First version

files/lockdown/10-acpc-no-power-actions.rules

@@ -0,0 +1,14 @@
+// ACPC 2026: the teams may not restart, power off, suspend or hibernate the
+// machine. A restart would let USBGuard accept a device plugged in before.
+// Only the administrators (sudo group) keep these actions.
+polkit.addRule(function(action, subject) {
+    if ((action.id.indexOf("org.freedesktop.login1.reboot") == 0 ||
+         action.id.indexOf("org.freedesktop.login1.power-off") == 0 ||
+         action.id.indexOf("org.freedesktop.login1.halt") == 0 ||
+         action.id.indexOf("org.freedesktop.login1.suspend") == 0 ||
+         action.id.indexOf("org.freedesktop.login1.hibernate") == 0 ||
+         action.id.indexOf("org.freedesktop.login1.set-reboot") == 0) &&
+        !subject.isInGroup("sudo")) {
+        return polkit.Result.NO;
+    }
+});