Repository: influxdata/influxdb
File: .circleci/packages/influxdb/fs/usr/lib/influxdb/scripts/init.sh (Shell)

Code before:
        fi
    else
        su -s /bin/sh -c "touch $PIDFILE" $USER &>/dev/null
        if [ $? -ne 0 ]; then
            log_failure_msg "$PIDFILE not writable, check permissions"
            exit 5
        fi
    fi

    # Bump the file limits, before launching the daemon. These will
    # carry over to launched processes.
    ulimit -n $OPEN_FILE_LIMIT
    if [ $? -ne 0 ]; then
        log_failure_msg "Unable to set ulimit to $OPEN_FILE_LIMIT"
        exit 1
    fi

    DATA_DIR="$( influxd_config data dir     )"
    WAL_DIR="$(  influxd_config data wal-dir )"
    if [[ ( -d "${DATA_DIR}" ) && ( -d "${WAL_DIR}" ) ]]
    then
        # buildtsi prompts with a warning it is is run as root as the files it makes will be owned by root.
        # In that case, it awaits an interactive Yes but that can't be supplied. All around, best to run it
        # as the influxdb user. sudo is also an option but not as available as su
        echo "Building tsi with influxd_inspect buildtsi."
        runuser -u influxdb -- /usr/bin/influx_inspect buildtsi -compact-series-file \
            -datadir "${DATA_DIR}"                                                   \
            -waldir  "${WAL_DIR}"
    fi

    # Launch process
    echo "Starting $NAME..."
    if command -v start-stop-daemon &>/dev/null; then
        start-stop-daemon \
            --chuid $USER:$GROUP \
            --start \
            --quiet \
            --pidfile $PIDFILE \
            --exec $DAEMON \
            -- \
            -pidfile $PIDFILE \
            -config $CONFIG \
            $INFLUXD_OPTS >>$STDOUT 2>>$STDERR &
    else
        local CMD="$DAEMON -pidfile $PIDFILE -config $CONFIG $INFLUXD_OPTS >>$STDOUT 2>>$STDERR &"
        su -s /bin/sh -c "$CMD" $USER
    fi

    # Sleep to verify process is still up
    sleep 1
    if [ -f $PIDFILE ]; then

Review comment (suggestion):
I suggest `setpriv` instead of `runuser` as it doesn't go through the PAM stack (which you don't need). See `man runuser`. Ie:

```
setpriv --reuid influxdb --regid influxdb --clear-groups /usr/bin/influx_inspect buildtsi -compact-series-file ...
```

Code after:
        fi
    else
        su -s /bin/sh -c "touch $PIDFILE" $USER &>/dev/null
        if [ $? -ne 0 ]; then
            log_failure_msg "$PIDFILE not writable, check permissions"
            exit 5
        fi
    fi

    # Bump the file limits, before launching the daemon. These will
    # carry over to launched processes.
    ulimit -n $OPEN_FILE_LIMIT
    if [ $? -ne 0 ]; then
        log_failure_msg "Unable to set ulimit to $OPEN_FILE_LIMIT"
        exit 1
    fi

    DATA_DIR="$( influxd_config data dir     )"
    WAL_DIR="$(  influxd_config data wal-dir )"
    if [[ ( -d "${DATA_DIR}" ) && ( -d "${WAL_DIR}" ) ]]
    then
        # buildtsi prompts with a warning if it is run as root as the files it creates will be owned by root which
        # influxd won't be able to read. Best to run it as the influxdb user instead. sudo and su are options but
        # difficult to use; setpriv is more direct and available in the util-linux package
        echo "Building tsi with influxd_inspect buildtsi."
        setpriv --reuid influxdb --regid influxdb --clear-groups /usr/bin/influx_inspect buildtsi -compact-series-file \
            -datadir "${DATA_DIR}"                                                   \
            -waldir  "${WAL_DIR}"
    fi

    # Launch process
    echo "Starting $NAME..."
    if command -v start-stop-daemon &>/dev/null; then
        start-stop-daemon \
            --chuid $USER:$GROUP \
            --start \
            --quiet \
            --pidfile $PIDFILE \
            --exec $DAEMON \
            -- \
            -pidfile $PIDFILE \
            -config $CONFIG \
            $INFLUXD_OPTS >>$STDOUT 2>>$STDERR &
    else
        local CMD="$DAEMON -pidfile $PIDFILE -config $CONFIG $INFLUXD_OPTS >>$STDOUT 2>>$STDERR &"
        su -s /bin/sh -c "$CMD" $USER
    fi

    # Sleep to verify process is still up
    sleep 1
    if [ -f $PIDFILE ]; then