Re: [bug #68587] Prefer runuser over su

Bernhard Voelker <[email protected]> writes:

> On 8/9/26 17:04, James Youngman wrote:
>> Sorry, I'm not able to log in to Savannah today; the login page gives
>> HTTP 502 errors.
>
> oh.

Even more annoying is that gnu.org isn't indexed by google anymore
meaning no one will be able to find documentation [1].

I bought coreutils.info (only decent domain available) and am tempted to
host docs there. FYI, in case you want to consider doing the same.

>> Go ahead and apply the patch, thanks.   I think runuser is a big
>> improvement here.
>> However, the `which` command is not in POSIX.   The POSIX
>> alternative
>> is `command -v` I think.
>
> I've personally never used 'command', but rather either 'which' or type'.
> Anyway, as you wrote ...

We use it in coreutils tests and likely elsewhere. It is also useful
since it will skip aliases/functions. So you can do stuff like this
(silly example, of course):

    grep ()
    {
      command grep --color=always
    }

>> I also note that the code we are changing here had some variables that
>> should have been better quoted.
>
> Indeed.  To be honest, the updatedb script is quite some mess with regards
> to quoting, but also about initializing variables, boldly taking over values
> from the environment, the locality of variables, redundant code paths, etc.
>
> If we want to enhance it, then this means a 80% rewrite, I'm afraid.

I was tempted at one point to rewrite 'zgrep', etc. in something other
than shell because of "security" reports WRT with quoting.

Collin

[1] https://lists.gnu.org/archive/html/savannah-hackers-public/2026-07/msg00045.html