TITANTOOLS(8)

👑 TITANTOOLS(8) — System Manager's Manual 💅

okay bestie, welcome to section 8 of the manual, the system manager's zone ✨ this is where we keep the programs that run your whole machine, and today's main character is runas.

🌸 NAME 🌸

runas — a lil program that runs daemons as non privileged users 🫶

✨ SYNOPSIS ✨

runas [-c directorio]  [uid]  [gid]  [umask]  [program]  [[options]]

that's it. that's the whole vibe. no cap 💖

🦋 DESCRIPTION 🦋

so runas is this small program that gives administrators a generic way to run daemons as non privileged users. like, a one-size-fits-all lil guy for dropping privileges, and honestly? iconic 👑

here's the tea: runas is equivalent to using su — but it strips off the environment, and it does not require the target user's shell to be legitimate. and by legitimate we mean listed under /etc/shells. so if your daemon user has some feral shell that nobody ever approved, runas literally does not care. it's giving unbothered. it's giving main character energy 😌

the main reason you'd use runas is to avoid having daemons run as the root user. and look — sometimes that's genuinely necessary, like for login programs such as ssh or telnetd that need to switch to the user making the connection. but in many cases it might not be necessary at all. so if you can avoid it, avoid it, periodt.

it can also be a good replacement for su, since it prevents attacks to daemons through the use of environment variables. environment variables are lowkey a whole attack surface and runas said "not on my watch" 🙈

so like, just change — in your initialisation scripts under /etc/init.d — the line that looks like this:

su - daemon -c /usr/bin/blah

to this:

runas daemon daemongroup /usr/bin/blah

and that's the glow-up. glow-up complete. slay 🔥

💅 OPTIONS 💅

this program just takes two command line options. only two. minimal. curated. obsessed.

• -? — show a summary of options. the lil "help me bestie" flag 🎀
• -cdirectory — chroot the daemon to a specific directory before execution. yes, that's -c with the directory glued right onto it, no space. keep it glued, bestie 🫶

🌈 SEE ALSO 🌈

chroot(2), chroot(8)

go read those if you want the full chroot lore. iykyk ✨

💜 AUTHOR 💜

this manual page was written by Javier Fernandez-Sanguino Pen~a <jfs@debian.org> for the Debian system (but may be used by others).

permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 any later version published by the Free Software Foundation.

on Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

bestie reminder 💖 this page lives in TITANTOOLS(8), section 8, the System Manager's Manual — so if you ever forget where you found it, that's the whole address. mwah, go run your daemons safely 🌸💅