diff -Nru util-linux-2.32/debian/changelog util-linux-2.32/debian/changelog
--- util-linux-2.32/debian/changelog	2018-05-10 17:22:53.000000000 +0200
+++ util-linux-2.32/debian/changelog	2018-06-18 21:26:40.000000000 +0200
@@ -1,3 +1,12 @@
+util-linux (2.32-0.2) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Take over /bin/su from login/src:shadow (See #833256)
+    - depends on new login package (rather than breaking old) as an
+      attempt to fool apt into unpacking things in the right order.
+
+ -- Andreas Henriksson <andreas@fatal.se>  Mon, 18 Jun 2018 21:26:40 +0200
+
 util-linux (2.32-0.1) unstable; urgency=medium
 
   * Non-maintainer upload.
diff -Nru util-linux-2.32/debian/control util-linux-2.32/debian/control
--- util-linux-2.32/debian/control	2018-05-10 17:22:53.000000000 +0200
+++ util-linux-2.32/debian/control	2018-06-18 21:26:40.000000000 +0200
@@ -34,13 +34,14 @@
 Section: utils
 Essential: yes
 Pre-Depends: ${misc:Pre-Depends}, ${shlibs:Depends}
-Depends: ${misc:Depends}, fdisk
+Depends: ${misc:Depends}, fdisk, login (>= 1:4.5-1.1~)
 Suggests: dosfstools, kbd | console-tools, util-linux-locales
 Replaces: bash-completion (<< 1:2.1-4.1~),
           sysvinit-utils (<< 2.88dsf-59.1~),
           initscripts (<< 2.88dsf-59.2~),
           mount (<< 2.29.2-3~),
-          s390-tools (<< 2.2.0-1~)
+          s390-tools (<< 2.2.0-1~),
+	  login (<< 1:4.5-1.1~)
 Breaks: bash-completion (<< 1:2.1-4.1~),
           grml-debootstrap (<< 0.68),
           cloud-utils (<< 0.27-1~),
diff -Nru util-linux-2.32/debian/rules util-linux-2.32/debian/rules
--- util-linux-2.32/debian/rules	2018-05-10 17:22:53.000000000 +0200
+++ util-linux-2.32/debian/rules	2018-06-18 21:26:40.000000000 +0200
@@ -29,7 +29,6 @@
 # => login
 CONFOPTS += --disable-login
 CONFOPTS += --disable-nologin
-CONFOPTS += --disable-su
 # => procps
 CONFOPTS += --disable-kill
 # => eject
@@ -156,7 +155,7 @@
 		--add-udeb=libuuid1-udeb
 
 override_dh_fixperms:
-	dh_fixperms -i -a -Xusr/bin/wall -Xbin/mount -Xbin/umount
+	dh_fixperms -i -a -Xusr/bin/wall -Xbin/mount -Xbin/umount -Xbin/su
 
 ifeq (linux,$(DEB_HOST_ARCH_OS))
 override_dh_installsystemd:
diff -Nru util-linux-2.32/debian/util-linux.install util-linux-2.32/debian/util-linux.install
--- util-linux-2.32/debian/util-linux.install	2018-05-10 17:22:53.000000000 +0200
+++ util-linux-2.32/debian/util-linux.install	2018-06-18 21:24:48.000000000 +0200
@@ -12,6 +12,7 @@
 bin/findmnt
 bin/more
 bin/mountpoint
+bin/su
 sbin/agetty
 sbin/blkid
 sbin/findfs
diff -Nru util-linux-2.32/debian/util-linux.su-l.pam util-linux-2.32/debian/util-linux.su-l.pam
--- util-linux-2.32/debian/util-linux.su-l.pam	1970-01-01 01:00:00.000000000 +0100
+++ util-linux-2.32/debian/util-linux.su-l.pam	2018-06-18 21:24:48.000000000 +0200
@@ -0,0 +1,6 @@
+#%PAM-1.0
+auth		include		su
+account		include		su
+password	include		su
+session		optional	pam_keyinit.so force revoke
+session		include		su
diff -Nru util-linux-2.32/debian/util-linux.su.pam util-linux-2.32/debian/util-linux.su.pam
--- util-linux-2.32/debian/util-linux.su.pam	1970-01-01 01:00:00.000000000 +0100
+++ util-linux-2.32/debian/util-linux.su.pam	2018-06-18 21:24:48.000000000 +0200
@@ -0,0 +1,61 @@
+#
+# The PAM configuration file for the Shadow `su' service
+#
+
+# This allows root to su without passwords (normal operation)
+auth       sufficient pam_rootok.so
+
+# Uncomment this to force users to be a member of group root
+# before they can use `su'. You can also add "group=foo"
+# to the end of this line if you want to use a group other
+# than the default "root" (but this may have side effect of
+# denying "root" user, unless she's a member of "foo" or explicitly
+# permitted earlier by e.g. "sufficient pam_rootok.so").
+# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
+# auth       required   pam_wheel.so
+
+# Uncomment this if you want wheel members to be able to
+# su without a password.
+# auth       sufficient pam_wheel.so trust
+
+# Uncomment this if you want members of a specific group to not
+# be allowed to use su at all.
+# auth       required   pam_wheel.so deny group=nosu
+
+# Uncomment and edit /etc/security/time.conf if you need to set
+# time restrainst on su usage.
+# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
+# as well as /etc/porttime)
+# account    requisite  pam_time.so
+
+# This module parses environment configuration file(s)
+# and also allows you to use an extended config
+# file /etc/security/pam_env.conf.
+# 
+# parsing /etc/environment needs "readenv=1"
+session       required   pam_env.so readenv=1
+# locale variables are also kept into /etc/default/locale in etch
+# reading this file *in addition to /etc/environment* does not hurt
+session       required   pam_env.so readenv=1 envfile=/etc/default/locale
+
+# Defines the MAIL environment variable
+# However, userdel also needs MAIL_DIR and MAIL_FILE variables
+# in /etc/login.defs to make sure that removing a user 
+# also removes the user's mail spool file.
+# See comments in /etc/login.defs
+#
+# "nopen" stands to avoid reporting new mail when su'ing to another user
+session    optional   pam_mail.so nopen
+
+# Sets up user limits according to /etc/security/limits.conf
+# (Replaces the use of /etc/limits in old login)
+session    required   pam_limits.so
+
+# The standard Unix authentication modules, used with
+# NIS (man nsswitch) as well as normal /etc/passwd and
+# /etc/shadow entries.
+@include common-auth
+@include common-account
+@include common-session
+
+