#1086509 `sudo -iu postgres` starts user systemd for system user

Package:
sudo
Source:
sudo
Description:
Provide limited super user privileges to specific users
Submitter:
Christoph Berg
Date:
2026-01-29 08:31:03 UTC
Severity:
normal
Tags:
#1086509#3
Date:
2024-10-31 14:53:56 UTC
From:
To:
Hi,

I'm now getting a full user systemd including dbus and pipewire when
logging into the postgres user account:

[0] 15:51 myon@turing:~ $ sudo -iu postgres
[0] 15:51 postgres@turing:~ $ ps xf
    PID TTY      STAT   TIME COMMAND
 113664 pts/8    S      0:00 -bash
 113688 pts/8    R+     0:00  \_ ps xf
 113641 ?        Ss     0:00 /usr/lib/systemd/systemd --user
 113642 ?        S      0:00  \_ (sd-pam)
 113660 ?        Ssl    0:00  \_ /usr/bin/pipewire
 113661 ?        Ssl    0:00  \_ /usr/bin/pipewire -c filter-chain.conf
 113663 ?        Ssl    0:00  \_ /usr/bin/wireplumber
 113665 ?        Ssl    0:00  \_ /usr/bin/pipewire-pulse
 113668 ?        Ss     0:00  \_ /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
[0] 15:51 postgres@turing:~ $ id
uid=118(postgres) gid=127(postgres) Gruppen=127(postgres),110(ssl-cert)
[0] 15:52 postgres@turing:~ $

This didn't use to be the case, and I don't think it is the right
behavior now.

I am not sure which package's fault this is, please forward if I got
the wrong one.

#1086509#12
Date:
2024-10-31 18:01:11 UTC
From:
To:
Hi,

Luca wrote:

I find it pretty rude to just reassign without a single word of
explanation. You (that means all of you reading this) have one week to
tell me what sudo can do here to fix this. After that, the bug will be
wontfixed or closed from the sudo side.

Other team members are invited to chime in as well.

Greetings
Marc

#1086509#15
Date:
2024-10-31 18:01:11 UTC
From:
To:
Hi,

Luca wrote:

I find it pretty rude to just reassign without a single word of
explanation. You (that means all of you reading this) have one week to
tell me what sudo can do here to fix this. After that, the bug will be
wontfixed or closed from the sudo side.

Other team members are invited to chime in as well.

Greetings
Marc

#1086509#18
Date:
2024-10-31 21:11:33 UTC
From:
To:
So `sudo -u postgres -i` opens a login shell as postgres and starts systemd.

But `sudo su -`; `su - postgres` opens a login shell as postgres and does not start systemd.

sudo shouldn't behave differently here; I guess there is some
difference somewhere in the pam configuration.

Christoph

#1086509#23
Date:
2024-10-31 23:53:35 UTC
From:
To:
to
be
some parameters, and the reporter thinks what happens should not
happen. It's for the maintainers of sudo to decide whether that is
expected or not, and change sudo or its configuration or whatnot
accordingly. libpam-systemd is just a library that does the job it's
supposed to do when it's configured to be in the pam callstack.

#1086509#28
Date:
2024-11-01 10:01:00 UTC
From:
To:
Control: tags -1 help
thanks

From the bug I only see that you're using testing. testing has a sudo
version from january 2024. If this is a recent breakage, then it was
another package causing it. PAM is a maze for me.

It would probably help if you would give the information that reportbug
gives when you file a bug against sudo in the first place.

Greetings
Marc

#1086509#33
Date:
2024-11-01 10:01:00 UTC
From:
To:
Control: tags -1 help
thanks

From the bug I only see that you're using testing. testing has a sudo
version from january 2024. If this is a recent breakage, then it was
another package causing it. PAM is a maze for me.

It would probably help if you would give the information that reportbug
gives when you file a bug against sudo in the first place.

Greetings
Marc

#1086509#36
Date:
2024-11-01 17:18:33 UTC
From:
To:
Re: Marc Haber

It's not that old, I would guess at most a few weeks. The way I
noticed is PostgreSQL's testsuite seeing a ~postgres/.local/ file
created by pipewire that wasn't there before. I would have noticed if
that had been there since January.

#1086509#41
Date:
2024-11-01 20:49:17 UTC
From:
To:
The actual version of the sudo in question isnt here.

Greetings
Marc

#1086509#44
Date:
2024-11-01 21:31:13 UTC
From:
To:
Re: Marc Haber

1.9.15p5-3+b1.

Upgrading to 1.9.16-2 does not change the problem.

