I recently read Simon Tatham's Nitpicking the shell history scene in Tron: Legacy , where one thing that surprised Tatham was the film using ' login -n root ' to become root instead of ' su . This surprised me because I found that perfectly ordinary, and this turns up both a bit of Unix history and a difference between modern Unixes.

Plain ' su ' can let you become another user, including root , but what it explicitly doesn't do by default is create a new login shell for that user. If you do ' su root ', the new root shell normally inherits most of your environment, your current directory, and so on. Sometimes this is what you want and sometimes you really want a new login environment, and originally in Unix how you got the latter was to run ' login ' from your existing shell session (and this meant that login was setuid root, like su).

This split usage of su(1) and login(1) is present in Research Unix V7 ( and for login goes back to at least V3 ), where the respective manual pages clearly say that su doesn't change your environment or your current directory, while login 's normal use (from a shell) is to 'change from one user to another'. Similar wording remains in the 4.2 BSD su(1) , but in System III, su(1) picked up an option to make the new shell a login shell (and it even describes the mechanism ) and login(1) lost the ability to be run from a normal shell. The 4.3 BSD su(1) picked up the System III su change, but login(1) can still be used from a normal shell, and I believe this continued on the BSD lineage in general.

As you might expect, all of the modern versions of su across Linux and the free BSDs support starting a login shell (cf the normal Linux su ( also ), FreeBSD su(1) , NetBSD su(1) , and OpenBSD su(1) ). On Linux and OpenBSD, login isn't setuid root and so can't be used from a regular shell environment to become a new user; your only option is su . On FreeBSD and NetBSD, login is still setuid root and can be used to switch to another account with a login shell, although this usage doesn't seem to be explicitly documented in either's manual page. Illumos (the open source successor of Solaris) also still supports using login from a command shell, and explicitly documents this in login(1) .

(OpenBSD making login not be setuid fits their general security posture, since a setuid login has been a vector for security issues in the past . I can't easily find out if Linux versions of login were ever setuid.)

PS: It's possible that login is still setuid on some Linux distributions. The normal util-linux login specifically says that it doesn't work from a shell session, but the shadow-utils login may still, and some distributions might enable that.

(This sort of elaborates on a Fediverse post I made .)

Sidebar: The early history of su

The su command goes back to V1 Unix , but at the time it was only used to let you become root ('superuser', likely the source of the 'su' command name). We don't have much from V2 ( well, sort of [PDF] ), but in V3 su's manpage moves to section 8 (for 'administrative commands') as su(8) , where it stayed in Research Unix V4 , V5 (per the V5 manual [PDF] ), and V6 . Only in V7 does su gain the ability to change to any user and its manual page was moved to section 1 (for general commands) as su(1) .

(Potentially of interest is this reconstruction of old Unix manual pages .)