0

I'm starting a process foobar as an upstart service which should be run under user joe. For this I'm using su -c:

script
    su -c "foobar" joe
end script

However the su process is still lying around when foobar executes. How can I replace the process? Is there an option to su, or another (standard) utility?

2
  • Can you not use sudo -u? Commented Oct 23, 2017 at 14:49
  • 1
    exec blahdeblah should replace a shell script process with blahdeblah
    – thrig
    Commented Oct 23, 2017 at 14:56

1 Answer 1

2

Do not abuse su for dropping user privileges.

It hasn't worked the right way for that for the better part of two decades, and it is in fact a tool for adding privileges. As the hyperlinked article explains in detail, it is not suitable as a dæmon helper tool. You are witnessing one of the very reasons why.

Upstart has the setuid stanza for setting the user account that the job process(es) execute(s) as, as the upstart Cookbook says.

If you really want a chain-loading tool for doing this, the daemontools family of toolsets has such tools in abundance.

Use setuidgid, setuidgid, s6-setuidgid, chpst, runuid, or setuidgid in the exec stanza:

exec setuidgid joe foobar
2
  • I do not need an external tool for this, so the default upstart stanza fits perfectly the bill! Thanks. Commented Oct 25, 2017 at 14:41
  • I have confirmed that setuidgid works! thank you
    – osexp2000
    Commented Jul 9, 2021 at 6:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .