URL: <https://savannah.gnu.org/bugs/?68587>
Summary: Prefer runuser over su
Group: findutils
Submitter: ametzler
Submitted: So 02 Aug 2026 11:36:33 CEST
Category: updatedb
Severity: 3 - Normal
Priority: 5 - Normal
Item Group: None
Status: None
Privacy: Public
Assigned to: None
Originator Name:
Originator Email:
Open/Closed: Open
Discussion Lock: Unlocked
Release: 4.11.0
Fixed Release: None
_______________________________________________________
Follow-up Comments:
-------------------------------------------------------
Date: So 02 Aug 2026 11:36:33 CEST By: Andreas Metzler <ametzler>
util-linux added runuser in 2.23 (April 2013) for exactly the purpose updatdb
is using su for.
Quoting su(1)
> su is mostly designed for unprivileged users, the recommended
> solution for privileged users (e.g., scripts executed by
> root) is to use non-set-user-ID command runuser(1) that does
> not require authentication and provides separate PAM
> configuration. If the PAM session is not required at all
> then the recommended solution is to use command setpriv(1).
For Debian I am definitely going to switch to fix
https://bugs.debian.org/1142935 - We are running updated via systemd and are
setting minimal permissions (e.g. ProtectSystem=strict) in the service file.
The su PAM configuration uses pam_wtmpdb/pam_lastlog2 (if installed) but the
inherited systemd sandboxing prevents mysql write access to the respective
databases of these PAM modules. Using runuser instead of su fixes this.
_______________________________________________________
File Attachments:
Name: POC_runuser.diff Size: 2,0KiB
<https://file.savannah.gnu.org/file/POC_runuser.diff?file_id=58851>
AGPL NOTICE
These attachments are served by Savane. You can download the corresponding
source code of Savane at
https://savannah.gnu.org/source/savane-c36938be85ff6c1b727bc7dd7fd30e48f9142870.tar.gz
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68587>
_______________________________________________
Nachricht gesendet über Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
