449 lines
9.7 KiB
HTML
449 lines
9.7 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of SU</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>SU</H1>
|
|
Section: User Commands (1)<BR>Updated: July 2014<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
su - run a command with substitute user and group ID
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>su</B> [options] [<B>-</B>]
|
|
|
|
[<I>user</I> [<I>argument</I>...]]
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>su</B>
|
|
|
|
allows to run commands with a substitute user and group ID.
|
|
<P>
|
|
|
|
When called without arguments,
|
|
<B>su</B>
|
|
|
|
defaults to running an interactive shell as
|
|
<I>root</I>.
|
|
|
|
<P>
|
|
|
|
For backward compatibility,
|
|
<B>su</B>
|
|
|
|
defaults to not change the current directory and to only set the
|
|
environment variables
|
|
<B>HOME</B>
|
|
|
|
and
|
|
<B>SHELL</B>
|
|
|
|
(plus
|
|
<B>USER</B>
|
|
|
|
and
|
|
<B>LOGNAME</B>
|
|
|
|
if the target
|
|
<I>user</I>
|
|
|
|
is not root). It is recommended to always use the
|
|
<B>--login</B>
|
|
|
|
option (instead of its shortcut
|
|
<B>-</B>)
|
|
|
|
to avoid side effects caused by mixing environments.
|
|
<P>
|
|
|
|
This version of
|
|
<B>su</B>
|
|
|
|
uses PAM for authentication, account and session management. Some
|
|
configuration options found in other
|
|
<B>su</B>
|
|
|
|
implementations, such as support for a wheel group, have to be
|
|
configured via PAM.
|
|
<P>
|
|
|
|
<B>su</B>
|
|
|
|
is mostly designed for unprivileged users, the recommended solution for
|
|
privileged users (e.g. scripts executed by root) is to use
|
|
non-set-user-ID command
|
|
<B><A HREF="/cgi-bin/man/man2html?1+runuser">runuser</A></B>(1)
|
|
|
|
that does not require authentication and provide separate PAM configuration. If
|
|
the PAM session is not required at all then the recommend solution is to use
|
|
command
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1).
|
|
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-c</B>,<B> --command</B>=<B></B><I>command</I>
|
|
|
|
<DD>
|
|
Pass
|
|
<I>command</I>
|
|
|
|
to the shell with the
|
|
<B>-c</B>
|
|
|
|
option.
|
|
<DT id="2"><B>-f</B>,<B> --fast</B>
|
|
|
|
<DD>
|
|
Pass
|
|
<B>-f</B>
|
|
|
|
to the shell, which may or may not be useful, depending on the shell.
|
|
<DT id="3"><B>-g</B>,<B> --group</B>=<B></B><I>group</I>
|
|
|
|
<DD>
|
|
Specify the primary group. This option is available to the root user only.
|
|
<DT id="4"><B>-G</B>,<B> --supp-group</B>=<B></B><I>group</I>
|
|
|
|
<DD>
|
|
Specify a supplemental group. This option is available to the root user only. The first specified
|
|
supplementary group is also used as a primary group if the option <B>--group</B> is unspecified.
|
|
<DT id="5"><B>-</B>,<B> -l</B>,<B> --login</B>
|
|
|
|
<DD>
|
|
Start the shell as a login shell with an environment similar to a real
|
|
login:
|
|
<DL COMPACT><DT id="6"><DD>
|
|
<DL COMPACT>
|
|
<DT id="7">o<DD>
|
|
clears all the environment variables except
|
|
<B>TERM</B>
|
|
|
|
and variables specified by <B>--whitelist-environment</B>
|
|
<DT id="8">o<DD>
|
|
initializes the environment variables
|
|
<B>HOME</B>,
|
|
|
|
<B>SHELL</B>,
|
|
|
|
<B>USER</B>,
|
|
|
|
<B>LOGNAME</B>, and
|
|
|
|
<B>PATH</B>
|
|
|
|
<DT id="9">o<DD>
|
|
changes to the target user's home directory
|
|
<DT id="10">o<DD>
|
|
sets argv[0] of the shell to
|
|
'<B>-</B>'
|
|
|
|
in order to make the shell a login shell
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="11"><B>-m</B>,<B> -p</B>,<B> --preserve-environment</B>
|
|
|
|
<DD>
|
|
Preserve the entire environment, i.e. it does not set
|
|
<B>HOME</B>,
|
|
|
|
<B>SHELL</B>,
|
|
|
|
<B>USER</B>
|
|
|
|
nor
|
|
<B>LOGNAME</B>.
