NAME
su —
substitute user identity
SYNOPSIS
su |
[-] [-flm]
[-c class]
[login [args]] |
DESCRIPTION
Thesu utility requests appropriate user credentials via
PAM and switches to that user ID (the default user is the superuser). A shell
is then executed.
PAM is used to set the policy su will use.
In particular, by default only users in the
“wheel” group can switch to UID 0
(“root”). This group requirement may
be changed by modifying the
“pam_group” section of
/etc/pam.d/su. See
pam_group(8) for details on how to modify this setting.
By default, the environment is unmodified with the exception of
USER, HOME, and
SHELL. HOME and
SHELL are set to the target login's default values.
USER is set to the target login, unless the target
login has a user ID of 0, in which case it is unmodified. The invoked shell
is the one belonging to the target login. This is the traditional behavior
of su. Resource limits and session priority
applicable to the original user's login class (see
login.conf(5)) are also normally retained unless the target
login has a user ID of 0.
The options are as follows:
-f- If the invoked shell is csh(1), this option prevents it from reading the “.cshrc” file.
-l- Simulate a full login. The environment is discarded except for
HOME,SHELL,PATH,TERM, andUSER.HOMEandSHELLare modified as above.USERis set to the target login.PATHis set to “/bin:/usr/bin”.TERMis imported from your current environment. Environment variables may be set or overridden from the login class capabilities database according to the class of the target login. The invoked shell is the target login's, andsuwill change directory to the target login's home directory. Resource limits and session priority are modified to that for the target account's login class. -- (no letter) The same as
-l. -m- Leave the environment unmodified. The invoked shell is your login shell,
and no directory changes are made. As a security precaution, if the target
user's shell is a non-standard shell (as defined by
getusershell(3)) and the caller's real uid is non-zero,
suwill fail. -cclass- Use the settings of the specified login class. Only allowed for the super-user.
The -l (or -) and
-m options are mutually exclusive; the last one
specified overrides any previous ones.
If the optional args are provided on the
command line, they are passed to the login shell of the target login. Note
that all command line arguments before the target login name are processed
by su itself, everything after the target login name
gets passed to the login shell.
By default (unless the prompt is reset by a startup file) the super-user prompt is set to “#” to remind one of its awesome power.
ENVIRONMENT
Environment variables used by su:
HOME- Default home directory of real user ID unless modified as specified above.
PATH- Default search path of real user ID unless modified as specified above.
TERM- Provides terminal type which may be retained for the substituted user ID.
USER- The user ID is always the effective ID (the target user ID) after an
suunless the user ID is 0 (root).
FILES
- /etc/pam.d/su
- PAM configuration for
su.
EXAMPLES
su -m operator -c poweroff- Starts a shell as user
operator, and runs the commandpoweroff. You will be asked for operator's password unless your real UID is 0. Note that the-moption is required since user “operator” does not have a valid shell by default. In this example,-cis passed to the shell of the user “operator”, and is not interpreted as an argument tosu. su -m operator -c 'shutdown -p now'- Same as above, but the target command consists of more than a single word
and hence is quoted for use with the
-coption being passed to the shell. (Most shells expect the argument to-cto be a single word). su -m -c staff operator -c 'shutdown -p now'- Same as above, but the target command is run with the resource limits of
the login class “staff”. Note: in this example, the first
-coption applies tosuwhile the second is an argument to the shell being invoked. su -l foo- Simulate a login for user foo.
su - foo- Same as above.
su -- Simulate a login for root.
SEE ALSO
csh(1), sh(1), group(5), login.conf(5), passwd(5), environ(7), pam_group(8)
HISTORY
A su command appeared in
Version 1 AT&T UNIX.