diff --git a/lib/Makemodule.am b/lib/Makemodule.am
index c9adf3faa..cab44480d 100644
--- a/lib/Makemodule.am
+++ b/lib/Makemodule.am
@@ -83,6 +83,7 @@ check_PROGRAMS += \
 	test_pwdutils \
 	test_mangle \
 	test_randutils \
+	test_remove_env \
 	test_strutils \
 	test_ttyutils \
 	test_timeutils
@@ -182,3 +183,6 @@ test_timeutils_CFLAGS = $(AM_CFLAGS) -DTEST_PROGRAM_TIMEUTILS
 
 test_pwdutils_SOURCES = lib/pwdutils.c
 test_pwdutils_CFLAGS = $(AM_CFLAGS) -DTEST_PROGRAM
+
+test_remove_env_SOURCES = lib/env.c
+test_remove_env_CFLAGS = $(AM_CFLAGS) -DTEST_PROGRAM
diff --git a/lib/env.c b/lib/env.c
index b2e3d975a..ea7d45782 100644
--- a/lib/env.c
+++ b/lib/env.c
@@ -107,3 +107,34 @@ return secure_getenv(arg);
 	return getenv(arg);
 #endif
 }
+
+#ifdef TEST_PROGRAM
+int main(int argc, char **argv)
+{
+	char *const *bad;
+	char copy[32];
+	char *p;
+	int retval = EXIT_SUCCESS;
+
+	for (bad = forbid; *bad; bad++) {
+		strcpy(copy, *bad);
+		p = strchr(copy, '=');
+		if (p)
+			*p = '\0';
+		setenv(copy, copy, 1);
+	}
+	sanitize_env();
+	for (bad = forbid; *bad; bad++) {
+		strcpy(copy, *bad);
+		p = strchr(copy, '=');
+		if (p)
+			*p = '\0';
+		p = getenv(copy);
+		if (p) {
+			warnx("%s was not removed", copy);
+			retval = EXIT_FAILURE;
+		}
+	}
+	return retval;
+}
+#endif