By default user can not reboot or mount cdrom. Here is the example for the same:
Open
/etc/mail/access file and add username/hostname to deny:
Code:
From:user@localhost ERROR:5.7.1:550 Rejected
user@localhost ERROR:5.7.1:550 Rejected
Restart sendmail to take effect.