/*
 * If you use this configuration you may disable boot capability
 * bit in default rule for all other executables.
 *
 * WARNING: untested
 */
 
/sbin/reboot {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		boot
	}
	
	exec deny all
}

/sbin/halt {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		boot
	}
		
	exec deny all
}

/sbin/poweroff {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		boot
	}
	
	exec deny all
}

/usr/bin/shutdown {
	uid 0
	gid 0
	groups no
	
	cap effective raise {
		boot
	}
	
	exec deny all
}
