SU(1)                            User Commands                            SU(1)

NAME
       su - run a command with substitute user and group ID

SYNOPSIS
       su [options] [-] [user [argument...]]

DESCRIPTION
       su allows commands to be run with a substitute user and group ID.

       When called with no user specified, su defaults to running an
       interactive shell as root. When user is specified, additional arguments
       can be supplied, in which case they are passed to the shell.

       For backward compatibility, su defaults to not change the current
       directory and to only set the environment variables HOME and SHELL (plus
       USER and LOGNAME if the target user is not root). It is recommended to
       always use the --login option (instead of its shortcut -) to avoid side
       effects caused by mixing environments.

       This version of su uses PAM for authentication, account and session
       management. Some configuration options found in other su
       implementations, such as support for a wheel group, have to be
       configured via PAM.

       su is mostly designed for unprivileged users, the recommended solution
       for privileged users (e.g., scripts executed by root) is to use
       non-set-user-ID command runuser(1) that does not require authentication
       and provides separate PAM configuration. If the PAM session is not
       required at all then the recommended solution is to use command
       setpriv(1).

       Note that su in all cases uses PAM (pam_getenvlist(3)) to do the final
       environment modification. Command-line options such as --login and
       --preserve-environment affect the environment before it is modified by
       PAM.

       Since version 2.38 su resets process resource limits RLIMIT_NICE,
       RLIMIT_RTPRIO, RLIMIT_FSIZE, RLIMIT_AS and RLIMIT_NOFILE.

OPTIONS
       -c, --command=command
           Pass command to the shell with the -c option.

       -f, --fast
           Pass -f to the shell, which may or may not be useful, depending on
           the shell.

       -g, --group=group
           Specify the primary group. This option is available to the root user
           only.

       -G, --supp-group=group
           Specify a supplementary group. This option is available to the root
           user only. The first specified supplementary group is also used as a
           primary group if the option --group is not specified.

       -, -l, --login
           Start the shell as a login shell with an environment similar to a
           real login:

           •   clears all the environment variables except TERM and variables
               specified by --whitelist-environment

           •   initializes the environment variables HOME, SHELL, USER,
               LOGNAME, and PATH

           •   changes to the target user’s home directory

           •   sets argv[0] of the shell to '-' in order to make the shell a
               login shell

       -m, -p, --preserve-environment
           Preserve the entire environment, i.e., do not set HOME, SHELL, USER
           or LOGNAME. This option is ignored if the option --login is
           specified.

       -P, --pty
           Create a pseudo-terminal for the session. The independent terminal
           provides better security as the user does not share a terminal with
           the original session. This can be used to avoid TIOCSTI ioctl
           terminal injection and other security attacks against terminal file
           descriptors. The entire session can also be moved to the background
           (e.g., su --pty - username -c application &). If the pseudo-terminal
           is enabled, then su works as a proxy between the sessions (sync
           stdin and stdout).

           This feature is mostly designed for interactive sessions. If the
           standard input is not a terminal, but for example a pipe (e.g., echo
           "date" | su --pty), then the ECHO flag for