system.restart - Overview of the macOS Authorization Right

macOS 10.9 / 10.10 / 10.11 / 10.12 / 10.13 / 10.14

{
  'class' : 'evaluate-mechanisms',
  'comment' : 'Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching.',
  'mechanisms' : [
    'RestartAuthorization:restart',
    'builtin:authenticate,privileged',
    'RestartAuthorization:success'
  ],
  'shared' : 'true',
  'tries' : '10000'
}

macOS 10.6

{
  'class' : 'evaluate-mechanisms',
  'comment' : 'Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching.',
  'mechanisms' : [
    'builtin:smartcard-sniffer,privileged',
    'RestartAuthorization:restart',
    'builtin:authenticate,privileged',
    'RestartAuthorization:success'
  ]
}

macOS 10.7 / 10.8

{
  'class' : 'evaluate-mechanisms',
  'comment' : 'Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching.',
  'mechanisms' : [
    'RestartAuthorization:restart',
    'builtin:authenticate,privileged',
    'RestartAuthorization:success'
  ]
}