1

I don't understand. In BSD if I want to run su -, I have to add myself to wheel group. Is this not true in Linux?

[test@centos ~]$ uname -a
Linux centos 4.18.0-193.19.1.el8_2.x86_64 ...
[test@centos ~]$ cat /etc/group | grep wheel
wheel:x:10:
[test@centos ~]$ cat /etc/group | grep test
test:x:1001:
[test@centos ~]$ su -
Password: 
Last login: Wed Oct 14 ...
[root@centos ~]# whoami
root
payagit373
  • 13
  • 3
  • A search engine is good for finding answers before posting a question. Have a look at the answer hidden within https://unix.stackexchange.com/questions/535936/why-is-su-world-executable Welcome aboard! – vk5tu Oct 14 '20 at 12:59
  • Membership of the wheel group is required by the BSD-authored su command. Membership of the wheel group is not required by the GNU-authored su command in their coreutils programs. Richard Stallman gives reasons at https://ftp.gnu.org/old-gnu/Manuals/coreutils-4.5.4/html_node/coreutils_149.html When PAM support was added to GNU's su, that behaviour was configured as the default. – vk5tu Oct 14 '20 at 13:02

2 Answers2

6

It depends on the Linux distribution, but in CentOS, there's no special relationship between su and wheel out of the box:

% docker run --rm -it centos:8
[root@58212abdad65 /]# grep wheel /etc/pam.d/ -r
/etc/pam.d/su:# Uncomment the following line to implicitly trust users in the "wheel" group.
/etc/pam.d/su:#auth     sufficient  pam_wheel.so trust use_uid
/etc/pam.d/su:# Uncomment the following line to require a user to be in the "wheel" group.
/etc/pam.d/su:#auth     required    pam_wheel.so use_uid

As you can see, you can configure it to behave like the BSD you use.

In some other distros, the first option might be enabled (allowing wheel users to su without needing a password), but I don't remember which ones.

muru
  • 69,900
  • 13
  • 192
  • 292
  • i can confirm, that on ubuntu, ubuntu server, raspberrypi os everyone can use "su" if you have the root password. – Bonsi Oct 14 '20 at 07:16
2

When invoked as aforementioned, the su command will ask for a root/superuser password; group membership is irrelevant, as long as you know the password. Now, if you were using sudo su, you could assign group(s) superuser rights; wheel and sudo are (2) groups most often used out-of-the-box, especially on single-user systems.

ajgringo619
  • 3,113
  • 1
  • 11
  • 37
  • Yes, but you specifically asked "Is this not true in Linux?" - so no reason for the downvotes, as this answer is correct. – Bonsi Oct 14 '20 at 07:12