When I ran a long-running command under sudo, I noticed that sudo showed up in the process list (ps).

At the same time I noticed login shows up in systemctl status "session-${XDG_SESSION_ID}.scope" when you log in on the text console.

Why do they fork a separate child process? Why do they not use exec() which would entirely replace themselves, with the desired program (a shell, in the case of login)? That's how nice and env work, for example.


The parent process has stuff to clean up afterwards. E.g. for the login records, see man utmp which is used for commands like who to show the list of logged in users.

On Linux, both the setup and cleanup actions are performed by Pluggable Authentication Modules (PAM).

  • … which is why, of course, one should not abuse su for dropping privileges. – JdeBP Sep 24 '17 at 7:40
  • @JdeBP lol, though I don't think the argument is very clear there, the single point with "temporary network mounts" is far more convincing :). You might be happy to know that man su on my machine points you right towards yet another minimal wrapper, setpriv, which is part of util-linux. I don't see it in Debian Jessie though, only Fedora. – sourcejedi Sep 24 '17 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.