[SOLVED] Allow only a specified group to execute shutdown

[Marcih]

I'm looking to give permission to run the shutdown command to a non-superuser using user groups. My idea was to create a group called "power" or "shutdown" (name is yet to be decided, submit your suggestions now!) and have users in that group be able to execute shutdown as root with the help of setuid.
From what I've understood reading the man page, doing chmod u+s /sbin/shutdown allows everybody to be able to run the command as if they were the owner of the file, i.e. root. I want to restrict this to only users in a specific group. Any ideas?

EDIT: Changed thread title from "Set rights flag on a file for a specific group only" to "[SOLVED] Allow only a specified group to execute shutdown"
_________________

[bunder]

I would recommend sudo. Back in ye olde unix days, there was an operator user/group who had the ability to do almost-root level stuff, but its usefulness has kind of waned. I'd still go the sudo route though.
_________________

[Mr. T.]

Someone can find an answer for less than two minutes.

• poweroff or reboot as a normal user
  
• proper way to enable a user to shutdown, halt or reboot

The title thread is ambivalent: someone may search a particular answer or someone may search a general answer.
This could lead to a waste of time for contributors and other users that search a similar topic but potentially unrelated.

The particular issue prevails in your case so you have to prioritize questions. Therefore, the real question would have been the one asked in the thread title.

Edit: revision to comply with Gentoo Guidelines.

[John R. Graham]

[Hu]

I concur with bunder. For completeness, if you really want to do as originally described, the traditional solution is to make the file mode 4710 and give it a group id matching the approved group. Users in that group will match the group id and be able to execute it because it is g+x. Users not in the group (other than the owner) will match other and be unable to execute it because it is o-x. Since they cannot run it at all, they cannot enjoy the setuid bit on it. Note that this has the minor undesirable aspect that non-privileged users cannot run the program even for "safe" purposes such as running with --help to see what options it accepts or, in the case of multifunction programs, running useful non-root functions. For the specific case, that undesirable aspect is probably acceptable to you.

[Marcih]

Mr T.,

I have stumbled upon and read both of the topics quoted before posting as well as the man pages (does that count as a manual?) for shutdown, chmod and chown because, after all, I'm still new to the *nix world. Needless to say neither have been much help. I haven't needed sudo up until now and I intended for it to stay that way. The -a option on shutdown seemed to be ineffective, as much as I wish it worked. What I said in the OP was just an idea that I wanted to know whether it would even work since my attempts at it have not been successful.
I don't assume bad faith but there are better ways of putting your point across.

Hu,

I can't believe I didn't think of that before, thanks! So if I understand it correctly, the way suid/sgid works is it sets the user/group ID to the owner/group of the file regardless of who executes it? That would mean what I tried to do cannot be done. I'll mark the thread as solved and change the title to a more fitting one.
_________________

[Hu]

That is how it works, and that's why, if I understood your request correctly, what you want is possible and is done in the way I described above. The key is to remove other-execute (o-x), so that only the owner of the file (and, if group execute is maintained, users in the group of the file) can run the program at all. If you leave other-execute enabled, then you let anyone run the program without restriction, and with the elevated rights from suid/sgid. Take a simple program such as sleep, give it various combinations of permissions, and run it with a long enough delay that you can inspect its /proc/PID/status file to see real/effective IDs. I suggest trying these permissions as a start:

[Ant P.]

If you're using sysvinit, there's a dirty secret you ought to be aware of: /sbin/shutdown just writes a few magic bytes to /run/initctl (a FIFO file). You can make initctl writable by whoever you want while leaving /sbin/shutdown untouched, and it'll work.

[krinn]

because none suggest it, this will also do the wanted job:
- a running script checking for a file presence, if present, trigger shutdown (better with delay)
- file presence in a directory restrict to a group, and better use a volatile one (ie: /run/myshutdown)

this way, as soon as a user create the file in /run/shutdown, the script itself detect it and initiate the shutdown process.
no real changes to the system and no sudo. if your users are dumb, create a script that create the file for them in the correct location and instruct them to use that script to shutdown (you can make a /usr/bin/stop that just do touch /run/myshutdown/afile)

[Mr. T.]

Personally, I will have used sudo because it was developed for that. Otherwise, I will have hacked shutdown or OpenRC.
Otherwise, I will have used Access Control List.