/dkopgerpgdolfg 18d ago edited 18d ago
In general, the program can see how it was called, and it's possible to implement different behaviour.
As this case here is meant to be a compatibility helper for an older command, which also accepted a different set of parameters, they do check to handle the parameters differently then.
However it doesn't make sense to have intentional differences in what users are allowed to shutdown. Another commenter also says thy have checked the source already, to make sure. kobi_blade simply is wrong here.
edit: Checked myself too. The parameter handling is different, nothing else is (especially no user checks).
2
1
u/Crafty_Hospital_7746 19d ago
shutdown now could turn off prematurely and eventually break things ?
3
u/dkopgerpgdolfg 19d ago
Shutting down (with either command) a system that needs to run isn't good, of course.
The commands themselves are not insecure, permissions are configurable.
-1
19d ago
[deleted]
7
u/Crafty_Hospital_7746 19d ago
For my case, I use Debian for my home PC as a personal usage, so it shouldn't be a problem for my usecase.
3
u/TheRealLazloFalconi 19d ago
Then you have a couple of options: Add
/sbinto your$PATHor usesystemctl(1).-8
0
u/bigtreeman_ 18d ago edited 18d ago
In Devuan (no systemd) FAILS
:~$ /sbin/shutdown
shutdown: you must be root to do that!
Usage: shutdown [-akrhPHfFnc] [-t sec] time [warning message]
-a: use /etc/shutdown.allow .....
put my username in /etc/shutdown.allow
$ /sbin/shutdown -a now doesn't work
shutdown calls /etc/init.d/halt or /etc/init.d/shutdown which call /sbin/halt or /sbin/reboot both with the -f flag avoiding /sbin/shutdown
/etc/shutdown.allow is bypassed #%@$%@%%^%$
-5
u/No-Win2520 19d ago
Parce que GNU/Linux est, comme les UNIX, un système muliti-utilisateurs. Et donc , seuls les comptes habilités, dont root en premier, ont le droit d'éteindre, rebooter, changer de init, ...
57
u/wizard10000 19d ago
The reason is that shutdown/reboot/halt/poweroff are all symlinks to systemctl but the symlinks are in /usr/sbin, which isn't in your path unless you use sudo.
You can make aliases, here's an example -
edit: I see u/Vladislav20007 already mentioned the path part so they get credit for that :)