`systemd-inhibit` doesn't work as expected

palto42

I'm trying to use systemd-inhibit started as root to prevent the user from shutting down os suspending the system as long as that process runs, but for some reason the regular user can still suspend or even power-off the machine via the Budgie power menu in the GUI.

If I try systemd-inhibit in the terminal, it works as expected. In one terminal I start systemd-inhibit as root:

$ sudo systemd-inhibit --why "Test" sleep 60

In second terminal I try to suspend or power-off as normal user:

$ systemctl suspend
Operation inhibited by "sleep 60" (PID 4021 "systemd-inhibit", user root), reason is "Test".
Please retry operation after closing inhibitors and logging out other users.
Alternatively, ignore inhibitors and users with 'systemctl suspend -i'.
$ systemctl poweroff 
Operation inhibited by "sleep 60" (PID 4021 "systemd-inhibit", user root), reason is "Test".
Please retry operation after closing inhibitors and logging out other users.
Alternatively, ignore inhibitors and users with 'systemctl poweroff -i'.

I found some hint about settings in /etc/systemd/logind.conf, but this hasn't changed anything for me.

Any idea why it doesn't block suspend/power-off and how to get it working?

palto42

I further investigated the current behaviour of systemd-inhibit and found that it has quite some gaps. Although still not fully clear why Solus Budgie ignores the inhibitor while other distro like Ubuntu Mate seems to respect it, the current restrictions make it useless for my purpose (unattended Solus package upgrade).

I found two interesting things during my search:

There is a PR #16245 for systemd to add a new feature which may provide what I need.
An interesting Python script reboot-guard to block shutdown and reboot. Since it wasn't updated a few years and still based on Python 2.7,
- One point I noted is that although rguard successfully blocks reboot/poweroff, it still terminates (kills?) the user GUI session. In the current code rguard doesn't block suspend/hibernate (this options are commented-out in the code).