我相信这是很多使用fedora用户的一大心病,这个版本shutdown需要管理员权限,但reboot,halt之类全都不要,甚至sudo都用不着。自己用无所谓,但如果给别人提供了账户,开了ssh的,这可就是个大问题了。有个笑话,fedora论坛有人报告某次更新后要管理员密码才能关机,麻烦死了,有人回复,你怎么做到的教我吧。
在写这篇文章之前,我把我能找到的解决办法都试过了,没有一个行的。不废话,给解决办法:
chmod 750 `which systemctl`
这个版本fedora不能用以前的解决办法,目测就是因为引入了新的系统控制命令systemctl。执行systemctl --help:
systemctl [OPTIONS...] {COMMAND} ...
Query or send control commands to the systemd manager.
-h --help Show this help
--version Show package version
-t --type=TYPE List only units of a particular type
-p --property=NAME Show only properties by this name
-a --all Show all units/properties, including dead/empty ones
--failed Show only failed units
--full Don't ellipsize unit names on output
--fail When queueing a new job, fail if conflicting jobs are
pending
--ignore-dependencies
When queueing a new job, ignore all its dependencies
--kill-who=WHO Who to send signal to
-s --signal=SIGNAL Which signal to send
-H --host=[USER@]HOST
Show information for remote host
-P --privileged Acquire privileges before execution
-q --quiet Suppress output
--no-block Do not wait until operation finished
--no-wall Don't send wall message before halt/power-off/reboot
--no-reload When enabling/disabling unit files, don't reload daemon
configuration
--no-legend Do not print a legend (column headers and hints)
--no-pager Do not pipe output into a pager
--no-ask-password
Do not ask for system passwords
--order When generating graph for dot, show only order
--require When generating graph for dot, show only requirement
--system Connect to system manager
--user Connect to user service manager
--global Enable/disable unit files globally
-f --force When enabling unit files, override existing symlinks
When shutting down, execute action immediately
--root=PATH Enable unit files in the specified root directory
--runtime Enable unit files only temporarily until next reboot
-n --lines=INTEGER Journal entries to show
--follow Follow journal
-o --output=STRING Change journal output mode (short, short-monotonic,
verbose, export, json, cat)
******************************此处省略************************************
System Commands:
default Enter system default mode
rescue Enter system rescue mode
emergency Enter system emergency mode
halt Shut down and halt the system
poweroff Shut down and power-off the system
reboot Shut down and reboot the system
kexec Shut down and reboot the system with kexec
exit Request user instance exit
switch-root [ROOT] [INIT] Change to a different root file system
suspend Suspend the system
hibernate Hibernate the system
看最后的部分,poweroff/reboot/halt之类都是作为参数传进去的。修改权限后执行:
$ reboot
bash: /bin/reboot: Permission denied
甚至:
$ which reboot
/usr/bin/which: no reboot in (/usr/lib64/qt-3.3/bin:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/zgm/.local/bin:/home/zgm/bin)
当然,不是systemctl控制部分的命令不受影响:
$ which df
/bin/df
$ df
Filesystem 1K-blocks Used Available Use% Mounted on
devtmpfs
tmpfs
tmpfs
/dev/sdb2
tmpfs
tmpfs
/dev/sdb1
/dev/sdb3 ********************保密********************
理所应当的,必须修改sudoers,用visudo修改,退出时会做语法检查,如何修改不在此赘述。
做完这一步,一般用户在控制台算是没法了。但在gnome3里面,shutdown/reboot/suspend全都可以,不需要输入管理员密码噢。费解的是,shutdown不应该可以啊,这个程序本身就是要管理员权限。在此,需要介绍另一个程序:PolicyKit。
有关policykit的工作机制,请参考这。有关其使用和语法,请参考这。
全是英文文档,大家耐心读吧。读完以后,需要修改这两个文件:
/usr/share/polkit-1/actions/org.freedesktop.login1.policy
/usr/share/polkit-1/actions/org.freedesktop.upower.policy
建议把其中所有授权全改为“auth_admin”。
特别的是,用vim修改的同学,一定要清除vim自动生成的以“~”结尾的备份文件。policykit的授权是按照“文件名先后顺序+action先后顺序”授权的,后面的授权会覆盖前面的授权。
###########################################################################################################
fedora 18已完全解决这个问题,policykit和sudo都严格了。这篇文章大家可以无视了。