Why are sudo environment variables different?

Refer:http://blog.sina.com.cn/s/blog_4da051a60102uyvg.html

When an ordinary user sets and export a variable and then executes the echo command with sudo, the value of the variable can be obtained, but if the echo command is written to the script and then Sudo executes the script, the variable cannot be found, and the title condition is as follows:

$ cat Tesh.shecho $var $ var=aaa$ export var                       # export variable $ sudo echo $var                   # sudo execute echo command, return variable value aaa$ sudo bash test.sh                # sudo executes script, cannot get variable value  $ bash test.sh                     

Reason

When Sudo runs, the environment variable is reset to a safe environment variable by default, that is, the previously set variables will be invalidated, and only the environment variables specified in a few configuration files can be saved. sudo configuration files are /etc/sudoers required for root access to read:

$ sudo sed '/^#/d;/^$/d '/etc/sudoersdefaults env_resetdefaults mail_badpassdefaults secure_path= "/usr/local/sbin:/ Usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin "Root all= (all:all) All%sudo all= (all:all) allxxx ALL= (ALL:ALL) NOPASSWD: All

However, you can sudo -l view sudo restrictions directly by:

  The options for the first line defaults env_reset means that the environment variable is reset by default so that the variables you define are invalidated in the sudo environment and cannot be obtained.
Other distributions also have a defaultsenv_keep=" " option to keep part of the environment variable from being reset, the variable that needs to be persisted is written in double quotation marks.

Why sudoecho $var can I get the value of a variable?
Now that the execution of sudo resets the environment variables, why would echo get the corresponding variables?
This is due to the shell command line substitution & reorganization function, in the input command, press ENTER, the shell will first cut the command line into a field according to the delimiter, for each field to find whether there is no variable or command replacement, and then replace the completion, re-compose the new command, and then to execute.
So, the actual execution of the command is:

$ sudo echo $var                   # $var = AAA (sudo echo AAA)                    # Complete command replacement & Reassembly (Echo AAA)                         

Therefore, the sudo environment is reset and does not have to refer to $var this variable, but directly echo aaa .

Solution 1, SUDO-E

-e option is explained in the man page:

-E

the-e (Preserve Environment) option indicates to the security policy, the user wishes to preserve their existing environment variables . The security policy may return a error if THE-E option is specified and the user does not having permission to preserve th E environment.

Simply put, the -E user can keep the environment variable that the current user already exists when Sudo executes, not reset by sudo, and if the user does not have permission for the specified environment variable, an error will be given.

Why are sudo environment variables different?