Comment # 5 on bug 1010779 from Wolfgang Bauer

(In reply to Marcus Meissner from comment #3)
> the reason is really if you have multipe sessions open it will take that the
> multiple session one.

Yes, but I was only logged in once (knowingly at least).
No idea where the other sessions came from, but it confused me at least...

(In reply to Thomas Wagner from comment #4)
> (In reply to Wolfgang Bauer from comment #1)
> > Your output of pkaction is normal AFAIK. Apparently it doesn't evaluate the 
> > javascript rules in /etc/polkit-1/rules.d/, but only takes its information 
> > from /usr/share/polkit/actions (i.e. the defaults).
> Ok, then the documentation section 9.4.3 is IMHO misleading, since it
> suggests the presumption that pkaction can be used the check the rules and
> not to display the defaults.

Well, it does state this in section 9.3:
> Note: Restrictions of pkaction on openSUSE Leap
>
> pkaction always operates on the upstream defaults. Therefore it cannot be used > to list or restore the defaults shipped with openSUSE Leap. To do so, refer to > Section 9.5, ���Restoring the Default Privileges���.

> (In reply to Wolfgang Bauer from comment #2)
> > @Thomas Wagner: can you confirm that adding these lines to
> > polkit-default-privs.local as well (and running
> > /sbin/set_polkit_default_privs afterwards) works for you too?
> > 
> > org.freedesktop.login1.reboot-multiple-sessions no
> > org.freedesktop.login1.power-off-multiple-sessions no
> Can confirm, having all four lines in place will prevent a user from
> shutdown/reboot on Leap 42.2.

Ok, I suppose we can close this then.
After all, polkit is working as expected.