Этим замечательным пулл-реквестом, Lennart Poettering, добавил замену su(1) в machinectl.
Открыть новый шелл для root на локальной машине:
$ machinectl shell
Для указания пользователя используется опция --uid=...
When using the shell command without arguments (thus invoking the executed shell or command on the local host) it is similar in many ways to a su(1) session, but unlike su completely isolates the new session from the originating session, so that it shares no process or session properties, and is in a clean and well-defined state. It will be tracked in a new utmp, login, audit, security and keyring session, and will not inherit any environment variables or resource limits, among other properties.
Несколько слов от Леннарта про su(1):
Well, there have been long discussions about this, but the problem is that what «su» is supposed to do is very unclear. On one hand it's supposed to open a new session and change a number of execution context parameters (uid, gid, env, ...), and on the other it's supposed to inherit a lot concepts from the originating session (tty, cgroup, audit, ...). Since this is so weakly defined it's a really weird mix&match of old and new paramters. To keep this somewhat managable we decided to only switch the absolute minimum over, and that excludes XDG_RUNTIME_DIR, specifically because XDG_RUNTIME_DIR is actually bound to the session/audit runtime and those we do not transition. Instead we simply unset it.
Long story short: «su» is really a broken concept. It will given you kind of a shell, and it's fine to use it for that, but it's not a full login, and shouldn't be mistaken for one.
THis has come up many times, but nothing really changed, hence closing this now. I understand this is confusing and unexpected, but well, that's UNIX...
