Removing system items from Leave menu in Plasma 5

[Roderick Johnstone]

After reading up a bit on the policykit docs I have tried two things, 
neither of which have worked:

1) Edited /usr/share/polkit-1/actions/org.freedesktop.login1.policy and 
changed the line in the <action id="org.freedesktop.login1.reboot"> 
section from:
  <allow_active>yes</allow_active>
to
  <allow_active>no</allow_active>

ie expecting my test account to be disallowed from running the reboot 
option.

2) Added a file: 52-org.freedesktop.login1.xray.rules to
/etc/polkit-1/rules.d/ which contains:
polkit.addRule(function(action, subject) {
         if (action.id == "org.freedesktop.login1.reboot" &&
                 !subject.isInGroup("admin")) {
                 return polkit.Result.AUTH_ADMIN;
         }
});

ie expecting my test account to be prompted for a root password in this 
case.

In both cases my test account can just restart the system.

So, two questions?

1) Should I be changing the policy or adding the new rule (ie 1 or 2 above)?

2) If changing the policy, where is the right place to put my new policy 
file, rather than changing the system installed one?

I'd appreciate some guidance or aid to debugging please.

Thanks

Roderick

On 16/04/15 19:18, Rex Dieter wrote:
> Create custom policykit configuration to limit those actions, per
> http://www.freedesktop.org/wiki/Software/systemd/logind/
>
> by default, local/console users have permission for all login1 actions, including:
>
> org.freedesktop.login1.power-off
> org.freedesktop.login1.reboot
>   org.freedesktop.login1.suspend
> org.freedesktop.login1.hibernate
>
> -- Rex
>
> ________________________________________
> From: kde-bounces at lists.fedoraproject.org <kde-bounces at lists.fedoraproject.org> on behalf of Roderick Johnstone <rmj at ast.cam.ac.uk>
> Sent: Thursday, April 16, 2015 12:15 PM
> To: kde at lists.fedoraproject.org
> Subject: Removing system items from Leave menu in Plasma 5
>
> Hi
>
> I'd like to remove the System items (Sleep, hibernate, restart and
> shutdown) from the Leave menu in Application Launcher on Plasma 5 on a
> system-wide basis.
>
> How would I do that please?
>
> Thanks
>
> Roderick Johnstone