Clarify that when sudo is run by root with the SUDO_USER variable set,

the sudoers lookup happens for root and not the SUDO_USER user.

diff --git a/sudo.pod b/sudo.pod
index 9ca04dfa577345bf672e81e9dc20de9d95195f63..461a495f7e93c0d4d086ff2cfc7d5401c38b11db 100644 (file)
--- a/sudo.pod
+++ b/sudo.pod
@@ -91,7 +91,8 @@ is set, B<sudo> will use this value to determine who the actual
 user is.  This can be used by a user to log commands through sudo
 even when a root shell has been invoked.  It also allows the B<-e>
 flag to remain useful even when being run via a sudo-run script or
-program.
+program.  Note however, that the sudoers lookup is still done for
+root, not the user specified by C<SUDO_USER>.
 
 B<sudo> can log both successful and unsuccessful attempts (as well
 as errors) to syslog(3), a log file, or both.  By default B<sudo>