Question: I run to run a command using the `su -s` command to start a process. Since I do not want the root user to own the process.

I try to do this by issuing the command

`su -s "$CATALINA_HOME/bin/catalina.sh run" tomcat`

which returns `su: /opt/apache-tomcat/bin/catalina.sh run: No such file or directory`

How can I run the `su -s` command along with arguments to not generate this error?

Answer: 
If you're running [`su`](http://man7.org/linux/man-pages/man1/su.1.html) as `root`, you can use `-s` to specify a different shell (running as `root` is necessary here since your `tomcat` user doesn't have a valid shell), and `-c` to specify the command to run:

```
su -s /bin/sh -c "$CATALINA_HOME/bin/catalina.sh run" tomcat

```

You might find [`start-stop-daemon`](http://man7.org/linux/man-pages/man8/start-stop-daemon.8.html) useful; it has a whole slew of options to specify the user and group to use, how to start the daemon etc. The [`tomcat8` initscript](https://salsa.debian.org/java-team/tomcat8/blob/master/debian/tomcat8.init) used in Debian might provide useful inspiration. Or you could look at writing a systemd unit or whatever is appropriate for your system's init.
Your other questions at <https://stackoverflow.com/questions/37753783/> and [Is there any way to tell if a shell script was killed with signal 9](https://unix.stackexchange.com/questions/283481/) indicate that what's missing from your question is that you are trying to run Tomcat under upstart. 

In such a case:

* `start-stop-daemon` is not appropriate.
* Nor is `su`.
* Nor are Poor Man's Daemon Supervisor gyrations to do PID file management in shell script.

All of those are attempting to duplicate stuff that upstart does *directly*. The use of `su` is particularly bad, because it isn't a tool for dropping privileges. It is a tool for *adding* privileges, in a login session. It nowadays has involvement under the covers with various login session management subsystems that makes it particularly inappropriate for the (much simpler) task of dropping superuser privileges in a dæmon. `start-stop-daemon` is just supererogatory. And *upstart knows the process IDs* of its children.

In the upstart job file, use the `setuid` and (if appropriate) `setgid` stanzas to drop privileges to an unprivileged user: 
```
setuid tomcat
```

And if you do invoke `catalina.sh` via `sh -c`, which isn't really necessary, don't wander into systemd House of Horror territory. (It's only marginally less horrendous when these sorts of things are done with upstart.) Do things the daemontools way and have the shell chain to the script, invoking it via the shell's `exec` command so that upstart sees the dæmon as its direct child process. (And make sure that upstart knows this with the correct `expect` stanza, too.)

An explicit shell isn't necessary in the first place, though, because upstart can invoke `catalina.sh` directly itself, just as systemd and other service management tools can. You furthermore thus don't have the worry of ensuring that `/bin/bash` is actually the right interpreter for that script. 
```
exec $CATALINA_HOME/bin/catalina.sh run
```

Further reading
---------------

* James Hunt and Clint Byrum (2014). "[`setuid`](http://upstart.ubuntu.com/cookbook/#setuid)". *Upstart Cookbook*.
* James Hunt and Clint Byrum (2014). "[`setgid`](http://upstart.ubuntu.com/cookbook/#setgid)". *Upstart Cookbook*.
* James Hunt and Clint Byrum (2014). "[`console log`](http://upstart.ubuntu.com/cookbook/#console-log)". *Upstart Cookbook*.
* Jonathan de Boyne Pollard (2014). [*Don't abuse `su` for dropping user privileges.*](http://jdebp.eu./FGA/dont-abuse-su-for-dropping-privileges.html) Frequently Given Answers.
* Jonathan de Boyne Pollard (2015). [*Wrapping Apache Tomcat in many pointless extra layers*](http://jdebp.eu./FGA/systemd-house-of-horror/tomcat.html) The systemd House of Horror.
* Jonathan de Boyne Pollard (2015). [*The systemd House of Horror*](http://jdebp.eu./FGA/systemd-house-of-horror/). Frequently Given Answers.
* <https://superuser.com/a/723333/38062>
* <https://superuser.com/questions/683855/>