KamoCRM

The reaper used `su` too — runuser, and no shell anywhere

RefactorKlusterServices
Shipped
3 செப்டம்பர், 2026 அன்று 7:50 PM UTC
Author
Kamo
Commit
d95d21d

Dropping su from the exec path left it in reap_idle, which runs on every terminal connect. Same three objections, and the last one is the one that bites: `su - <user> -c "..."` builds a shell string, opens a PAM session, and sources the account's profile — so a .bashrc that prints anything would prepend it to the tmux listing this method parses. `runuser -u <user> --` takes an argv list and does none of those things. With this, no part of the terminal path assembles a command as a string. A test now asserts no argv in the reaper contains `su` and every one starts with runuser, so this cannot quietly come back. 114 tests.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing