SU(1) SU(1) su - - su [options] [-] [user|UID [argument...]] su - . , su . , , . , su HOME SHELL ( USER LOGNAME ). --login ( -) . su PAM , . su , , PAM-. su , (., ) ,,non-set-user-ID" runuser(1) PAM . PAM setpriv(1). su PAM (pam_getenvlist(3)) . --login --preserve-environment PAM-. 2.38 su RLIMIT_NICE, RLIMIT_RTPRIO, RLIMIT_FSIZE, RLIMIT_AS RLIMIT_NOFILE. -c, --command Pass command to the shell with the -c option. Creates a new session via setsid(2). Refer to --session-command to keep the same session. -f, --fast -f , , . -g, --group . . -G, --supp-group . . --group . -, -l, --login . Note that on systemd(1)-based systems, a new session may be defined as a real entry point to the system. However, su does not create a real session (by PAM) from this point of view. You need to use tools like systemd-run(1) or machinectl(1) to initiate a complete, real session. su : o clear all the environment variables except TERM, COLORTERM, NO_COLOR and variables specified by --whitelist-environment o initialize the environment variables HOME, SHELL, USER, LOGNAME, and PATH o change to the target user's home directory o set argv[0] of the shell to '-' in order to make the shell a login shell -m, -p, --preserve-environment , . , , -. --login . -P, --pty Create a pseudo-terminal for the session. The independent terminal provides better security as the user does not share a terminal with the original session. Please note security advice about TIOCSTI vulnerability below. The entire session can also be moved to the background (e.g., su --pty - user -c application &). If the pseudo-terminal is enabled, then su works as a proxy between the sessions (sync stdin and stdout). . , (., echo "" | su --pty), ECHO . -s, --shell . (. /etc/shells), --shell . , : o --shell o , --preserve-environment o o /bin/sh --session-command= Same as -c, but do not create a new session. (Discouraged.) Please note security advice about TIOCSTI vulnerability below. -T, --no-pty Do not create a pseudo-terminal, opposite of --pty and -P. Please note security advice about TIOCSTI vulnerability below. -w, --whitelist-environment --login. , , , - . -h, --help . -V, --version . SIGINT, SIGQUIT SIGTERM, su . SIGTERM-, 2 SIGKILL-. su /etc/default/su /etc/login.defs . su: FAIL_DELAY () . - . ENV_PATH () . /usr/local/bin:/bin:/usr/bin. ENV_ROOTPATH (), ENV_SUPATH () . ENV_SUPATH . /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin. ALWAYS_SET_PATH () yes --login --preserve-environment runuser . /bin /sbin /usr; --login (., pam_env(8)). su . , su 128. su: 1 126 127 /etc/pam.d/su /etc/pam.d/su-l --login /etc/default/su ,,logindef" /etc/login.defs ,,logindef" SECURITY NOTES If su shares a terminal with the original session, it is potentially vulnerable to privilege escalation through TIOCSTI/TIOCLINUX ioctl command injection. There are two built-in ways to prevent this: Either you can use su with the -c option, which starts a new session via setsid(2) without a controlling terminal. Or, if your use case requires a controlling terminal, for example an interactive session, you can instruct su to use a pseudo terminal with the --pty or -P option. , su btmp , lastlog . su PAM . pam_lastlog(8) pam_lastlog(8) lastlog . : session required pam_lastlog.so nowtmp su su ,,coreutils"-, . ,,util-linux"- . setpriv(1), login.defs(5), shells(5), pam(8), runuser(1) , ,,https://github.com/util-linux/util-linux/issues[issue tracker]". su ,,util-linux" . util-linux 2.42.2 2026-06-16 SU(1)