I'm making an upstart job, and I need to run an executable as another user. Nothing fancy like
su provides, and none of the mixed-up SELinux contexts that come along with it. A quick internet search recommends
su for this task, but
runuser is nowhere to be found on Ubuntu 13.10.
Should I be using
su on Ubuntu--will it be smart enough to avoid full authorization? Would a resulting job be portable to other distros, or will I run into SELinux issues?
Ultimately, what's the best way to change users in an upstart job?
Apparently upstart >= 1.4 supports
setgid, but they're limited in that they affect all of the job pre-*/post-* scripts, not just the primary script/exec. It'd still be nice to have a way to properly drop to another user for a single command. I've considered using
stop-start-daemon, but it overlaps too much with upstart and will likely cause
expect to behave oddly.