Christoph

#1086509#49
Date:
2026-01-29 08:30:13 UTC
From:
To:
as pid 1, libpam-systemd installed:

290388f0f485 login: mh
Password:
Linux 290388f0f485 6.18.5+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.18.5-1 (2026-01-16) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
mh@290388f0f485:~$ systemctl --user status
● 290388f0f485
    State: running
    Units: 40 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Thu 2026-01-29 08:08:00 UTC; 7s ago
  systemd: 259-1
  Tainted: unmerged-bin
   CGroup: /user.slice/user-1000.slice/user@1000.service
           └─init.scope
             ├─6006 /usr/lib/systemd/systemd --user
             └─6008 "(sd-pam)"
mh@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6015 pts/0    Ss     0:00 -bash
   6054 pts/0    R+     0:00  \_ ps xf
   6006 ?        Ss     0:00 /usr/lib/systemd/systemd --user
   6008 ?        S      0:00  \_ (sd-pam)
mh@290388f0f485:~$ sudo -iu postgres
[sudo] password for mh:
postgres@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6069 pts/1    S      0:00 -bash
   6082 pts/1    R+     0:00  \_ ps xf
postgres@290388f0f485:~$ systemctl --user status
Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host --user to connect to bus of other user)
postgres@290388f0f485:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY   IDLE SINCE
     c3 1000 mh   -    5996   user    pts/0 no   -
     c4 1000 mh   -    6006   manager -     no   -

2 sessions listed.
postgres@290388f0f485:~$

Maybe my container is missing some packages? I am pasting reportbug
output of the container at the bottom of this mail.

Then, I tried this on my postgresql database server, and things are fine
there as well:

[1/1271]mh@derriere:~ $ ps xf
    PID TTY      STAT   TIME COMMAND
  29865 ?        S      0:00 sshd-session: mh@pts/2
  29866 pts/2    Ss     0:00  \_ -bash
  30175 pts/2    R+     0:00      \_ ps xf
  29791 ?        Ss     0:00 /usr/lib/systemd/systemd --user
  29795 ?        S      0:00  \_ (sd-pam)
[2/1272]mh@derriere:~ $ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
[3/1273]mh@derriere:~ $ sudo -iu postgres
[sudo] password for mh on derriere:
postgres@derriere:~$ ps xf
    PID TTY      STAT   TIME COMMAND
  30210 pts/3    S      0:00 -bash
  30214 pts/3    R+     0:00  \_ ps xf
    579 ?        Ss     0:10 /usr/lib/postgresql/17/bin/postgres -D /var/lib/pos
    801 ?        Ss     0:00  \_ postgres: 17/main: checkpointer
    803 ?        Ss     0:01  \_ postgres: 17/main: background writer
    911 ?        Ss     0:08  \_ postgres: 17/main: walwriter
    912 ?        Ss     0:01  \_ postgres: 17/main: autovacuum launcher
    913 ?        Ss     0:00  \_ postgres: 17/main: logical replication launcher
postgres@derriere:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
postgres@derriere:~$

What am I doing wrong here?

Greetings
Marc

#1086509#54
Date:
2026-01-29 08:30:13 UTC
From:
To:
as pid 1, libpam-systemd installed:

290388f0f485 login: mh
Password:
Linux 290388f0f485 6.18.5+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.18.5-1 (2026-01-16) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
mh@290388f0f485:~$ systemctl --user status
● 290388f0f485
    State: running
    Units: 40 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Thu 2026-01-29 08:08:00 UTC; 7s ago
  systemd: 259-1
  Tainted: unmerged-bin
   CGroup: /user.slice/user-1000.slice/user@1000.service
           └─init.scope
             ├─6006 /usr/lib/systemd/systemd --user
             └─6008 "(sd-pam)"
mh@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6015 pts/0    Ss     0:00 -bash
   6054 pts/0    R+     0:00  \_ ps xf
   6006 ?        Ss     0:00 /usr/lib/systemd/systemd --user
   6008 ?        S      0:00  \_ (sd-pam)
mh@290388f0f485:~$ sudo -iu postgres
[sudo] password for mh:
postgres@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6069 pts/1    S      0:00 -bash
   6082 pts/1    R+     0:00  \_ ps xf
postgres@290388f0f485:~$ systemctl --user status
Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host --user to connect to bus of other user)
postgres@290388f0f485:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY   IDLE SINCE
     c3 1000 mh   -    5996   user    pts/0 no   -
     c4 1000 mh   -    6006   manager -     no   -

2 sessions listed.
postgres@290388f0f485:~$

Maybe my container is missing some packages? I am pasting reportbug
output of the container at the bottom of this mail.