|
|
|
|
This option is ignored if the option <B>--login</B> is specified.
|
|
<DT id="12"><B>-P</B>,<B> --pty</B>
|
|
|
|
<DD>
|
|
Create pseudo-terminal for the session. The independent terminal provides
|
|
better security as user does not share terminal with the original
|
|
session. This allow to avoid TIOCSTI ioctl terminal injection and another
|
|
security attacks against terminal file descriptors. The all session is also
|
|
possible to move to background (e.g. "su --pty - username -c
|
|
application &"). If the pseudo-terminal is enabled then su command works
|
|
as a proxy between the sessions (copy stdin and stdout).
|
|
<P>
|
|
This feature is mostly designed for interactive sessions. If the standard input
|
|
is not a terminal, but for example pipe (e.g. echo "date" | su --pty) than ECHO
|
|
flag for the pseudo-terminal is disabled to avoid messy output.
|
|
<DT id="13"><B>-s</B>,<B> --shell</B>=<B></B><I>shell</I>
|
|
|
|
<DD>
|
|
Run the specified <I>shell</I> instead of the default. The shell to run is
|
|
selected according to the following rules, in order:
|
|
<DL COMPACT><DT id="14"><DD>
|
|
<DL COMPACT>
|
|
<DT id="15">o<DD>
|
|
the shell specified with
|
|
<B>--shell</B>
|
|
|
|
<DT id="16">o<DD>
|
|
the shell specified in the environment variable
|
|
<B>SHELL</B>,
|
|
|
|
if the
|
|
<B>--preserve-environment</B>
|
|
|
|
option is used
|
|
<DT id="17">o<DD>
|
|
the shell listed in the passwd entry of the target user
|
|
<DT id="18">o<DD>
|
|
/bin/sh
|
|
</DL>
|
|
</DL>
|
|
|
|
<DT id="19"><DD>
|
|
If the target user has a restricted shell (i.e. not listed in
|
|
/etc/shells), the
|
|
<B>--shell</B>
|
|
|
|
option and the
|
|
<B>SHELL</B>
|
|
|
|
environment variables are ignored unless the calling user is root.
|
|
<DT id="20"><B>--session-command=</B><I>command</I>
|
|
|
|
<DD>
|
|
Same as
|
|
<B>-c</B>
|
|
|
|
but do not create a new session. (Discouraged.)
|
|
<DT id="21"><B>-w</B>,<B> --whitelist-environment</B>=<B></B><I>list</I>
|
|
|
|
<DD>
|
|
Don't reset environment variables specified in comma separated <I>list</I> when clears
|
|
environment for <B>--login</B>. The whitelist is ignored for the environment variables
|
|
<B>HOME</B>,
|
|
|
|
<B>SHELL</B>,
|
|
|
|
<B>USER</B>,
|
|
|
|
<B>LOGNAME</B>, and
|
|
|
|
<B>PATH</B>.
|
|
|
|
<DT id="22"><B>-V</B>,<B> --version</B>
|
|
|
|
<DD>
|
|
Display version information and exit.
|
|
<DT id="23"><B>-h</B>,<B> --help</B>
|
|
|
|
<DD>
|
|
Display help text and exit.
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>SIGNALS</H2>
|
|
|
|
Upon receiving either
|
|
<B>SIGINT</B>,
|
|
|
|
<B>SIGQUIT</B>
|
|
|
|
or
|
|
<B>SIGTERM</B>,
|
|
|
|
<B>su</B>
|
|
|
|
terminates its child and afterwards terminates itself with the received signal.
|
|
The child is terminated by SIGTERM, after unsuccessful attempt and 2 seconds of
|
|
delay the child is killed by SIGKILL.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>CONFIG FILES</H2>
|
|
|
|
<B>su</B>
|
|
|
|
reads the
|
|
<I>/etc/default/su</I>
|
|
|
|
and
|
|
<I>/etc/login.defs</I>
|
|
|
|
configuration files. The following configuration items are relevant
|
|
for
|
|
<B><A HREF="/cgi-bin/man/man2html?1+su">su</A></B>(1):
|
|
|
|
<P>
|
|
|
|
<B>FAIL_DELAY</B>
|
|
|
|
(number)
|
|
<DL COMPACT><DT id="24"><DD>
|
|
Delay in seconds in case of an authentication failure. The number must be
|
|
a non-negative integer.
