Bug 835

Regression since changeset b511e35d9be4 although arguably by design. :p

I don't understand why these two options should be deemed mutually exclusive, though this changeset merely served to ensure existing codepaths were properly triggered... I think the original intent is wrong.

It's inconsistent behavior to allow env_keep to preserve environment variables when using --login, but then refuse to allow it when using --preserve-env. If these options are really considered to be incompatible, then keep_env should not work either...

However! The sudoers manpage explicitly states:

All other environment variables are removed unless permitted by env_keep or env_check, described above.

This indicates that adding additional to-be-kept variables to the base --login policy is an expected behavior, and as I understand --preserve-env to be equal in all ways to keep_env, it shouldn't be arbitrarily restricted in additional ways.

Note: we use(d) this on Arch Linux in https://git.archlinux.org/devtools.git/commit/?id=eab5aba9b027a7689acaf2382a04ff69b5b8771e but it just broke with the package update to sudo 1.8.23-1 (this bugreport is incorrectly marked as affecting 1.8.22 but there is no option to select 1.8.23).

The manpage does not seem to indicate these options are incompatible or meant to be incompatible, and it successfully passed our environment variable down to the command that needed it, so I expected this to work by design.