Re: ubuntu's shutdown screen

[Brian Cameron <Brian Cameron Sun COM>]

Alan/Martin:

I'm the GDM maintainer, so I can probably answer some of your questions.

>> Martin says:
> Alan says:

> > Who maintains the logout and shutdown screens anyway? I have no idea 
>> what project they come from.

In most GNOME distros, the GDM program manages the
shutdown/reboot/suspend options, and these are functional if your GDM
configuration has SystemMenu=true and the ShutdownCommand,
RebootCommand, and/or HaltCommand have valid commands.

The gnome-panel program has some integration (see
gnome-panel/panel-gdm.[ch]) which tells GDM to shutdown/suspend/halt
the computer after the user logs out.  The gnome-panel code checks GDM
to see if these features are available and displays the choices if they
are.

So this is a GDM/gnome-panel specific thing.  You won't see these
options if you are using any other display manager (such as KDM, xdm,
etc.).  I'm not sure how KDE works, but you might similarly see
differences using GDM with KDE or KDM with KDE, etc.

Obviously root needs to actually run these commands and I guess the
display-manager daemon has been a convenient place for this logic.
It might be better to move this functionality into a separate daemon
that works with KDE and GNOME without depending on a specific display
manager being used.

> > As far as rational, it seems to me that most users only want one place
> > to go when they plan to leave gnome: a logout screen. I understand
> > that they perform different functions (one seems to interface with
> > gnome-session and the other with gdm?) but users (like me) don't care
> > which software is being contacted. They just get annoyed when they
> > just want to logout and realize that they only put the icon for
> > shutdown on their panel.

If your distro isn't using GDM with GNOME, then this might be the
reason why they do things a different way?

> > I can see a reason for leaving the two independent dialogs there
> > because you don't always want users to be able to shutdown (i.e. on a
>
> There was a recent discussion on the usability mailing list where a
> systems adminstrator wanted to remove the Shutdown button so that his
> users would not shutdown during an upgrade (or otherwise interfere with
> background processes) or in the simpler case choose Shutdown when Logout
> was the more appropriate choice.  There are certainly reasonable case to
> hide the Shutdown button in multi user sytems, or at least relegate it to
> the GDM login screen.
>
> http://mail.gnome.org/archives/usability/2007-March/msg00040.html

Yes, it would be nicer if GDM supported the ability to have more
sophisticated configuration with these features.  Right now it is either
all or nothing.  These features are always on or not on at all.

The following two GDM bug reports explain the issues:

  http://bugzilla.gnome.org/show_bug.cgi?id=172600
  http://bugzilla.gnome.org/show_bug.cgi?id=372738

It would probably be better if GDM supported the following:

- The ability to only allow shutdown/suspend/reboot to users who have
  logged in.  Not display them on the GDM login screen at all, but make
  the features available to gnome-panel or people who call
  gdmflexiserver directly.  This would ensure that a user needs to
  authenticate before they could shutdown the system.

- Perhaps require the root password entry to access these features
  much like it currently does for running gdmsetup.

- GDM should be nicer about warning you that other users are logged
  in (say via XDMCP or virtual-terminals) before going ahead and
  shutting down the system.

I'd be happy to work with anyone wanting to implement these sorts of
enhancements to GDM.

> Keep in mind a determined user can find many ways to shutdown (or
> otherwise forcibly reset a machine that is causing problems)  and systems
> adminstrators must fully understand "lockdown" is something of an
> overstatement.  Having suffered attempts at lockdown in a Microsoft
> enviroment I'm deeply concerned about the usability implications of
> inappropriate attemps at lockdown, or unintentionally allowing systems
> adminstrators to setup a very hostile enviroment for users.  Conversely
> having provided technical support I fully understand the need to move
> certain things out of the way so user do not trip on them, but bolting
> everything the floor is not necessarily the right answer.  (Please forgive
> the over extended analogies.)

Right, like it would be possible to run gdmflexiserver to shutdown the
system even if the panel is locked down to not show the options.
However, if the GDM shutdown/reboot configuration options are turned on,
then these options appear in the login screen, so it would be silly to
only turn these features off in the panel if the user can just log out
and use GDM directly to shutdown/reboot the system.

I'd say that on systems where you don't want users to have the ability
to shutdown/reboot/suspend, you should make sure the GDM configuration
has no value specifies for RebootCommand, HaltCommand, and
SuspendCommand.  This way these features are not available at all via
GDM or gnome-panel.

Note that commenting out the values is not enough since it will use
"compiled in values", so you should specify them as blank like this:

ShutdownCommand=

rather than

#ShutdownCommand=

As you say, there may be other (non-GDM) ways to shutdown/reboot the
system, but I can't speak for those.

I hope this helps explain how things work and how you can configure your
systems the way you want.

Brian