SU(1)

NAME
su - assume a user's identity

SYNOPSIS
su [-] [-c command ] [username]

DESCRIPTION
Su invokes the preferred shell of another user. The identity of the new user can be specified with the username, argument. The default username is that of the local superuser (UID=0).

By default the user's shell is invoked directly, however, giving the argument flag -, su is instructed to invoke the shell as a login shell. This means that the current working directory will be changed to the home of the new user and the shell's first argument will be prefixed with a -. This behavior is understood and acted on by most command-shells. In the case of a login, any direct command supplied via, -c, is ignored. In the case of a login shell, the appropriate entries are made in the utmp(5) and wtmp(5) databases to announce the assumed user's presence on the system.

Instead of fully activating the user's command-shell, a single command may be invoked with the assumed identity, by using the -c flag. For example, a file may be deleted with the power of the superuser using the following command:

         su -c 'rm ./this_file'

In such cases, the choice of shell is not automatically, that entered in the user's Password Database entry; see libpwdb(3). The logic for this is as follows. If the user's default shell is a single full pathname, it is appended with -c 'commands', however, if the users shell is an entry of more than one token, it is not used by su for individual commands. Instead, /bin/sh is substituted.

Su is configured to work through the Linux-PAM API. Essentially, it initializes itself as a "su" service with Linux-PAM and utilizes the configured account, authentication and session modules to authenticate and then invoke a session with the assumed user's identity. Note, unlike login(1), if the user's password(s) has(have) expired, new one(s) will not be sought. Indeed, any failure from the accounting component of Linux-PAM will be fatal. This is the case for all applicant users other than the superuser. In the case of the superuser encountering an accounting failure, a warning will be displayed but su will proceed to invoke the sought user's shell.

A simple entry in the Linux-PAM configuration file for this service would be:

 #
 # su service, authentication not required for root.
 # For other users authentication is provided via
 # pwdb. Some account management done with time module
 #
 su auth sufficient pam_rootok.so
 su auth required pam_pwdb.so
 su account required pam_pwdb.so
 su account required pam_time.so
 su session required pam_pwdb.so
 #

(For the equivalent /etc/pam.d/su file, you should delete the first field ("su") from the above example). Note, the password module-type is not required for this application to function correctly.

For continuity of service, the administrator might wish to make the login(1) and su configurations similar.

EXIT CODE
On successful completion of its task, su will complete with exit code 0. An exit code of 1 indicates an error occurred. Textual errors are written to the standard error stream.

CONFORMING TO
Linux-PAM (Pluggable Authentication modules for Linux).
Modules on your system will probably be located in /usr/lib/security/ or /lib/security/.

BUGS

None known.

SEE ALSO
su(1) and pam(8)

For more complete information on how to configure this application with Linux-PAM, see the Linux-PAM System Administrators' Guide at
<http://http://linux.kernel.org/pub/linux/libs/pam/index.html>