[SOLVED] Creating a SetUID script to shut down machine

shadefenseofficial · 2026-09-08 15:33:35

Hello, I am wondering if anybody has any suggestions about shut down scripts.
This is what I am trying to do:

echo "systemctl poweroff" > ~/.local/bin/po
nano ~/.bashrc (or .zshrc)
Then make sure ~/.local/bin is added to path
chmod +x ~/.local/bin/po
su
chmod +s /home/<my username>/.local/bin/po
exit
po (ensure it works)

Is there anything anyone would add? Or remove?
Thanks.

Edit: I will now just type in the command normally, even though it is 20 extra keystrokes.

Last edited by shadefenseofficial (2026-09-08 21:32:20)

Whoracle · 2026-09-08 16:16:19

I would remove that script wholesale and allow exactly /usr/bin/systemctl poweroff via sudo for my user with NOPASSWD. Add an alias po for it to bashrc, and done.
Reason: You now have a shellscript in your home with setuid that is trivially findable and allows an attacker to just change it and do whatever. Editable with your permissions no less.

seth · 2026-09-08 16:20:39

You cannot suid scripts because you would have to suid the interpreter (bash, don't do that) and you don't have to do any of this because the active session is allowed to shutdown the system.

If you're using xinit see the lat link below, otherwise detail how your session is started.

shadefenseofficial · 2026-09-08 21:30:21

ah, ok, thanks

dimich · 2026-09-09 02:54:42

If the goal is to allow the user to poweroff/reboot, you can achieve it by overriding polkit configuration. Maybe there are other simpler ways but I have done it in this way:
Create /etc/polkit-1/localauthority.conf.d/51-power-mgmt.conf:

[Allow power management]
Identity=unix-user:username
Action=org.freedesktop.login1.power-off;org.freedesktop.login1.reboot;org.freedesktop.login1.suspend;org.freedesktop.login1.hibernate
ResultAny=yes
ResultActive=yes
ResultInactive=yes

Change "username" in the second line to your actual user name and re-login.

seth · 2026-09-09 06:07:43

Traditionally through https://wiki.archlinux.org/title/Polkit … tion_rules - is this for a remote user?

dimich · 2026-09-09 06:53:54

seth wrote:

is this for a remote user?

Is this question to me or to @shadefenseofficial?
I know that it's possible to override polkit rules and implement more flexible logic. But configuring permissions for corresponding dbus methods looks more straightforward for me. And yes, it works for both local and remote user.

seth · 2026-09-09 06:57:35

You; Because at least for the active session of a local user it should™ not be required to override this at all.

dimich · 2026-09-09 07:04:32

seth wrote:

You; Because at least for the active session of a local user it should™ not be required to override this at all.

Right, with default configuration it is not required for local user. However, it depends on definition of "active session of a local user" from polkit's point of view

GerBra · 2026-09-09 07:23:10

shadefenseofficial wrote:

Edit: I will now just type in the command normally, even though it is 20 extra keystrokes

If i understand the initial post correctly you have had no problem on the system to power off from terminal with : systemctl poweroff
You only want a shorter name for doing this.

Your approach via a script has already mentioned.
Best way is: create an alias in your shell for doing this, as @Whoracle already mentioned.

Hint: make always sure that your aliases don't namely collide with any existing command, esp. not on system relevant commands.
Myself prefix my important aliases with my name initials, ex. gb_po
Shell complementation also works with aliases.

General poweroff/polkit:
https://wiki.archlinux.org/title/Power_ … emd-logind
That's why local user should/could always systemctl power related commands.

lfcr · 2026-09-09 12:50:28

For example, in my /etc/bash.bashrc - file, I have:

....
alias shut='mpv /usr/local/share/sounds/sandman-shorter.mp3;shutdown now'
...

with a little song ahead

Arch Linux

#1 2026-09-08 15:33:35

[SOLVED] Creating a SetUID script to shut down machine

#2 2026-09-08 16:16:19

Re: [SOLVED] Creating a SetUID script to shut down machine

#3 2026-09-08 16:20:39

Re: [SOLVED] Creating a SetUID script to shut down machine

#4 2026-09-08 21:30:21

Re: [SOLVED] Creating a SetUID script to shut down machine

#5 2026-09-09 02:54:42

Re: [SOLVED] Creating a SetUID script to shut down machine

#6 2026-09-09 06:07:43

Re: [SOLVED] Creating a SetUID script to shut down machine

#7 2026-09-09 06:53:54

Re: [SOLVED] Creating a SetUID script to shut down machine

#8 2026-09-09 06:57:35

Re: [SOLVED] Creating a SetUID script to shut down machine

#9 2026-09-09 07:04:32

Re: [SOLVED] Creating a SetUID script to shut down machine

#10 2026-09-09 07:23:10

Re: [SOLVED] Creating a SetUID script to shut down machine

#11 2026-09-09 12:50:28

Re: [SOLVED] Creating a SetUID script to shut down machine

Board footer