Lets say I am logged in at a root terminal and I run something like the following command:

sudo -u '#1000' dbus-launch chromium
  • Are there any potential security issues I should be worried about?
  • Is there a safer way to do it? With the requirement that it works with GUI applications, which runuser does not. If I use runuser I get failed to open display.

With that I can execute terminal commands from my keyboard through custom drivers (g15daemon), which can only be launched as root.

  • What privileges does the user with UID 1000 have? If that user is just a usual non-privileged user, then there shouldn't be any security issues. My understanding is that the dbus-launch chromium process will have the same rights as if you had run the command while logged in as that user.
    – Warwick
    Jul 2, 2014 at 1:22
  • @Warwick User with UID 1000 is just a usual user in the wheel group. So in theory at least this is just as much safe as it would be to launch it from the user itself?
    – Cestarian
    Jul 2, 2014 at 8:23
  • 4
    You don't need sudo for this, you can use su username -c "command".
    – Barmar
    Jul 2, 2014 at 20:20
  • 2
    Barmar is right. If you are already root, then there is no point in running sudo.
    – Warwick
    Jul 2, 2014 at 23:28
  • @Barmar You don't need su for this. In fact su has some serious deficiencies that sudo can handle.
    – phemmer
    Jul 7, 2014 at 16:52

1 Answer 1



From the relevant man page:

The real and effective uid and gid are set to match those of the target user as specified in the passwd file.

Also, in the description for the -P (preserve group vector) option to sudo:

The real and effective group IDs, however, are still set to match the target user.

Basically, whatever commands that are run using sudo will be run with the effective user and group IDs of the target user.

To answer the question, “Is there a safer way to do it”, when running sudo as a non-privileged user, I prefer to use the -H (HOME) option to “set the HOME environment variable to the homedir of the target user”. Some time in the past I was caught out by some unexpected behaviour (can’t remember the details) which I was able to prevent by adding the -H option to shell scripts that used sudo.

You should probably also make sure that the secure_path and env_reset options are set correctly in your /etc/sudoers. Running sudo -V shows which environment variables will be passed on to commands launched by sudo and which won’t along with other interesting / useful information.


Alternatively, you can use su $(id -un 1000) -c 'dbus-launch chromium' to run Chromium with the effective user id and group id of user #1000.

If you use su to accomplish the same task, you should be aware that (by default) su only sets the HOME and SHELL environment variables to those of the target user. In this case (where the target user is non-priveleged, i.e., not a super-user) the USER and LOGNAME are also set to those of the target user. The remaining environment variables (such as PATH) are preserved.

To avoid leaking any environment data to the non-privileged processes being run, su should be run with the --login or -l option for a login shell, e.g. su $(id -un 1000) -lc 'dbus-launch chromium'

The --login unsets all environment variables except TERM and then resets HOME,SHELL, USER and LOGNAME as listed above. In addition the PATH is set to a pre-compiled default value and the current working directory is set to the target user’s home directory before running the target user’s login script.

I generally prefer sudo over su because of its logging capability and its “ticketing system” which obviates the need to re-type your password within 5 minutes of the previously successful sudo.

  • Thanks, I think I can deduce from this that there are potential security risks associated with ´sudo´, for example you can see here a former issue with secure_path and there is a rather big list of environment variables that is passed on too by default which I know very little about. Is ´su -c´ really safer? or does it have the same problems?
    – Cestarian
    Jul 5, 2014 at 17:26
  • I wasn’t aware that you could have different instances of PATH in your environment so I couldn’t say if su is any safer in this regard. BTW, I edited my answer above to add extra info about su and to advocate using -l if you choose to use su (I also tried to improve the formatting to make the now longer answer more readable). Jul 7, 2014 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.