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<B>ENV_PATH</B>
|
|
|
|
(string)
|
|
<DL COMPACT><DT id="25"><DD>
|
|
Defines the PATH environment variable for a regular user. The
|
|
default value is
|
|
<I>/usr/local/bin::/bin::/usr/bin</I>.
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<B>ENV_ROOTPATH</B>
|
|
|
|
(string)
|
|
<BR>
|
|
|
|
<B>ENV_SUPATH</B>
|
|
|
|
(string)
|
|
<DL COMPACT><DT id="26"><DD>
|
|
Defines the PATH environment variable for root. ENV_SUPATH takes precedence. The default value is
|
|
<I>/usr/local/sbin::/usr/local/bin::/sbin::/bin::/usr/sbin::/usr/bin</I>.
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
|
|
<B>ALWAYS_SET_PATH</B>
|
|
|
|
(boolean)
|
|
<DL COMPACT><DT id="27"><DD>
|
|
If set to
|
|
<I>yes</I>
|
|
|
|
and --login and --preserve-environment were not specified
|
|
<B>su</B>
|
|
|
|
initializes
|
|
<B>PATH</B>.
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
The environment variable PATH may be different on systems where /bin and /sbin
|
|
are merged into /usr.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>EXIT STATUS</H2>
|
|
|
|
<B>su</B>
|
|
|
|
normally returns the exit status of the command it executed. If the
|
|
command was killed by a signal,
|
|
<B>su</B>
|
|
|
|
returns the number of the signal plus 128.
|
|
<P>
|
|
|
|
Exit status generated by
|
|
<B>su</B>
|
|
|
|
itself:
|
|
<DL COMPACT><DT id="28"><DD>
|
|
<DL COMPACT>
|
|
<DT id="29">1<DD>
|
|
Generic error before executing the requested command
|
|
<DT id="30">126<DD>
|
|
The requested command could not be executed
|
|
<DT id="31">127<DD>
|
|
The requested command was not found
|
|
</DL>
|
|
</DL>
|
|
|
|
<A NAME="lbAI"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
|
|
<DL COMPACT>
|
|
<DT id="32">/etc/pam.d/su<DD>
|
|
default PAM configuration file
|
|
<DT id="33">/etc/pam.d/su-l<DD>
|
|
PAM configuration file if --login is specified
|
|
<DT id="34">/etc/default/su<DD>
|
|
command specific logindef config file
|
|
<DT id="35">/etc/login.defs<DD>
|
|
global logindef config file
|
|
|
|
</DL>
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
For security reasons
|
|
<B>su</B>
|
|
|
|
always logs failed log-in attempts to the btmp file, but it does not write to
|
|
the lastlog file at all. This solution allows to control
|
|
<B>su</B>
|
|
|
|
behavior by PAM configuration. If you want to use the pam_lastlog module to
|
|
print warning message about failed log-in attempts then the pam_lastlog has to
|
|
be configured to update the lastlog file as well. For example by:
|
|
<P>
|
|
<DL COMPACT><DT id="36"><DD>
|
|
<BR>
|
|
|
|
session required pam_lastlog.so nowtmp
|
|
</DL>
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+setpriv">setpriv</A></B>(1),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?5+login.defs">login.defs</A></B>(5),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?5+shells">shells</A></B>(5),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+pam">pam</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+runuser">runuser</A></B>(8)
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H2>HISTORY</H2>
|
|
|
|
This <B>su</B> command was
|
|
derived from coreutils' <B>su</B>, which was based on an implementation by
|
|
David MacKenzie. The util-linux has been refactored by Karel Zak.
|
|
<A NAME="lbAM"> </A>
|
|
<H2>AVAILABILITY</H2>
|
|
|
|
The su command is part of the util-linux package and is
|
|
available from
|
|
|
|
Linux Kernel Archive
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="37"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="38"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="39"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="40"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="41"><A HREF="#lbAF">SIGNALS</A><DD>
|
|
<DT id="42"><A HREF="#lbAG">CONFIG FILES</A><DD>
|
|
<DT id="43"><A HREF="#lbAH">EXIT STATUS</A><DD>
|
|
<DT id="44"><A HREF="#lbAI">FILES</A><DD>
|
|
<DT id="45"><A HREF="#lbAJ">NOTES</A><DD>
|
|
<DT id="46"><A HREF="#lbAK">SEE ALSO</A><DD>
|
|
<DT id="47"><A HREF="#lbAL">HISTORY</A><DD>
|
|
<DT id="48"><A HREF="#lbAM">AVAILABILITY</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:27 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|