Question

If I use a login shell to login as root
then ‘who’ or ‘users’ commands
will show an entry for the root user.
However If I login with user1 and then use:

'su - root'

Then the ‘who’ and ‘users’ command will not show an entry for root.

Is there a way to find out whether there is a logged-in user in my system that has currently switched to root (or to any other account)?

Answer 1

Thanx to Davide Berra’s answer, I think I have found what I was looking for.

> who | sort -k2 > /tmp/whoresult
> pgrep -x su | xargs -i ps hu -p{} | awk '{printf $7 " ";for (i=11; i<=NF; i++) printf $i " "; printf "\n"}' | sort -k1 | join -1 2 -2 1 /tmp/whoresult -

The output is something like:

pts/3 user1 2013-02-06 16:35 (:0.0) su - root    #logged in as user1 and executed 'su - root'
pts/5 user1 2013-02-06 16:51 (:0.0) su           #logged in as user1 executed 'su'
tty2 root 2013-02-06 17:07 su - user1            #logged in as root and executed 'su - user1'