Allow "systemctl halt" for all users? (systemd + debian)

Question

Is it possible to allow "systemctl halt" for all users?

Currently only the commands:

systemctl poweroff & systemctl reboot work on my system (Debian Jessie)

When I call systemctl halt as a normal user, I get the following message:

Failed to start halt.target: Access denied

I tried the following methods:

1. Method - I tried to add a new action in: /usr/share/polkit-1/actions/org.freedesktop.login1.policy

I copied the action

<action id="org.freedesktop.login1.power-off"> to
<action id="org.freedesktop.login1.halt">

2. Method (and which worked) was to chmod u+s /sbin/halt but because /sbin/halt is a link to -> /bin/systemctl this is probably not a good idea

Answer 1

Step 1: Wait several months until Debian Stretch is released – you need at least systemd v227, with commits 2ac3930f (polkit checking for /sbin/halt) and 88ced61b (extended polkit data for systemctl halt etc.)

Step 2: Create a polkit rule in… Actually, no, that won't be enough because even Stretch still has polkit v0.105, which did not support the JS-based rules yet; only the considerably more limited .pkla format. That said, v0.113 is finally in "experimental".

But if you happen to upgrade to systemd ≥v227 and polkit ≥v0.113, a rule such as this should work:

/* copy to /etc/polkit-1/rules.d/systemd-allow-halt.rules */

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        action.lookup("unit") == "halt.service")
    {
        return polkit.Result.YES;
    }
});

---

So, teach yourself to type systemctl poweroff instead. "Halt" isn't the normal shutdown command; it's the command to literally halt the machine – without powering it off. It's not very useful.

If you do find it useful, use sudo instead:

# /etc/sudoers

ALL ALL=(root) NOPASSWD: /usr/bin/systemctl halt, /sbin/halt