Section: User Commands (1)
Updated: July 2014
runuser - run a command with substitute user and group ID
runuser [options] [-]
can be used to run commands with a substitute user and group ID.
If the option -u
is not given,
falls back to
semantics and a shell is executed.
The difference between the commands
does not ask for a password (because it may be executed by the root user only) and
it uses a different PAM configuration.
does not have to be installed with set-user-ID permissions.
If the PAM session is not required,
then the recommended solution is to use the
When called without arguments,
defaults to running an interactive shell as
For backward compatibility,
defaults to not changing the current directory and to setting only the
if the target
is not root).
This version of
uses PAM for session management.
in all cases use PAM (pam_getenvlist()) to do
the final environment modification.
such as --login and --preserve-environment affect
the environment before it is modified by PAM.
- -c, --command=command
to the shell with the
- -f, --fast
to the shell, which may or may not be useful, depending on the
- -g, --group=group
The primary group to be used. This option is allowed for the root user only.
- -G, --supp-group=group
Specify a supplementary group.
This option is available to the root user only. The first specified
supplementary group is also used as a primary group
if the option --group is not specified.
- -, -l, --login
Start the shell as a login shell with an environment similar to a real
clears all the environment variables except for
and variables specified by --whitelist-environment
initializes the environment variables
changes to the target user's home directory
sets argv of the shell to
in order to make the shell a login shell
- -P, --pty
Create a pseudo-terminal for the session. The independent terminal provides
better security as the user does not share a terminal with the original
This can be used to avoid TIOCSTI ioctl terminal injection and other
security attacks against terminal file descriptors.
The entire session can also be moved to the background
(e.g., "runuser --pty -u username -- command &").
If the pseudo-terminal is enabled, then
works as a proxy between the sessions (copy stdin and stdout).
This feature is mostly designed for interactive sessions.
If the standard input is not a terminal,
but for example a pipe (e.g., echo "date" | runuser --pty -u user),
then the ECHO flag for the pseudo-terminal is disabled to avoid messy output.
- -m, -p, --preserve-environment
Preserve the entire environment, i.e., do not set
The option is ignored if the option --login is specified.
- -s, --shell=shell
Run the specified shell instead of the default. The shell to run is
selected according to the following rules, in order:
the shell specified with
the shell specified in the environment variable
option is used
the shell listed in the passwd entry of the target user
If the target user has a restricted shell (i.e., not listed in
/etc/shells), then the
option and the
environment variables are ignored unless the calling user is root.
but do not create a new session. (Discouraged.)
- -w, --whitelist-environment=list
Don't reset the environment variables specified in the
comma-separated list when clearing the
environment for --login. The whitelist is ignored for the environment variables
- -V, --version
Display version information and exit.
- -h, --help
Display help text and exit.
configuration files. The following configuration items are relevant
Defines the PATH environment variable for a regular user. The
default value is
environment variable for root.
takes precedence. The default value is
If set to
and --login and --preserve-environment were not specified
The environment variable
may be different on systems where
are merged into
this variable is also affected by the --login command-line option and
the PAM system setting (e.g.,
normally returns the exit status of the command it executed. If the
command was killed by a signal,
returns the number of the signal plus 128.
Exit status generated by
Generic error before executing the requested command
The requested command could not be executed
The requested command was not found
default PAM configuration file
PAM configuration file if --login is specified
runuser specific logindef config file
global logindef config file
derived from coreutils' su
, which was based on an implementation by
David MacKenzie, and the Fedora runuser
command by Dan Walsh.
The runuser command is part of the util-linux package and is
Linux Kernel Archive