Go to main content

man pages section 8: System Administration Commands

Exit Print View

Updated: Friday, February 2, 2018



su - become superuser or another user


su [-fpmslh] [-c <command> ] [username [arg...]]


The su command allows one to become another user without logging off or to assume a role. The default user name is root (superuser).

To use su, the appropriate password must be supplied (unless the invoker is already root). If the password is correct, su creates a new shell process that has the real and effective user ID, group IDs, and supplementary group list set to those of the specified username. Additionally, the new shell's project ID is set to the default project ID of the specified user. See getprojent(3PROJECT), setproject(3PROJECT). The new shell will be the shell specified in the shell field of username's password file entry (see passwd(5)). If no shell is specified, /usr/bin/sh is used (see sh(1)). If superuser privilege is requested and the shell for the superuser cannot be invoked using exec(2), /sbin/sh is used as a fallback. To return to normal user ID privileges, type an EOF character (CTRL-D) to exit the new shell.

Any additional arguments given on the command line are passed to the new shell. When using programs such as sh, an arg of the form –c string executes string using the shell and an arg of –r gives the user a restricted shell.

To create a login environment, the command “su –” does the following:

  • In addition to what is already propagated, the LC* and LANG environment variables from the specified user's environment are also propagated.

  • Set MAIL to /var/mail/new_user.

If the first argument to su is a dash (-), the environment will be changed to what would be expected if the user actually logged in as the specified user. Otherwise, the environment is passed along, with the exception of $PATH, which is controlled by PATH and SUPATH in /etc/default/su.

All attempts to become another user using su are logged in the log file /var/adm/sulog (see sulog(5)).


The following options are supported:

–f, –-fast

Requests that the shell bypasses reading initialisation scripts. Not all shells support this.

-, –l, –-login

Simulates a login environment.

–m, –p, –-preserve-environment

Preserves the environment. Silently ignored if the –l is also passed. Specifically the $USER, $HOME, $LOGNAME environment variables are not set.

–c, –-command=<command>

Passes the <command> to the invoked shell by using the shell's –c option.

–s, –-shell=<shell>

Uses the requested program as the users shell. Users that have a shell that is not returned by the getusershell function, cannot use this option unless the current user is root.

If the environment is being preserved and no option value is specified then the shell started is the one specified by $SHELL if present. Otherwise, the users entry in passwd is used. When no shell is specified in the passwd entry, /bin/sh is used as a fallback.

–h, –-help

Displays the command usage.


su uses pam(3PAM) with the service name su for authentication, account management, and credential establishment.


Example 1 Becoming User bin While Retaining Your Previously Exported Environment

To become user bin while retaining your previously exported environment, execute:

example% su bin
Example 2 Becoming User bin and Changing to bin's Login Environment

To become user bin but change the environment to what would be expected if bin had originally logged in, execute:

example% su - bin
Example 3 Executing command with user bin's Environment and Permissions

To execute command with the temporary environment and permissions of user bin, type:

example% su - bin -c "command args"
Example 4 Executing a Command by Using an Alternate Shell

To execute a command as user bob and preserve the environment, but using a shell other than the accounts default type:

example% su -s /bin/zsh -p bob "command args"

Environment Variables

Variables with LD_ prefix are removed for security reasons. Thus, su bin will not retain previously exported variables with LD_ prefix while becoming user bin.

If any of the LC_* variables ( LC_CTYPE, LC_MESSAGES, LC_TIME, LC_COLLATE, LC_NUMERIC, and LC_MONETARY) (see environ(7)) are not set in the environment, the operational behavior of su for each corresponding locale category is determined by the value of the LANG environment variable. If LC_ALL is set, its contents are used to override both the LANG and the other LC_* variables. If none of the above variables are set in the environment, the “C” (U.S. style) locale determines how su behaves.


Determines how su handles characters. When LC_CTYPE is set to a valid value, su can display and handle text and filenames containing valid characters for that locale. su can display and handle Extended Unix Code (EUC) characters where any individual character can be 1, 2, or 3 bytes wide. su can also handle EUC characters of 1, 2, or more column widths. In the “C” locale, only characters from ISO 8859-1 are valid.


Determines how diagnostic and informative messages are presented. This includes the language and style of the messages, and the correct form of affirmative and negative responses. In the “C” locale, the messages are presented in the default form found in the program itself (in most cases, U.S. English).



user's login commands for sh and ksh


system's password file


system-wide sh and ksh login commands


log file


This file is obsolete. However, you can use the svc:/system/security/account-policy:default service to set the corresponding SMF properties.

The following table lists the mapping between the properties in the /etc/default/su and the SMF properties:

Property in /etc/default/login
Corresponding SMF Property

For information on managing the SMF properties, see the account-policy (8S) man page.

The descriptions of the properties in the /etc/default/su file are as follows:


If defined, all attempts to su to another user are logged in the indicated file.


If defined, all attempts to su to root are logged on the console.


Default path. (/usr/bin:)


Default path for a user invoking su to root. (/usr/sbin:/usr/bin)


Determines whether the syslog(3C) LOG_AUTH facility should be used to log all su attempts. LOG_NOTICE messages are generated for su's to root, LOG_INFO messages are generated for su's to other users, and LOG_CRIT messages are generated for failed su attempts.


the default parameters in this file are:


If present, sets the number of seconds to wait before login failure is printed to the screen and another login attempt is allowed. Default is 4 seconds. Minimum is 0 seconds. Maximum is 5 seconds.

Both su and login(1) are affected by the value of SLEEPTIME.


See attributes(7) for descriptions of the following attributes:


See Also

csh(1), env(1), ksh(1), login(1), roles(1), sh(1), exec(2), syslog(3C), pam(3PAM), pam_acct_mgmt(3PAM), pam_authenticate(3PAM), pam_setcred(3PAM), getprojent(3PROJECT), setproject(3PROJECT), pam.conf(5), passwd(5), profile(5), sulog(5), attributes(7), environ(7), syslogd(8), account-policy (8S)