This is desktop policy decision that a logged in user can shut down the machine, this is expected behavior, and that's how / why clicking the power button in top right corner -> shutdown icon works. Ditto long clicking that shutdown icon works to suspend the machine too.
Being physical user on the physical display console, means one can pull the power cord too, no need for sudo to do that. If you don't want regular users to be able to shutdown the machine, adjust the policy on your system accordingly. ** Changed in: systemd (Ubuntu) Status: New => Opinion -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1748095 Title: Non-root user can reboot machine from the command line To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1748095/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs