su(1)

SU(1)

PAM only applications

SU(1)

NAME

su - assume a user's identity

SYNOPSIS

su [-|-l] [-c command] [-s shell] [username]

DESCRIPTION

Su invokes the preferred shell of another user. The identity of the new user can be specified with the username, argument. The default username is that of the local superuser (UID=0).

By default the user's shell is invoked directly, however, giving the argument flag -, su is instructed to invoke the shell as a login shell. This means that the current working directory will be changed to the home of the new user and the shell's first argument will be prefixed with a -. This behavior is understood and acted on by most command-shells. In the case of a login, any direct command supplied via, -c, is ignored. In the case of a login shell, the appropriate entries are made in the utmp(5) and wtmp(5) databases to announce the assumed user's presence on the system.

Instead of fully activating the user's command-shell, a single command may be invoked with the assumed identity, by using the -c flag. For example, a file may be deleted with the power of the superuser using the following command:

su -c 'rm ./this_file'

In such cases, the choice of shell is not automatically, that entered in the user's Password Database entry; see libpwdb(3). The logic for this is as follows. If the user's default shell is a single full pathname, it is appended with -c 'commands', however, if the users shell is an entry of more than one token, it is not used by su for individual commands. Instead, /bin/sh is substituted.

Su is configured to work through the Linux-PAM API. Essentially, it initializes itself as a "su" service with Linux-PAM and utilizes the configured account, authentication and session modules to authenticate and then invoke a session with the assumed user's identity. Note, unlike login(1), if the user's password(s) has(have) expired, new one(s) will not be sought. Indeed, any failure from the accounting component of Linux-PAM will be fatal. This is the case for all applicant users other than the superuser. In the case of the superuser encountering an accounting failure, a warning will be displayed but su will proceed to invoke the sought user's shell.

OPTIONS

-c command, --command=command: Pass command, a single command line to run, to the shell with a -c option instead of starting an interactive shell.
-, -l, --login: Invoke the shell as a login shell.
-s, --shell shell: Superuser may run shell instead of user's command-shell, unless the user running su is not the superuser and user's shell is restricted.
--help: Print a usage message on standard output and exit successfully.

EXIT CODE

On successful completion of its task, su will complete with exit code 0. An exit code of 1 indicates an error occurred. Textual errors are written to the standard error stream.

CONFORMING TO

Linux-PAM (Pluggable Authentication modules for Linux).
Modules on your system will probably be located in /usr/lib/security/ or /lib/security/.

BUGS

None known.