Observing /var/log/syslog while using su and sudo reveals that this may actaully be a bug in sudo.
When I use su, I see systemd-logind logging the creation and destruction of a new session for the target user before and after the process invoked by su exits, respectively. That is, su forks and the parent process waits around for the child process to exit before closing the session. With sudo, however, the log messages form systemd show that the session is being created and destroyed immediately, before the target process exits. sudo appears to open and close the PAM session before execing the target process. Run 'tail -F /var/log/syslog' and compare the different timing of the log messages generated when running 'su' and 'sudo -i', then waiting a few seconds before closing the invoked shell, to see what I mean. -- Sam Morris <https://robots.org.uk/> 3412 EA18 1277 354B 991B C869 B219 7FDB 5EA0 1078
signature.asc
Description: This is a digitally signed message part
