Comment # 5 on bug 1205939 from Matthias Gerstner

The codebase of lightdm does not support any restrictions for calling these
methods. Polkit support is not present. On D-Bus configuration file level
there exists the deprecated 'at_console' setting that could be used but it is
also not properly implemented.

This means that there is nothing clean that we can do to address the issue on
the packaging level.

On the code level one could try to ask systemd whether the calling users is in
a logged in session and allow only them to issue calls.

I will ask upstream what their thoughts about this are.