Why doesn’t `sudo -E` preserve `PERL5LIB`?

Question

I’m experiencing a strange behavior related to environment variable preservation with sudo on macOS(15.2): sudo -E doesn't preserve the environment variable PERL5LIB.

Reproduction Steps

1. Set an environment variable in the shell: export PERL5LIB=foo . The command env | grep PERL5LIB outputs as expected: PERL5LIB=foo .

2. However, the command sudo -E env | grep PERL5LIB , returns nothing. In contrast, this works: sudo --preserve-env=PERL5LIB env | grep PERL5LIB . It successfully preserves PERL5LIB.

This is confusing because I expected sudo -E to preserve all environment variables from the invoking shell, including PERL5LIB. But clearly, it’s not working that way for this particular variable.

Question

• Why is PERL5LIB not preserved by sudo -E on macOS?
• Is this behavior specific to PERL5LIB, or does it affect other variables as well?
• What is the recommended, reliable way to ensure that PERL5LIB is preserved when using sudo?

Answer 1

Variables matched by the env_delete list are removed from the environment with sudo -E a.k.a. sudo --preserve-env. Passing the variable to --preserve-env= re-adds it with its original value, which effectively negates its presence in the env_delete list.  (When --preserve-env is not in effect, the env_delete list does not apply, but environment variables are removed unless they are in the env_keep list, with a few additional conditions.)

The default list of “bad” environment variables includes PATH-like settings for various scripting languages, including PERL5LIB for Perl, PYTHONPATH for Python, RUBYLIB for Ruby, etc.  (But not PATH itself, which is handled specially.)

That list is OS-specific and can be obtained by running sudo -V as root. Quoting the sudoers(5) man page:

The complete list of environment variables that are preserved or removed, as modified by global Defaults parameters in sudoers, is displayed when sudo is run by root with the -V option. The list of environment variables to remove varies based on the operating system sudo is running on.

Use sudo --preserve-env=PERL5LIB if you specifically want to preserve PERL5LIB. You can change the env_delete option on a rule-by-rule basis in the sudoers file. If you add a specific rule, keep in mind that the last match applies, so put it after the generic rule for I-can-become-root, if that's relevant.