Section: User Commands (1)
Updated: July 2014
su - run a command with substitute user and group ID
allows commands to be run with a substitute user and group ID.
When called with no
defaults to running an interactive shell as
is specified, additional
can be supplied, in which case they are passed to the shell.
For backward compatibility,
defaults to not change the current directory and to only set the
if the target
is not root). It is recommended to always use the
option (instead of its shortcut
to avoid side effects caused by mixing environments.
This version of
uses PAM for authentication, account and session management. Some
configuration options found in other
implementations, such as support for a wheel group, have to be
configured via PAM.
is mostly designed for unprivileged users, the recommended solution for
privileged users (e.g., scripts executed by root) is to use
that does not require authentication and provide separate PAM configuration. If
the PAM session is not required at all then the recommend solution is to use
in all cases use PAM
to do the final environment modification.
such as --login and --preserve-environment affect
the environment before it is modified by PAM.
- -c, --command=command
to the shell with the
- -f, --fast
to the shell, which may or may not be useful, depending on the shell.
- -g, --group=group
Specify the primary group. This option is available to the root user only.
- -G, --supp-group=group
Specify a supplementary group.
This option is available to the root user only. The first specified
supplementary group is also used as a primary group
if the option --group is not specified.
- -, -l, --login
Start the shell as a login shell with an environment similar to a real
clears all the environment variables except
and variables specified by --whitelist-environment
initializes the environment variables
changes to the target user's home directory
sets argv of the shell to
in order to make the shell a login shell
- -m, -p, --preserve-environment
Preserve the entire environment, i.e., do not set
This option is ignored if the option --login is specified.
- -P, --pty
Create a pseudo-terminal for the session. The independent terminal provides
better security as the user does not share a terminal with the original
This can be used to avoid TIOCSTI ioctl terminal injection and other
security attacks against terminal file descriptors.
The entire session can also be moved to the background
(e.g., "su --pty - username -c application &").
If the pseudo-terminal is enabled, then
works as a proxy between the sessions (copy stdin and stdout).
This feature is mostly designed for interactive sessions.
If the standard input is not a terminal,
but for example a pipe (e.g., echo "date" | su --pty),
then the ECHO flag for the pseudo-terminal is disabled to avoid messy output.
- -s, --shell=shell
Run the specified shell instead of the default. The shell to run is
selected according to the following rules, in order:
the shell specified with
the shell specified in the environment variable
option is used
the shell listed in the passwd entry of the target user
If the target user has a restricted shell (i.e., not listed in
option and the
environment variables are ignored unless the calling user is root.
but do not create a new session. (Discouraged.)
- -w, --whitelist-environment=list
Don't reset the environment variables specified in the
comma-separated list when clearing the
environment for --login. The whitelist is ignored for the environment variables
- -V, --version
Display version information and exit.
- -h, --help
Display help text and exit.
Upon receiving either
terminates its child and afterwards terminates itself with the received signal.
The child is terminated by SIGTERM, after unsuccessful attempt and 2 seconds of
delay the child is killed by SIGKILL.
configuration files. The following configuration items are relevant
Delay in seconds in case of an authentication failure. The number must be
a non-negative integer.
environment variable for a regular user. The
default value is
Defines the PATH environment variable for root.
takes precedence. The default value is
If set to
and --login and --preserve-environment were not specified
The environment variable
may be different on systems where
are merged into
this variable is also affected by the --login command-line option and
the PAM system setting (e.g.,
normally returns the exit status of the command it executed. If the
command was killed by a signal,
returns the number of the signal plus 128.
Exit status generated by
Generic error before executing the requested command
The requested command could not be executed
The requested command was not found
default PAM configuration file
PAM configuration file if --login is specified
command specific logindef config file
global logindef config file
For security reasons,
always logs failed log-in attempts to the btmp file, but it does not write to
file at all. This solution can be used to control
behavior by PAM configuration. If you want to use the
print warning message about failed log-in attempts then
be configured to update the
file as well. For example by:
session required pam_lastlog.so nowtmp
derived from coreutils' su
, which was based on an implementation by
David MacKenzie. The util-linux version has been refactored by Karel Zak.
The su command is part of the util-linux package and is
Linux Kernel Archive