How to run command as different user

Question

Is it possible to run a command

• with parameters first of which starts with - (dash) e.g. /usr/bin/echo -n foo
• as different user and group, for example apache:apache
• using command su
• when login shell is set to /sbin/nologin ?

I tried:

• su -s "/usr/bin/echo" -g apache apache -n foo
  • fails with su: invalid option -- 'n'. It looks like first argument may not start with dash.
• su -c "/usr/bin/echo -n foo" -g apache apache
  • fails with nologin: invalid option -- 'c'. It looks like -c can't be used if login shell is /sbin/nologin

Answer 1

sudo to the rescue!

sudo -u <user> -g <group> -- echo -n foo

Answer 2

su -s /bin/bash -c "/usr/bin/echo -n foo" -g apache apache

• -s /bin/bash overrides nologin and allows to interpret value of -c option
• -c "/usr/bin/echo -n foo" allows to avoid using dash-starting first argument

Answer 3

If the user's login shell is set to /sbin/nologin then the user can't login and su - generally won't work.

But there is the su -m option to preserve the current user's environment and login shell:

su -m <user> -c "<command>"

For example:

su -m apache -c "echo hello; id"

Prints:

hello
uid=33(apache) gid=33(apache) groups=33(apache)