Then, I tried this on my postgresql database server, and things are fine
there as well:

[1/1271]mh@derriere:~ $ ps xf
    PID TTY      STAT   TIME COMMAND
  29865 ?        S      0:00 sshd-session: mh@pts/2
  29866 pts/2    Ss     0:00  \_ -bash
  30175 pts/2    R+     0:00      \_ ps xf
  29791 ?        Ss     0:00 /usr/lib/systemd/systemd --user
  29795 ?        S      0:00  \_ (sd-pam)
[2/1272]mh@derriere:~ $ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
[3/1273]mh@derriere:~ $ sudo -iu postgres
[sudo] password for mh on derriere:
postgres@derriere:~$ ps xf
    PID TTY      STAT   TIME COMMAND
  30210 pts/3    S      0:00 -bash
  30214 pts/3    R+     0:00  \_ ps xf
    579 ?        Ss     0:10 /usr/lib/postgresql/17/bin/postgres -D /var/lib/pos
    801 ?        Ss     0:00  \_ postgres: 17/main: checkpointer
    803 ?        Ss     0:01  \_ postgres: 17/main: background writer
    911 ?        Ss     0:08  \_ postgres: 17/main: walwriter
    912 ?        Ss     0:01  \_ postgres: 17/main: autovacuum launcher
    913 ?        Ss     0:00  \_ postgres: 17/main: logical replication launcher
postgres@derriere:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
postgres@derriere:~$

What am I doing wrong here?

Greetings
Marc

#1086509#57
Date:
2026-01-29 08:30:13 UTC
From:
To:
as pid 1, libpam-systemd installed:

290388f0f485 login: mh
Password:
Linux 290388f0f485 6.18.5+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.18.5-1 (2026-01-16) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
mh@290388f0f485:~$ systemctl --user status
● 290388f0f485
    State: running
    Units: 40 loaded (incl. loaded aliases)
     Jobs: 0 queued
   Failed: 0 units
    Since: Thu 2026-01-29 08:08:00 UTC; 7s ago
  systemd: 259-1
  Tainted: unmerged-bin
   CGroup: /user.slice/user-1000.slice/user@1000.service
           └─init.scope
             ├─6006 /usr/lib/systemd/systemd --user
             └─6008 "(sd-pam)"
mh@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6015 pts/0    Ss     0:00 -bash
   6054 pts/0    R+     0:00  \_ ps xf
   6006 ?        Ss     0:00 /usr/lib/systemd/systemd --user
   6008 ?        S      0:00  \_ (sd-pam)
mh@290388f0f485:~$ sudo -iu postgres
[sudo] password for mh:
postgres@290388f0f485:~$ ps xf
    PID TTY      STAT   TIME COMMAND
   6069 pts/1    S      0:00 -bash
   6082 pts/1    R+     0:00  \_ ps xf
postgres@290388f0f485:~$ systemctl --user status
Failed to connect to user scope bus via local transport: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=<user>@.host --user to connect to bus of other user)
postgres@290388f0f485:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY   IDLE SINCE
     c3 1000 mh   -    5996   user    pts/0 no   -
     c4 1000 mh   -    6006   manager -     no   -

2 sessions listed.
postgres@290388f0f485:~$

Maybe my container is missing some packages? I am pasting reportbug
output of the container at the bottom of this mail.

Then, I tried this on my postgresql database server, and things are fine
there as well:

[1/1271]mh@derriere:~ $ ps xf
    PID TTY      STAT   TIME COMMAND
  29865 ?        S      0:00 sshd-session: mh@pts/2
  29866 pts/2    Ss     0:00  \_ -bash
  30175 pts/2    R+     0:00      \_ ps xf
  29791 ?        Ss     0:00 /usr/lib/systemd/systemd --user
  29795 ?        S      0:00  \_ (sd-pam)
[2/1272]mh@derriere:~ $ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
[3/1273]mh@derriere:~ $ sudo -iu postgres
[sudo] password for mh on derriere:
postgres@derriere:~$ ps xf
    PID TTY      STAT   TIME COMMAND
  30210 pts/3    S      0:00 -bash
  30214 pts/3    R+     0:00  \_ ps xf
    579 ?        Ss     0:10 /usr/lib/postgresql/17/bin/postgres -D /var/lib/pos
    801 ?        Ss     0:00  \_ postgres: 17/main: checkpointer
    803 ?        Ss     0:01  \_ postgres: 17/main: background writer
    911 ?        Ss     0:08  \_ postgres: 17/main: walwriter
    912 ?        Ss     0:01  \_ postgres: 17/main: autovacuum launcher
    913 ?        Ss     0:00  \_ postgres: 17/main: logical replication launcher
postgres@derriere:~$ loginctl
SESSION  UID USER SEAT LEADER CLASS   TTY IDLE SINCE
     78 1001 mh   -    29784  user    -   no   -
     79 1001 mh   -    29791  manager -   no   -

2 sessions listed.
postgres@derriere:~$

What am I doing wrong here?

Greetings
Marc