sudo -E not passing all variables

Question

Reading the man pages I expected sudo -E to pass all environment variables to the subshell, but I am not getting the expected results.

As expected, awesome:

$ export LD_LIBRARY_PATH=/home/mmendez/toolchains/x86-destdir/usr/lib/
$ env | grep LD
LD_LIBRARY_PATH=/home/mmendez/toolchains/x86-destdir/usr/lib/

More awesomeness:

$ env -i LD_LIBRARY_PATH=/tmp/no/where env | grep LD
LD_LIBRARY_PATH=/tmp/no/where

Not what was expected:

$ env -i LD_LIBRARY_PATH=$LD_LIBRARY_PATH sudo -E /usr/bin/env | grep LD
$
$ env -i LD_LIBRARY_PATH=/tmp/no/where sudo -E /usr/bin/env | grep LD
$

So, how can I get sudo -E to pass LD_LIBRARY_PATH, without editing /etc/sudoers?

Edit:

According to How do I make sudo preserve my environment variables? the OP indicates that the shell may play a role in conjunction with !env_reset. I am running Arch Linux and the default shell is BASH. Once again, I do not want to edit /etc/sudoers, is it possible?

Answer 1

Certain environment variables, including LD_LIBRARY_PATH or HOSTALIASES (full list is in sysdeps/generic/unsecvars.h), are automatically unset by glibc when executing a privileged program (i.e. with the setuid bit or with filesystem capabilities). This is a security feature, since otherwise users could load their own libraries into su or sudo and trick them into accepting any password.

You will need to use sudo env LD_LIBRARY_PATH=$LD_LIBRARY_PATH yourcommand in order to pass the variable to commands run via sudo.