who sets my PATH when calling env -i bash --norc --noprofile?

[Philippe Cerfon]

Hey.

By coincidence I've stumbled over the following on a Debian system:

(1) From bash I run:
$ env -i bash --norc --noprofile
bash-5.2$ echo $PATH
/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.

(2) interestingly:
$ env -i bash --norc --noprofile -c "echo $PATH"
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

I'm a bit concerned that the former contains "." but I cannot even
find out who sets the PATH.
It cannot come from the outer shell, because of the env -i .
It cannot come from any profile/bashrc files.

Debian has:
$ grep ^ENV_ /etc/login.defs
ENV_SUPATH    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ENV_PATH    PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

and ENV_PATH would be the one from 2nd case, and in fact, if I change
it there it would affect (2), but *only* after a fresh login.
Does bash somehow interact with login/shadow/pam there? Even on a
non-login shell?

But I couldn't find how the PATH from (1) is set or why the . is added.

Neither would I understand why (1) and (2) produce even different results.


Thanks,
Philippe