On Sun, May 11, 2014 at 11:12:08AM +1000, Brian May wrote: > On 11 May 2014 03:13, Matthias Urlichs <matthias@urlichs.de> wrote: > > "su" does a bunch of things that are perfectly appropriate for something > > that creates a "new" login. That's its job. > I am still a bit confused, isn't this only when you use the "-l" su flag? The '-l' flag is defined rather vaguely in the documentation, but in practice it appears to only impact the inheritance of environment variables. > Does su do stuff (e.g. pam session stuff) even without the -l flag? Yes. This has been the case for su in Debian since 1999, and to do otherwise would break a variety of configurations where session setup is required in order for, e.g., the su process to have access to the files of the target user. > Running a daemon under its own UID is an almost-completely different > > problem. We already have a tool which does this (start-stop-daemon), > > which has been recommended for this task for umpteen years, and which still > > works if there is no .service file – for whatever reason. > As a debian developer I was unaware of this. > What about the task of running a short program for a brief duration, e.g. > from cron scripts? Is using su considered acceptable? > e.g. /etc/cron.daily/spamassassin on wheezy has numerous references to su. > I think there might be other packages, this is just one I could find the > quickest. Cronjobs are not always shortlived either, and can also cause these sorts of "phantom" sessions to show up to logind. I don't think we want to use su for cronjobs. > The name "start-stop-daemon" would suggest this is inappropriate for cron > jobs, is that an invalid assumption I made? Perhaps a better name could have been chosen, in hindsight. But in practice, s-s-d is the best available tool for uid switching in any noninteractive scripts. Systemd (as upstart) sidesteps this problem to a large degree by handling uid switching as a native directive, avoiding the need to call out to a separate command. -- Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer http://www.debian.org/ slangasek@ubuntu.com vorlon@debian.org
Attachment:
signature.asc
Description: Digital signature