So, what is the correct default (nothing self-built, please) command to start a shell using the privilege level of some less privileged user? Setuigid doesn't seem to be included by default in distributions.
“su is mostly designed for unprivileged users, the recommended solution for privileged users (e.g. scripts executed by root) is to use non-set-user-ID command runuser(1) that does not require authentication and provide separate PAM configuration. If the PAM session is not required at all then the recommend solution is to use command setpriv(1).”
This is kind of a subtle point that the article makes—the problem is that “su” is not good for dropping user privileges in general, but it does work if you are a user trying to spawn an interactive shell as another user.
Keep in mind that you are giving control of your terminal to that less-privileged account, and that this is a potential point of privilege escalation.