https://github.com/ncopa/su-exec

switch user and group id and exec
https://github.com/ncopa/su-exec

Last synced: 1 day ago
JSON representation

switch user and group id and exec

• Host: GitHub
• URL: https://github.com/ncopa/su-exec
• Owner: ncopa
• License: mit
• Created: 2015-12-08T08:02:04.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2024-07-12T10:15:09.000Z (5 months ago)
• Last Synced: 2024-12-18T06:08:59.999Z (3 days ago)
• Language: C
• Homepage:
• Size: 8.79 KB
• Stars: 979
• Watchers: 20
• Forks: 100
• Open Issues: 26
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-docker - su-exec - This is a simple tool that will simply execute a program with different privileges. The program will be excuted directly and not run as a child, like su and sudo does, which avoids TTY and signal issues. Why reinvent gosu? This does more or less exactly the same thing as gosu but it is only 10kb instead of 1.8MB. By [ncopa](https://github.com/ncopa) (Docker Images / Base Tools)
• awesome-docker - su-exec - This is a simple tool that will simply execute a program with different privileges. The program will be executed directly and not run as a child, like su and sudo does, which avoids TTY and signal issues. Why reinvent gosu? This does more or less exactly the same thing as gosu but it is only 10kb instead of 1.8MB. By [ncopa](https://github.com/ncopa) (Docker Images / Base Tools)

README

        
# su-exec

switch user and group id, setgroups and exec

## Purpose

This is a simple tool that will simply execute a program with different

privileges. The program will be executed directly and not run as a child,

like su and sudo does, which avoids TTY and signal issues (see below).

Notice that su-exec depends on being run by the root user, non-root

users do not have permission to change uid/gid.

## Usage

```shell

su-exec user-spec command [ arguments... ]

```

`user-spec` is either a user name (e.g. `nobody`) or user name and group

name separated with colon (e.g. `nobody:ftp`). Numeric uid/gid values

can be used instead of names. Example:

```shell

$ su-exec apache:1000 /usr/sbin/httpd -f /opt/www/httpd.conf

```

## TTY & parent/child handling

Notice how `su` will make `ps` be a child of a shell while `su-exec`

just executes `ps` directly.

```shell

$ docker run -it --rm alpine:edge su postgres -c 'ps aux'

PID   USER     TIME   COMMAND

    1 postgres   0:00 ash -c ps aux

   12 postgres   0:00 ps aux

$ docker run -it --rm -v $PWD/su-exec:/sbin/su-exec:ro alpine:edge su-exec postgres ps aux

PID   USER     TIME   COMMAND

    1 postgres   0:00 ps aux

```

## Why reinvent gosu?

This does more or less exactly the same thing as [gosu](https://github.com/tianon/gosu)

but it is only 10kb instead of 1.8MB.