The following statement appears early in the sudoers manual, it refers to the "SUDO_USER environment variable" but the manual does not define it:
If sudo is run by root and the SUDO_USER environment variable is set, the sudoers policy will use this value to determine who the actual user is. This can be used by a user to log commands through sudo even when a root shell has been invoked. It also allows the -e option to remain useful even when invoked via a sudo-run script or program. Note, however, that the sudoers lookup is still done for root, not the user specified by SUDO_USER.
This entire paragraph remains fairly elusive to me, any clarification would be appreciated. For instance, what does it mean that the sudoers policy uses the SUDO_USER environment variable to determine who the user actually is, and what does it mean that it can be used by a user to log commands?
This sentence also eludes me:
This can be used by a user to log commands through sudo even when a root shell has been invoked.