Login shell does not always preserve target user environment

[BAMF0]

Describe the bug
PAM environment variables included in env_keep do not get overridden by the target user's environment when passing the -i option to sudo-rs.

To Reproduce
Steps to reproduce the behavior:

1. Edit /etc/sudoers using visudo to include:

Defaults env_keep += "HOME"

2. Enter a login shell as a different user in the sudo group:

root@host$ sudo -i -u ubuntu

3. Print the HOME directory:

ubuntu@host$ echo $HOME

4. HOME directory of the user who invoked the login shell is shown:

/root

Expected behavior
When entering a login shell using sudo -i -u <target_user> the environment is expected to reflect the target user's PAM environment, not the invoking user's, even though PAM environment variables have been preserved using env_keep.

Environment (please complete the following information):

• Linux distribution: Ubuntu 26.04 (development branch)
• sudo-rs version: 0.2.10

Additional context
This is a special case present in ogsudo (see Command Environment in the Sudoers manual):

As a special case, if sudo's -i option (initial login) is specified, sudoers will initialize the environment regardless of the value of env_reset. The DISPLAY, PATH and TERM variables remain unchanged; HOME, MAIL, SHELL, USER, and LOGNAME are set based on the target user. On AIX (and Linux systems without PAM), the contents of /etc/environment are also included. On BSD systems, if the use_loginclass flag is enabled, the path and setenv variables in /etc/login.conf are also applied. All other environment variables are removed.

[TheJJ]

Ubuntu bug report: https://bugs.launchpad.net/ubuntu/+source/rust-sudo-rs/+bug/2131153

[squell]

Note: I've checked the behaviour with --preserve-env as well, and in that case there is no difference between -i and -s, so the fix for this issue can be quite localized to our env handling functions.

I'm also a bit unsure what

The DISPLAY, PATH and TERM variables remain unchanged

means; initial testing indicates that they're handled "as usual" and the text is meant as a clarification that they're not reset.

[squell]

Note that given #1360, we're ignoring any special treatment of MAIL.