0

What are the differences between

su target-user

and

login target-user

? The latter may need sudo.

They both seem to me to create a login session for target-user. Thanks.

2
  • Have you seen the relevant paragraph at the end of the login manpage (in the “BUGS” section)? Commented May 4, 2018 at 16:32
  • @StephenKitt Thanks. I am not sure why the newer version manpage (man7.org/linux/man-pages/man1/login.1@@shadow-utils.html) that I have read didn't mention that. No longer valid? Is the new i.e. shadow-utils version more or less accurate that the old version?
    – Tim
    Commented May 4, 2018 at 17:14

1 Answer 1

1

They both seem to me to create a login session for target-user.

In reality, they do not. su does not create a login session. It "switches user" to run a program under the aegis of a different user account, adding privileges (that account's privileges) to the totality of privileges available to the user of the existing login session that it is run in.

In fact, the login program does not create a login session either. It expects the login session, with the process running login marked as the session leader process and a controlling terminal attached, to have been set up already by whatever invoked it. login target-user, assuming the C shell's built-in login command that is effectively an exec, co-opts the existing already-set-up login session for another user account. This of course entails risks that are well known by this point.

This is of course considering the kernel's concept of a login session, which involves a session leader, a controlling terminal, and process groups. The systemd people have invented their own entirely application-mode concept of a login session, managed by systemd-logind in conjunction with PAM plug-ins. The rules are slightly different here, in part because the systemd people botched them by conflating service stop at shutdown with session hangup (and still need to fix this). But su does not create this type of login session either.

Further reading

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .