From: Todd C. Miller <Todd.Miller@courtesan.com>
Date: Thu, 18 Jul 2013 22:51:56 +0000 (-0600)
Subject: Add support for long options and fix inclusion of sudo_usage.h with
X-Git-Tag: SUDO_1_8_8^2~104
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6e56e6d8c86cc7beedd5c0b9a32c47a92b7b43f9;p=sudo

Add support for long options and fix inclusion of sudo_usage.h with
modern gcc broken in 8597:1fcb7ba13018.
---

diff --git a/doc/sudo.cat b/doc/sudo.cat
index 29bc20736..f1deb5f8b 100644
--- a/doc/sudo.cat
+++ b/doc/sudo.cat
@@ -5,15 +5,15 @@ NNAAMMEE
 
 SSYYNNOOPPSSIISS
      ssuuddoo --hh | --KK | --kk | --VV
-     ssuuddoo --vv [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--pp _p_r_o_m_p_t]
-          [--uu _u_s_e_r _n_a_m_e | _#_u_i_d]
-     ssuuddoo --ll[_l] [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _h_o_s_t _n_a_m_e]
+     ssuuddoo --vv [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _r_e_m_o_t_e _h_o_s_t]
+          [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d]
+     ssuuddoo --ll[_l] [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _r_e_m_o_t_e _h_o_s_t]
           [--pp _p_r_o_m_p_t] [--UU _u_s_e_r _n_a_m_e] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] [_c_o_m_m_a_n_d]
      ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s | _-]
-          [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _h_o_s_t _n_a_m_e] [--pp _p_r_o_m_p_t] [--rr _r_o_l_e]
+          [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _r_e_m_o_t_e _h_o_s_t] [--pp _p_r_o_m_p_t] [--rr _r_o_l_e]
           [--tt _t_y_p_e] [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] [VVAARR=_v_a_l_u_e] --ii | --ss [_c_o_m_m_a_n_d]
      ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s | _-]
-              [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _h_o_s_t _n_a_m_e] [--pp _p_r_o_m_p_t]
+              [--gg _g_r_o_u_p _n_a_m_e | _#_g_i_d] [--hh _r_e_m_o_t_e _h_o_s_t] [--pp _p_r_o_m_p_t]
               [--uu _u_s_e_r _n_a_m_e | _#_u_i_d] file ...
 
 DDEESSCCRRIIPPTTIIOONN
@@ -48,7 +48,8 @@ DDEESSCCRRIIPPTTIIOONN
 
      The options are as follows:
 
-     --AA          Normally, if ssuuddoo requires a password, it will read it from
+     --AA, ----aasskkppaassss
+                 Normally, if ssuuddoo requires a password, it will read it from
                  the user's terminal.  If the --AA (_a_s_k_p_a_s_s) option is
                  specified, a (possibly graphical) helper program is executed
                  to read the user's password and output the password to the
@@ -63,7 +64,8 @@ DDEESSCCRRIIPPTTIIOONN
                  If no askpass program is available, ssuuddoo will exit with an
                  error.
 
-     --aa _t_y_p_e     The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes ssuuddoo to use the
+     --aa, ----aauutthh--ttyyppee _a_u_t_h___t_y_p_e
+                 The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes ssuuddoo to use the
                  specified authentication type when validating the user, as
                  allowed by _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The system administrator may
                  specify a list of sudo-specific authentication methods by
@@ -71,13 +73,15 @@ DDEESSCCRRIIPPTTIIOONN
                  option is only available on systems that support BSD
                  authentication.
 
-     --bb          The --bb (_b_a_c_k_g_r_o_u_n_d) option tells ssuuddoo to run the given
+     --bb, ----bbaacckkggrroouunndd
+                 The --bb (_b_a_c_k_g_r_o_u_n_d) option tells ssuuddoo to run the given
                  command in the background.  Note that if you use the --bb
                  option you cannot use shell job control to manipulate the
                  process.  Most interactive commands will fail to work
                  properly in background mode.
 
-     --CC _f_d       Normally, ssuuddoo will close all open file descriptors other
+     --CC, ----cclloossee--ffrroomm _f_d
+                 Normally, ssuuddoo will close all open file descriptors other
                  than standard input, standard output and standard error.  The
                  --CC (_c_l_o_s_e _f_r_o_m) option allows the user to specify a starting
                  point above the standard error (file descriptor three).
@@ -86,7 +90,8 @@ DDEESSCCRRIIPPTTIIOONN
                  The _s_u_d_o_e_r_s policy only permits use of the --CC option when the
                  administrator has enabled the _c_l_o_s_e_f_r_o_m___o_v_e_r_r_i_d_e option.
 
-     --cc _c_l_a_s_s    The --cc (_c_l_a_s_s) option causes ssuuddoo to run the specified
+     --cc, ----llooggiinn--ccllaassss _c_l_a_s_s
+                 The --cc (_c_l_a_s_s) option causes ssuuddoo to run the specified
                  command with resources limited by the specified login class.
                  The _c_l_a_s_s argument can be either a class name as defined in
                  _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single `-' character.  Specifying a
@@ -98,13 +103,14 @@ DDEESSCCRRIIPPTTIIOONN
                  This option is only available on systems with BSD login
                  classes.
 
-     --EE          The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option indicates to the
+     --EE, ----pprreesseerrvvee--eennvv
+                 The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option indicates to the
                  security policy that the user wishes to preserve their
                  existing environment variables.  The security policy may
                  return an error if the --EE option is specified and the user
                  does not have permission to preserve the environment.
 
-     --ee          The --ee (_e_d_i_t) option indicates that, instead of running a
+     --ee, ----eeddiitt  The --ee (_e_d_i_t) option indicates that, instead of running a
                  command, the user wishes to edit one or more files.  In lieu
                  of a command, the string "sudoedit" is used when consulting
                  the security policy.  If the user is authorized by the
@@ -131,32 +137,35 @@ DDEESSCCRRIIPPTTIIOONN
                  version, the user will receive a warning and the edited copy
                  will remain in a temporary file.
 
-     --gg _g_r_o_u_p    Normally, ssuuddoo runs a command with the primary group set to
+     --gg, ----ggrroouupp _g_r_o_u_p
+                 Normally, ssuuddoo runs a command with the primary group set to
                  the one specified by the password database for the user the
                  command is being run as (by default, root).  The --gg (_g_r_o_u_p)
                  option causes ssuuddoo to run the command with the primary group
-                 set to _g_r_o_u_p instead.  To specify a _g_i_d instead of a _g_r_o_u_p
-                 _n_a_m_e, use _#_g_i_d.  When running commands as a _g_i_d, many shells
-                 require that the `#' be escaped with a backslash (`\').  If
-                 no --uu option is specified, the command will be run as the
-                 invoking user (not root).  In either case, the primary group
-                 will be set to _g_r_o_u_p.
-
-     --HH          The --HH (_H_O_M_E) option requests that the security policy set
+                 set to _g_r_o_u_p instead.  To specify a numeric group ID (gid)
+                 instead of a group name, use _#_g_i_d.  When running commands as
+                 a gid, many shells require that the `#' be escaped with a
+                 backslash (`\').  If no --uu option is specified, the command
+                 will be run as the invoking user (not root).  In either case,
+                 the primary group will be set to _g_r_o_u_p.
+
+     --HH, ----sseett--hhoommee
+                 The --HH (_H_O_M_E) option requests that the security policy set
                  the HOME environment variable to the home directory of the
                  target user (root by default) as specified by the password
                  database.  Depending on the policy, this may be the default
                  behavior.
 
-     --hh [_h_o_s_t _n_a_m_e]
-                 If a _h_o_s_t _n_a_m_e is specified and the policy plugin supports
+     --hh, ----hheellpp  The --hh (_h_e_l_p) option causes ssuuddoo will print a short help
+                 message to the standard output and exit.
+
+     --hh, ----hhoosstt _r_e_m_o_t_e _h_o_s_t
+                 If a _r_e_m_o_t_e _h_o_s_t is specified and the policy plugin supports
                  it, the command will be run on the specified remote host.
                  Note that the _s_u_d_o_e_r_s plugin does not currently support
-                 running remote commands.  If no _h_o_s_t _n_a_m_e is specified, ssuuddoo
-                 will print a short help message to the standard output and
-                 exit.
+                 running remote commands.
 
-     --ii [_c_o_m_m_a_n_d]
+     --ii, ----llooggiinn [_c_o_m_m_a_n_d]
                  The --ii (_s_i_m_u_l_a_t_e _i_n_i_t_i_a_l _l_o_g_i_n) option runs the shell
                  specified by the password database entry of the target user
                  as a login shell.  This means that login-specific resource
@@ -172,13 +181,14 @@ DDEESSCCRRIIPPTTIIOONN
                  environment in which a command is run when the _s_u_d_o_e_r_s policy
                  is in use.
 
-     --KK          The --KK (sure _k_i_l_l) option is like --kk except that it removes
+     --KK, ----rreemmoovvee--ttiimmeessttaammpp
+                 The --KK (sure _k_i_l_l) option is like --kk except that it removes
                  the user's cached credentials entirely and may not be used in
                  conjunction with a command or other option.  This option does
                  not require a password.  Not all security policies support
                  credential caching.
 
-     --kk [_c_o_m_m_a_n_d]
+     --kk, ----rreesseett--ttiimmeessttaammpp [_c_o_m_m_a_n_d]
                  When used alone, the --kk (_k_i_l_l) option to ssuuddoo invalidates the
                  user's cached credentials.  The next time ssuuddoo is run a
                  password will be required.  This option does not require a
@@ -192,7 +202,7 @@ DDEESSCCRRIIPPTTIIOONN
                  for a password (if one is required by the security policy)
                  and will not update the user's cached credentials.
 
-     --ll[ll] [_c_o_m_m_a_n_d]
+     --ll[ll], ----lliisstt [_c_o_m_m_a_n_d]
                  If no _c_o_m_m_a_n_d is specified, the --ll (_l_i_s_t) option will list
                  the allowed (and forbidden) commands for the invoking user
                  (or the user specified by the --UU option) on the current host.
@@ -204,17 +214,20 @@ DDEESSCCRRIIPPTTIIOONN
                  --llll), or if --ll is specified multiple times, a longer list
                  format is used.
 
-     --nn          The --nn (_n_o_n_-_i_n_t_e_r_a_c_t_i_v_e) option prevents ssuuddoo from prompting
+     --nn, ----nnoonn--iinntteerraaccttiivvee
+                 The --nn (_n_o_n_-_i_n_t_e_r_a_c_t_i_v_e) option prevents ssuuddoo from prompting
                  the user for a password.  If a password is required for the
                  command to run, ssuuddoo will display an error message and exit.
 
-     --PP          The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes ssuuddoo to preserve
+     --PP, ----pprreesseerrvvee--ggrroouuppss
+                 The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes ssuuddoo to preserve
                  the invoking user's group vector unaltered.  By default, the
                  _s_u_d_o_e_r_s policy will initialize the group vector to the list
                  of groups the target user is in.  The real and effective
                  group IDs, however, are still set to match the target user.
 
-     --pp _p_r_o_m_p_t   The --pp (_p_r_o_m_p_t) option allows you to override the default
+     --pp, ----pprroommpptt _p_r_o_m_p_t
+                 The --pp (_p_r_o_m_p_t) option allows you to override the default
                  password prompt and use a custom one.  The following percent
                  (`%') escapes are supported by the _s_u_d_o_e_r_s policy:
 
@@ -241,49 +254,56 @@ DDEESSCCRRIIPPTTIIOONN
                  system password prompt on systems that support PAM unless the
                  _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag is disabled in _s_u_d_o_e_r_s.
 
-     --rr _r_o_l_e     The --rr (_r_o_l_e) option causes the new (SELinux) security
-                 context to have the role specified by _r_o_l_e.
+     --rr, ----rroollee _r_o_l_e
+                 The --rr (_r_o_l_e) option causes the new SELinux security context
+                 to have the role specified by _r_o_l_e.
 
-     --SS          The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password from
+     --SS, ----ssttddiinn
+                 The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password from
                  the standard input instead of the terminal device.  The
                  password must be followed by a newline character.
 
-     --ss [_c_o_m_m_a_n_d]
+     --ss, ----sshheellll [_c_o_m_m_a_n_d]
                  The --ss (_s_h_e_l_l) option runs the shell specified by the SHELL
                  environment variable if it is set or the shell as specified
                  in the password database.  If a command is specified, it is
                  passed to the shell for execution via the shell's --cc option.
                  If no command is specified, an interactive shell is executed.
 
-     --tt _t_y_p_e     The --tt (_t_y_p_e) option causes the new (SELinux) security
-                 context to have the type specified by _t_y_p_e.  If no type is
-                 specified, the default type is derived from the specified
-                 role.
+     --tt, ----ttyyppee _t_y_p_e
+                 The --tt (_t_y_p_e) option causes the new SELinux security context
+                 to have the type specified by _t_y_p_e.  If no type is specified,
+                 the default type is derived from the specified role.
 
-     --UU _u_s_e_r     The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with the --ll
+     --UU, ----ootthheerr--uusseerr _u_s_e_r
+                 The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with the --ll
                  option to specify the user whose privileges should be listed.
                  The security policy may restrict listing other users'
                  privileges.  The _s_u_d_o_e_r_s policy only allows root or a user
                  with the ALL privilege on the current host to use this
                  option.
 
-     --uu _u_s_e_r     The --uu (_u_s_e_r) option causes ssuuddoo to run the specified command
-                 as a user other than _r_o_o_t.  To specify a _u_i_d instead of a
-                 _u_s_e_r _n_a_m_e, _#_u_i_d.  When running commands as a _u_i_d, many shells
-                 require that the `#' be escaped with a backslash (`\').
-                 Security policies may restrict _u_i_ds to those listed in the
-                 password database.  The _s_u_d_o_e_r_s policy allows _u_i_ds that are
-                 not in the password database as long as the _t_a_r_g_e_t_p_w option
-                 is not set.  Other security policies may not support this.
-
-     --VV          The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print its version
+     --uu, ----uusseerr _u_s_e_r
+                 The --uu (_u_s_e_r) option causes ssuuddoo to run the specified command
+                 as a user other than _r_o_o_t.  To specify a numeric user ID
+                 (uid) instead of a user name, use _#_u_i_d.  When running
+                 commands as a uid, many shells require that the `#' be
+                 escaped with a backslash (`\').  Some security policies may
+                 restrict uids to those listed in the password database.  The
+                 _s_u_d_o_e_r_s policy allows uids that are not in the password
+                 database as long as the _t_a_r_g_e_t_p_w option is not set.  Other
+                 security policies may not support this.
+
+     --VV, ----vveerrssiioonn
+                 The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print its version
                  string and the version string of the security policy plugin
                  and any I/O plugins.  If the invoking user is already root
                  the --VV option will display the arguments passed to configure
                  when ssuuddoo was built and plugins may display more verbose
                  information such as default options.
 
-     --vv          When given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
+     --vv, ----vvaalliiddaattee
+                 When given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
                  user's cached credentials, authenticating the user's password
                  if necessary.  For the _s_u_d_o_e_r_s plugin, this extends the ssuuddoo
                  timeout for another 5 minutes (or whatever the timeout is set
@@ -304,10 +324,10 @@ DDEESSCCRRIIPPTTIIOONN
 
 CCOOMMMMAANNDD EEXXEECCUUTTIIOONN
      When ssuuddoo executes a command, the security policy specifies the execution
-     environment for the command.  Typically, the real and effective uid and
-     gid are set to match those of the target user, as specified in the
-     password database, and the group vector is initialized based on the group
-     database (unless the --PP option was specified).
+     environment for the command.  Typically, the real and effective user and
+     group and IDs are set to match those of the target user, as specified in
+     the password database, and the group vector is initialized based on the
+     group database (unless the --PP option was specified).
 
      The following parameters may be specified by security policy:
 
diff --git a/doc/sudo.man.in b/doc/sudo.man.in
index b2faf186f..e45396494 100644
--- a/doc/sudo.man.in
+++ b/doc/sudo.man.in
@@ -39,6 +39,7 @@
 [\fB\-AknS\fR]
 [\fB\-a\fR\ \fIauth_type\fR]
 [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
+[\fB\-h\fR\ \fIremote\ host\fR]
 [\fB\-p\fR\ \fIprompt\fR]
 [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
 .br
@@ -48,7 +49,7 @@
 [\fB\-AknS\fR]
 [\fB\-a\fR\ \fIauth_type\fR]
 [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
-[\fB\-h\fR\ \fIhost\ name\fR]
+[\fB\-h\fR\ \fIremote\ host\fR]
 [\fB\-p\fR\ \fIprompt\fR]
 [\fB\-U\fR\ \fIuser\ name\fR]
 [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
@@ -61,7 +62,7 @@
 [\fB\-C\fR\ \fIfd\fR]
 [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
 [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
-[\fB\-h\fR\ \fIhost\ name\fR]
+[\fB\-h\fR\ \fIremote\ host\fR]
 [\fB\-p\fR\ \fIprompt\fR]
 [\fB\-r\fR\ \fIrole\fR]
 [\fB\-t\fR\ \fItype\fR]
@@ -77,7 +78,7 @@
 [\fB\-C\fR\ \fIfd\fR]
 [\fB\-c\fR\ \fIclass\fR\ |\ \fI-\fR]
 [\fB\-g\fR\ \fIgroup\ name\fR\ |\ \fI#gid\fR]
-[\fB\-h\fR\ \fIhost\ name\fR]
+[\fB\-h\fR\ \fIremote\ host\fR]
 [\fB\-p\fR\ \fIprompt\fR]
 [\fB\-u\fR\ \fIuser\ name\fR\ |\ \fI#uid\fR]
 file ...
@@ -151,7 +152,7 @@ output may be logged as well.
 .PP
 The options are as follows:
 .TP 12n
-\fB\-A\fR
+\fB\-A\fR, \fB\--askpass\fR
 Normally, if
 \fBsudo\fR
 requires a password, it will read it from the user's terminal.
@@ -183,7 +184,7 @@ If no askpass program is available,
 will exit with an error.
 .RE
 .TP 12n
-\fB\-a\fR \fItype\fR
+\fB\-a\fR, \fB\--auth-type\fR \fIauth_type\fR
 The
 \fB\-a\fR (\fIauthentication type\fR)
 option causes
@@ -198,7 +199,7 @@ entry in
 \fI/etc/login.conf\fR.
 This option is only available on systems that support BSD authentication.
 .TP 12n
-\fB\-b\fR
+\fB\-b\fR, \fB\--background\fR
 The
 \fB\-b\fR (\fIbackground\fR)
 option tells
@@ -210,7 +211,7 @@ option you cannot use shell job control to manipulate the process.
 Most interactive commands will fail to work properly in background
 mode.
 .TP 12n
-\fB\-C\fR \fIfd\fR
+\fB\-C\fR, \fB\--close-from\fR \fIfd\fR
 Normally,
 \fBsudo\fR
 will close all open file descriptors other than standard input,
@@ -231,7 +232,7 @@ option when the administrator has enabled the
 \fIclosefrom_override\fR
 option.
 .TP 12n
-\fB\-c\fR \fIclass\fR
+\fB\-c\fR, \fB\--login-class\fR \fIclass\fR
 The
 \fB\-c\fR (\fIclass\fR)
 option causes
@@ -259,7 +260,7 @@ as root, or the
 command must be run from a shell that is already root.
 This option is only available on systems with BSD login classes.
 .TP 12n
-\fB\-E\fR
+\fB\-E\fR, \fB\--preserve-env\fR
 The
 \fB\-E\fR (\fIpreserve environment\fR)
 option indicates to the security policy that the user wishes to
@@ -269,7 +270,7 @@ The security policy may return an error if the
 option is specified and the user does not have permission to preserve
 the environment.
 .TP 12n
-\fB\-e\fR
+\fB\-e\fR, \fB\--edit\fR
 The
 \fB\-e\fR (\fIedit\fR)
 option indicates that, instead of running a command, the user wishes
@@ -322,7 +323,7 @@ receive a warning and the edited copy will remain in a temporary
 file.
 .RE
 .TP 12n
-\fB\-g\fR \fIgroup\fR
+\fB\-g\fR, \fB\--group\fR \fIgroup\fR
 Normally,
 \fBsudo\fR
 runs a command with the primary group set to the one specified by
@@ -335,15 +336,11 @@ option causes
 to run the command with the primary group set to
 \fIgroup\fR
 instead.
-To specify a
-\fIgid\fR
-instead of a
-\fIgroup name\fR,
-use
+To specify a numeric group ID
+(gid)
+instead of a group name, use
 \fI#gid\fR.
-When running commands as a
-\fIgid\fR,
-many shells require that the
+When running commands as a gid, many shells require that the
 \(oq#\(cq
 be escaped with a backslash
 (\(oq\e\(cq).
@@ -354,7 +351,7 @@ option is specified, the command will be run as the invoking user
 In either case, the primary group will be set to
 \fIgroup\fR.
 .TP 12n
-\fB\-H\fR
+\fB\-H\fR, \fB\--set-home\fR
 The
 \fB\-H\fR (\fIHOME\fR)
 option requests that the security policy set the
@@ -363,21 +360,23 @@ environment variable to the home directory of the target user (root
 by default) as specified by the password database.
 Depending on the policy, this may be the default behavior.
 .TP 12n
-\fB\-h\fR [\fIhost name\fR]
+\fB\-h\fR, \fB\--help\fR
+The
+\fB\-h\fR (\fIhelp\fR)
+option causes
+\fBsudo\fR
+will print a short help message to the standard output and exit.
+.TP 12n
+\fB\-h\fR, \fB\--host\fR \fIremote host\fR
 If a
-\fIhost name\fR
+\fIremote host\fR
 is specified and the policy plugin supports it, the command will be run
 on the specified remote host.
 Note that the
 \fIsudoers\fR
 plugin does not currently support running remote commands.
-If no
-\fIhost name\fR
-is specified,
-\fBsudo\fR
-will print a short help message to the standard output and exit.
 .TP 12n
-\fB\-i\fR [\fIcommand\fR]
+\fB\-i\fR, \fB\--login\fR [\fIcommand\fR]
 The
 \fB\-i\fR (\fIsimulate initial login\fR)
 option runs the shell specified by the password database entry of
@@ -407,7 +406,7 @@ option affects the environment in which a command is run when the
 \fIsudoers\fR
 policy is in use.
 .TP 12n
-\fB\-K\fR
+\fB\-K\fR, \fB\--remove-timestamp\fR
 The
 \fB\-K\fR (sure \fIkill\fR)
 option is like
@@ -417,7 +416,7 @@ may not be used in conjunction with a command or other option.
 This option does not require a password.
 Not all security policies support credential caching.
 .TP 12n
-\fB\-k\fR [\fIcommand\fR]
+\fB\-k\fR, \fB\--reset-timestamp\fR [\fIcommand\fR]
 When used alone, the
 \fB\-k\fR (\fIkill\fR)
 option to
@@ -445,7 +444,7 @@ As a result,
 will prompt for a password (if one is required by the security
 policy) and will not update the user's cached credentials.
 .TP 12n
-\fB\-l\fR[\fBl\fR] [\fIcommand\fR]
+\fB\-l\fR[\fBl\fR], \fB\--list\fR [\fIcommand\fR]
 If no
 \fIcommand\fR
 is specified, the
@@ -474,7 +473,7 @@ or if
 \fB\-l\fR
 is specified multiple times, a longer list format is used.
 .TP 12n
-\fB\-n\fR
+\fB\-n\fR, \fB\--non-interactive\fR
 The
 \fB\-n\fR (\fInon-interactive\fR)
 option prevents
@@ -484,7 +483,7 @@ If a password is required for the command to run,
 \fBsudo\fR
 will display an error message and exit.
 .TP 12n
-\fB\-P\fR
+\fB\-P\fR, \fB\--preserve-groups\fR
 The
 \fB\-P\fR (\fIpreserve group vector\fR)
 option causes
@@ -497,7 +496,7 @@ target user is in.
 The real and effective group IDs, however, are still set to match
 the target user.
 .TP 12n
-\fB\-p\fR \fIprompt\fR
+\fB\-p\fR, \fB\--prompt\fR \fIprompt\fR
 The
 \fB\-p\fR (\fIprompt\fR)
 option allows you to override the default password prompt and use
@@ -557,14 +556,14 @@ flag is disabled in
 \fIsudoers\fR.
 .RE
 .TP 12n
-\fB\-r\fR \fIrole\fR
+\fB\-r\fR, \fB\--role\fR \fIrole\fR
 The
 \fB\-r\fR (\fIrole\fR)
-option causes the new (SELinux) security context to have the role
+option causes the new SELinux security context to have the role
 specified by
 \fIrole\fR.
 .TP 12n
-\fB\-S\fR
+\fB\-S\fR, \fB\--stdin\fR
 The
 \fB\-S\fR (\fIstdin\fR)
 option causes
@@ -573,7 +572,7 @@ to read the password from the standard input instead of the terminal
 device.
 The password must be followed by a newline character.
 .TP 12n
-\fB\-s\fR [\fIcommand\fR]
+\fB\-s\fR, \fB\--shell\fR [\fIcommand\fR]
 The
 \fB\-s\fR (\fIshell\fR)
 option runs the shell specified by the
@@ -586,16 +585,16 @@ via the shell's
 option.
 If no command is specified, an interactive shell is executed.
 .TP 12n
-\fB\-t\fR \fItype\fR
+\fB\-t\fR, \fB\--type\fR \fItype\fR
 The
 \fB\-t\fR (\fItype\fR)
-option causes the new (SELinux) security context to have the type
+option causes the new SELinux security context to have the type
 specified by
 \fItype\fR.
 If no type is specified, the default type is derived from the
 specified role.
 .TP 12n
-\fB\-U\fR \fIuser\fR
+\fB\-U\fR, \fB\--other-user\fR \fIuser\fR
 The
 \fB\-U\fR (\fIother user\fR)
 option is used in conjunction with the
@@ -608,37 +607,31 @@ policy only allows root or a user with the
 \fRALL\fR
 privilege on the current host to use this option.
 .TP 12n
-\fB\-u\fR \fIuser\fR
+\fB\-u\fR, \fB\--user\fR \fIuser\fR
 The
 \fB\-u\fR (\fIuser\fR)
 option causes
 \fBsudo\fR
 to run the specified command as a user other than
 \fIroot\fR.
-To specify a
-\fIuid\fR
-instead of a
-\fIuser name\fR,
+To specify a numeric user ID
+(uid)
+instead of a user name, use
 \fI#uid\fR.
-When running commands as a
-\fIuid\fR,
-many shells require that the
+When running commands as a uid, many shells require that the
 \(oq#\(cq
 be escaped with a backslash
 (\(oq\e\(cq).
-Security policies may restrict
-\fIuid\fRs
+Some security policies may restrict uids
 to those listed in the password database.
 The
 \fIsudoers\fR
-policy allows
-\fIuid\fRs
-that are not in the password database as long as the
+policy allows uids that are not in the password database as long as the
 \fItargetpw\fR
 option is not set.
 Other security policies may not support this.
 .TP 12n
-\fB\-V\fR
+\fB\-V\fR, \fB\--version\fR
 The
 \fB\-V\fR (\fIversion\fR)
 option causes
@@ -652,7 +645,7 @@ option will display the arguments passed to configure when
 was built and plugins may display more verbose information such as
 default options.
 .TP 12n
-\fB\-v\fR
+\fB\-v\fR, \fB\--validate\fR
 When given the
 \fB\-v\fR (\fIvalidate\fR)
 option,
@@ -701,7 +694,7 @@ When
 \fBsudo\fR
 executes a command, the security policy specifies the execution
 environment for the command.
-Typically, the real and effective uid and gid are set to
+Typically, the real and effective user and group and IDs are set to
 match those of the target user, as specified in the password database,
 and the group vector is initialized based on the group database
 (unless the
diff --git a/doc/sudo.mdoc.in b/doc/sudo.mdoc.in
index 74dd3cd3b..6e8a95936 100644
--- a/doc/sudo.mdoc.in
+++ b/doc/sudo.mdoc.in
@@ -39,6 +39,9 @@
 .Op Fl g Ar group name No | Ar #gid
 .Ek
 .Bk -words
+.Op Fl h Ar remote host
+.Ek
+.Bk -words
 .Op Fl p Ar prompt
 .Ek
 .Bk -words
@@ -54,7 +57,7 @@
 .Op Fl g Ar group name No | Ar #gid
 .Ek
 .Bk -words
-.Op Fl h Ar host name
+.Op Fl h Ar remote host
 .Ek
 .Bk -words
 .Op Fl p Ar prompt
@@ -81,7 +84,7 @@
 .Op Fl g Ar group name No | Ar #gid
 .Ek
 .Bk -words
-.Op Fl h Ar host name
+.Op Fl h Ar remote host
 .Ek
 .Bk -words
 .Op Fl p Ar prompt
@@ -117,7 +120,7 @@
 .Op Fl g Ar group name No | Ar #gid
 .Ek
 .Bk -words
-.Op Fl h Ar host name
+.Op Fl h Ar remote host
 .Ek
 .Bk -words
 .Op Fl p Ar prompt
@@ -197,7 +200,7 @@ output may be logged as well.
 .Pp
 The options are as follows:
 .Bl -tag -width Fl
-.It Fl A
+.It Fl A , -askpass
 Normally, if
 .Nm sudo
 requires a password, it will read it from the user's terminal.
@@ -223,7 +226,7 @@ Path askpass /usr/X11R6/bin/ssh-askpass
 If no askpass program is available,
 .Nm sudo
 will exit with an error.
-.It Fl a Ar type
+.It Fl a , -auth-type Ar auth_type
 The
 .Fl a No ( Em "authentication type" Ns No )
 option causes
@@ -237,7 +240,7 @@ authentication methods by adding an
 entry in
 .Pa /etc/login.conf .
 This option is only available on systems that support BSD authentication.
-.It Fl b
+.It Fl b , -background
 The
 .Fl b No ( Em background Ns No )
 option tells
@@ -248,7 +251,7 @@ Note that if you use the
 option you cannot use shell job control to manipulate the process.
 Most interactive commands will fail to work properly in background
 mode.
-.It Fl C Ar fd
+.It Fl C , -close-from Ar fd
 Normally,
 .Nm sudo
 will close all open file descriptors other than standard input,
@@ -268,7 +271,7 @@ policy only permits use of the
 option when the administrator has enabled the
 .Em closefrom_override
 option.
-.It Fl c Ar class
+.It Fl c , -login-class Ar class
 The
 .Fl c No ( Em class Ns No )
 option causes
@@ -295,7 +298,7 @@ as root, or the
 .Nm sudo
 command must be run from a shell that is already root.
 This option is only available on systems with BSD login classes.
-.It Fl E
+.It Fl E , -preserve-env
 The
 .Fl E No ( Em preserve environment Ns No )
 option indicates to the security policy that the user wishes to
@@ -304,7 +307,7 @@ The security policy may return an error if the
 .Fl E
 option is specified and the user does not have permission to preserve
 the environment.
-.It Fl e
+.It Fl e , -edit
 The
 .Fl e No ( Em edit Ns No )
 option indicates that, instead of running a command, the user wishes
@@ -351,7 +354,7 @@ If, for some reason,
 is unable to update a file with its edited version, the user will
 receive a warning and the edited copy will remain in a temporary
 file.
-.It Fl g Ar group
+.It Fl g , -group Ar group
 Normally,
 .Nm sudo
 runs a command with the primary group set to the one specified by
@@ -364,15 +367,11 @@ option causes
 to run the command with the primary group set to
 .Ar group
 instead.
-To specify a
-.Em gid
-instead of a
-.Em "group name" ,
-use
-.Em #gid .
-When running commands as a
-.Em gid ,
-many shells require that the
+To specify a numeric group ID
+.Pq gid
+instead of a group name, use
+.Ar #gid .
+When running commands as a gid, many shells require that the
 .Ql #
 be escaped with a backslash
 .Pq Ql \e .
@@ -381,8 +380,8 @@ If no
 option is specified, the command will be run as the invoking user
 (not root).
 In either case, the primary group will be set to
-.Em group .
-.It Fl H
+.Ar group .
+.It Fl H , -set-home
 The
 .Fl H No ( Em HOME Ns No )
 option requests that the security policy set the
@@ -390,20 +389,21 @@ option requests that the security policy set the
 environment variable to the home directory of the target user (root
 by default) as specified by the password database.
 Depending on the policy, this may be the default behavior.
-.It Fl h Op Ar host name
+.It Fl h , -help
+The
+.Fl h No ( Em help Ns No )
+option causes
+.Nm sudo
+will print a short help message to the standard output and exit.
+.It Fl h , -host Ar remote host
 If a
-.Ar host name
+.Ar remote host
 is specified and the policy plugin supports it, the command will be run
 on the specified remote host.
 Note that the
 .Em sudoers
 plugin does not currently support running remote commands.
-If no
-.Ar host name
-is specified,
-.Nm sudo
-will print a short help message to the standard output and exit.
-.It Fl i Op Ar command
+.It Fl i , -login Op Ar command
 The
 .Fl i No ( Em simulate initial login Ns No )
 option runs the shell specified by the password database entry of
@@ -432,7 +432,7 @@ manual documents how the
 option affects the environment in which a command is run when the
 .Em sudoers
 policy is in use.
-.It Fl K
+.It Fl K , -remove-timestamp
 The
 .Fl K No ( sure Em kill Ns No )
 option is like
@@ -441,7 +441,7 @@ except that it removes the user's cached credentials entirely and
 may not be used in conjunction with a command or other option.
 This option does not require a password.
 Not all security policies support credential caching.
-.It Fl k Op Ar command
+.It Fl k , -reset-timestamp Op Ar command
 When used alone, the
 .Fl k No ( Em kill Ns No )
 option to
@@ -468,7 +468,7 @@ As a result,
 .Nm sudo
 will prompt for a password (if one is required by the security
 policy) and will not update the user's cached credentials.
-.It Fl l Ns Oo Sy l Oc Op Ar command
+.It Fl l Ns Oo Sy l Oc , Fl -list Op Ar command
 If no
 .Ar command
 is specified, the
@@ -496,7 +496,7 @@ argument
 or if
 .Fl l
 is specified multiple times, a longer list format is used.
-.It Fl n
+.It Fl n , -non-interactive
 The
 .Fl n No ( Em non-interactive Ns No )
 option prevents
@@ -505,7 +505,7 @@ from prompting the user for a password.
 If a password is required for the command to run,
 .Nm sudo
 will display an error message and exit.
-.It Fl P
+.It Fl P , -preserve-groups
 The
 .Fl P No ( Em preserve group vector Ns No )
 option causes
@@ -517,7 +517,7 @@ policy will initialize the group vector to the list of groups the
 target user is in.
 The real and effective group IDs, however, are still set to match
 the target user.
-.It Fl p Ar prompt
+.It Fl p , -prompt Ar prompt
 The
 .Fl p No ( Em prompt Ns No )
 option allows you to override the default password prompt and use
@@ -567,13 +567,13 @@ support PAM unless the
 .Em passprompt_override
 flag is disabled in
 .Em sudoers .
-.It Fl r Ar role
+.It Fl r , -role Ar role
 The
 .Fl r No ( Em role Ns No )
-option causes the new (SELinux) security context to have the role
+option causes the new SELinux security context to have the role
 specified by
 .Ar role .
-.It Fl S
+.It Fl S , -stdin
 The
 .Fl S ( Em stdin Ns No )
 option causes
@@ -581,7 +581,7 @@ option causes
 to read the password from the standard input instead of the terminal
 device.
 The password must be followed by a newline character.
-.It Fl s Op Ar command
+.It Fl s , -shell Op Ar command
 The
 .Fl s ( Em shell Ns No )
 option runs the shell specified by the
@@ -593,15 +593,15 @@ via the shell's
 .Fl c
 option.
 If no command is specified, an interactive shell is executed.
-.It Fl t Ar type
+.It Fl t , -type Ar type
 The
 .Fl t ( Em type Ns No )
-option causes the new (SELinux) security context to have the type
+option causes the new SELinux security context to have the type
 specified by
 .Ar type .
 If no type is specified, the default type is derived from the
 specified role.
-.It Fl U Ar user
+.It Fl U , -other-user Ar user
 The
 .Fl U ( Em other user Ns No )
 option is used in conjunction with the
@@ -613,36 +613,30 @@ The
 policy only allows root or a user with the
 .Li ALL
 privilege on the current host to use this option.
-.It Fl u Ar user
+.It Fl u , -user Ar user
 The
 .Fl u ( Em user Ns No )
 option causes
 .Nm sudo
 to run the specified command as a user other than
 .Em root .
-To specify a
-.Em uid
-instead of a
-.Em user name ,
-.Em #uid .
-When running commands as a
-.Em uid ,
-many shells require that the
+To specify a numeric user ID
+.Pq uid
+instead of a user name, use
+.Ar #uid .
+When running commands as a uid, many shells require that the
 .Ql #
 be escaped with a backslash
 .Pq Ql \e .
-Security policies may restrict
-.Em uid Ns No s
+Some security policies may restrict uids
 to those listed in the password database.
 The
 .Em sudoers
-policy allows
-.Em uid Ns No s
-that are not in the password database as long as the
+policy allows uids that are not in the password database as long as the
 .Em targetpw
 option is not set.
 Other security policies may not support this.
-.It Fl V
+.It Fl V , -version
 The
 .Fl V ( Em version Ns No )
 option causes
@@ -655,7 +649,7 @@ option will display the arguments passed to configure when
 .Nm sudo
 was built and plugins may display more verbose information such as
 default options.
-.It Fl v
+.It Fl v , -validate
 When given the
 .Fl v ( Em validate Ns No )
 option,
@@ -704,7 +698,7 @@ When
 .Nm sudo
 executes a command, the security policy specifies the execution
 environment for the command.
-Typically, the real and effective uid and gid are set to
+Typically, the real and effective user and group and IDs are set to
 match those of the target user, as specified in the password database,
 and the group vector is initialized based on the group database
 (unless the
diff --git a/src/Makefile.in b/src/Makefile.in
index 2d1a376de..3181bd9c5 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -38,7 +38,7 @@ LT_LIBS = $(top_builddir)/common/libcommon.la $(LIBOBJDIR)libreplace.la
 LIBS = @LIBS@ @SUDO_LIBS@ @GETGROUPS_LIB@ @NET_LIBS@ @LIBINTL@ $(LT_LIBS)
 
 # C preprocessor flags
-CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(srcdir) -I$(top_srcdir) -I. @CPPFLAGS@
+CPPFLAGS = -I$(incdir) -I$(top_builddir) -I. -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
 
 # Usually -O and/or -g
 CFLAGS = @CFLAGS@
@@ -106,7 +106,7 @@ Makefile: $(srcdir)/Makefile.in
 	(cd $(top_builddir) && ./config.status --file src/Makefile)
 
 ./sudo_usage.h: $(srcdir)/sudo_usage.h.in
-        (cd $(top_builddir) && ./config.status --file src/sudo_usage.h)
+	(cd $(top_builddir) && ./config.status --file src/sudo_usage.h)
 
 .SUFFIXES: .c .h .lo .o
 
diff --git a/src/parse_args.c b/src/parse_args.c
index c67944378..e3779e554 100644
--- a/src/parse_args.c
+++ b/src/parse_args.c
@@ -49,7 +49,7 @@
 #include <grp.h>
 #include <pwd.h>
 
-#include "sudo_usage.h"
+#include <sudo_usage.h>
 #include "sudo.h"
 #include "lbuf.h"
 
@@ -123,6 +123,45 @@ static struct sudo_settings {
  */
 #define DEFAULT_VALID_FLAGS	(MODE_BACKGROUND|MODE_PRESERVE_ENV|MODE_RESET_HOME|MODE_LOGIN_SHELL|MODE_NONINTERACTIVE|MODE_SHELL)
 
+/* Option number for the --host long option due to ambiguity of the -h flag. */
+#define OPT_HOSTNAME	256
+
+/*
+ * Available command line options, both short and long.
+ * Note that we must disable arg permutation to support setting environment
+ * variables and to better support the optional arg of the -h flag.
+ */
+static const char short_opts[] =  "+Aa:bC:c:D:Eeg:Hh::iKklnPp:r:Sst:U:u:Vv";
+static struct option long_opts[] = {
+    { "askpass",	no_argument,		NULL,	'A' },
+    { "auth-type",	required_argument,	NULL,	'a' },
+    { "background",	no_argument,		NULL,	'b' },
+    { "close-from",	required_argument,	NULL,	'C' },
+    { "login-class",	required_argument,	NULL,	'c' },
+    { "preserve-env",	no_argument,		NULL,	'E' },
+    { "edit",		no_argument,		NULL,	'e' },
+    { "group",		required_argument,	NULL,	'g' },
+    { "set-home",	no_argument,		NULL,	'H' },
+    { "help",		no_argument,		NULL,	'h' },
+    { "host",		required_argument,	NULL,	OPT_HOSTNAME },
+    { "login",		no_argument,		NULL,	'i' },
+    { "remove-timestamp", no_argument,		NULL,	'K' },
+    { "reset-timestamp", no_argument,		NULL,	'k' },
+    { "list",		no_argument,		NULL,	'l' },
+    { "non-interactive", no_argument,		NULL,	'n' },
+    { "preserve-groups", no_argument,		NULL,	'P' },
+    { "prompt",		required_argument,	NULL,	'p' },
+    { "role",		required_argument,	NULL,	'r' },
+    { "stdin",		no_argument,		NULL,	'S' },
+    { "shell",		no_argument,		NULL,	's' },
+    { "type",		required_argument,	NULL,	't' },
+    { "other-user",	required_argument,	NULL,	'U' },
+    { "user",		required_argument,	NULL,	'u' },
+    { "version",	no_argument,		NULL,	'V' },
+    { "validate",	no_argument,		NULL,	'v' },
+    { NULL,		no_argument,		NULL,	'\0' },
+};
+
 /*
  * Command line argument parsing.
  * Sets nargc and nargv which corresponds to the argc/argv we'll use
@@ -186,11 +225,10 @@ parse_args(int argc, char **argv, int *nargc, char ***nargv, char ***settingsp,
     /* XXX - should fill in settings at the end to avoid dupes */
     for (;;) {
 	/*
-	 * We disable arg permutation for GNU getopt().
 	 * Some trickiness is required to allow environment variables
 	 * to be interspersed with command line options.
 	 */
-	if ((ch = getopt_long(argc, argv, "+Aa:bC:c:D:Eeg:Hh::iKklnPp:r:Sst:U:u:Vv", NULL, NULL)) != -1) {
+	if ((ch = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) {
 	    switch (ch) {
 		case 'A':
 		    SET(tgetpass_flags, TGP_ASKPASS);
@@ -236,16 +274,18 @@ parse_args(int argc, char **argv, int *nargc, char ***nargv, char ***settingsp,
 		    sudo_settings[ARG_SET_HOME].value = "true";
 		    break;
 		case 'h':
-		    if (optarg != NULL) {
-			sudo_settings[ARG_REMOTE_HOST].value = optarg;
-		    } else {
+		    if (optarg == NULL) {
 			if (mode && mode != MODE_HELP) {
 			    if (strcmp(getprogname(), "sudoedit") != 0)
 				usage_excl(1);
 			}
 			mode = MODE_HELP;
 			valid_flags = 0;
+			break;
 		    }
+		    /* FALLTHROUGH */
+		case OPT_HOSTNAME:
+		    sudo_settings[ARG_REMOTE_HOST].value = optarg;
 		    break;
 		case 'i':
 		    sudo_settings[ARG_LOGIN_SHELL].value = "true";
@@ -318,7 +358,7 @@ parse_args(int argc, char **argv, int *nargc, char ***nargv, char ***settingsp,
 		default:
 		    usage(1);
 	    }
-	} else if (got_host_flag) {
+	} else if (got_host_flag && optind < argc) {
 	    /*
 	     * Optional args only support -hhostname, not -h hostname.
 	     * If we see a non-option after the -h flag, treat as
@@ -559,7 +599,7 @@ static void
 help(void)
 {
     struct lbuf lbuf;
-    int indent = 16;
+    const int indent = 30;
     const char *pname = getprogname();
     debug_decl(help, SUDO_DEBUG_ARGS)
 
@@ -573,67 +613,67 @@ help(void)
     usage(0);
 
     lbuf_append(&lbuf, _("\nOptions:\n"));
-    lbuf_append(&lbuf, "  -A            %s",
+    lbuf_append(&lbuf, "  -A, --askpass               %s",
 	_("use helper program for password prompting\n"));
 #ifdef HAVE_BSD_AUTH_H
-    lbuf_append(&lbuf, "  -a type       %s",
+    lbuf_append(&lbuf, "  -a, --auth-type auth_type   %s",
 	_("use specified BSD authentication type\n"));
 #endif
-    lbuf_append(&lbuf, "  -b            %s",
+    lbuf_append(&lbuf, "  -b, --background            %s",
 	_("run command in the background\n"));
-    lbuf_append(&lbuf, "  -C fd         %s",
+    lbuf_append(&lbuf, "  -C, --close-from fd         %s",
 	_("close all file descriptors >= fd\n"));
 #ifdef HAVE_LOGIN_CAP_H
-    lbuf_append(&lbuf, "  -c class      %s",
+    lbuf_append(&lbuf, "  -c, --login-class class     %s",
 	_("run command with specified login class\n"));
 #endif
-    lbuf_append(&lbuf, "  -E            %s",
+    lbuf_append(&lbuf, "  -E, --preserve-env          %s",
 	_("preserve user environment when executing command\n"));
-    lbuf_append(&lbuf, "  -e            %s",
+    lbuf_append(&lbuf, "  -e, --edit                  %s",
 	_("edit files instead of running a command\n"));
-    lbuf_append(&lbuf, "  -g group      %s",
+    lbuf_append(&lbuf, "  -g, --group group name|#gid %s",
 	_("execute command as the specified group\n"));
-    lbuf_append(&lbuf, "  -H            %s",
+    lbuf_append(&lbuf, "  -H, --set-home              %s",
 	_("set HOME variable to target user's home dir.\n"));
-    lbuf_append(&lbuf, "  -h            %s",
+    lbuf_append(&lbuf, "  -h, --help                  %s",
 	_("display help message and exit\n"));
-    lbuf_append(&lbuf, "  -h host name  %s",
-	_("run command on specified host if supported\n"));
-    lbuf_append(&lbuf, "  -i [command]  %s",
+    lbuf_append(&lbuf, "  -h, --host remote host      %s",
+	_("run command on specified host (if supported)\n"));
+    lbuf_append(&lbuf, "  -i, --login [command]       %s",
 	_("run a login shell as target user\n"));
-    lbuf_append(&lbuf, "  -K            %s",
+    lbuf_append(&lbuf, "  -K, --remove-timestamp      %s",
 	_("remove timestamp file completely\n"));
-    lbuf_append(&lbuf, "  -k            %s",
+    lbuf_append(&lbuf, "  -k, --reset-timestamp       %s",
 	_("invalidate timestamp file\n"));
-    lbuf_append(&lbuf, "  -l[l] command %s",
+    lbuf_append(&lbuf, "  -l[l], --list [command]     %s",
 	_("list user's available commands\n"));
-    lbuf_append(&lbuf, "  -n            %s",
+    lbuf_append(&lbuf, "  -n, --non-interactive       %s",
 	_("non-interactive mode, will not prompt user\n"));
-    lbuf_append(&lbuf, "  -P            %s",
+    lbuf_append(&lbuf, "  -P, --preserve-groups       %s",
 	_("preserve group vector instead of setting to target's\n"));
-    lbuf_append(&lbuf, "  -p prompt     %s",
+    lbuf_append(&lbuf, "  -p, --prompt prompt         %s",
 	_("use specified password prompt\n"));
 #ifdef HAVE_SELINUX
-    lbuf_append(&lbuf, "  -r role       %s",
+    lbuf_append(&lbuf, "  -r, --role role             %s",
 	_("create SELinux security context with specified role\n"));
 #endif
-    lbuf_append(&lbuf, "  -S            %s",
+    lbuf_append(&lbuf, "  -S, --stdin                 %s",
 	_("read password from standard input\n"));
-    lbuf_append(&lbuf,
-	"  -s [command]  %s", _("run a shell as target user\n"));
+    lbuf_append(&lbuf, "  -s, --shell [command]       %s",
+	_("run a shell as target user\n"));
 #ifdef HAVE_SELINUX
-    lbuf_append(&lbuf, "  -t type       %s",
+    lbuf_append(&lbuf, "  -t, --type type             %s",
 	_("create SELinux security context with specified role\n"));
 #endif
-    lbuf_append(&lbuf, "  -U user       %s",
+    lbuf_append(&lbuf, "  -U, --other-user user name  %s",
 	_("when listing, list specified user's privileges\n"));
-    lbuf_append(&lbuf, "  -u user       %s",
+    lbuf_append(&lbuf, "  -u, --user user name|#uid   %s",
 	_("run command (or edit file) as specified user\n"));
-    lbuf_append(&lbuf, "  -V            %s",
+    lbuf_append(&lbuf, "  -V, --version               %s",
 	_("display version information and exit\n"));
-    lbuf_append(&lbuf, "  -v            %s",
+    lbuf_append(&lbuf, "  -v, --validate              %s",
 	_("update user's timestamp without running a command\n"));
-    lbuf_append(&lbuf, "  --            %s",
+    lbuf_append(&lbuf, "  --                          %s",
 	_("stop processing command line arguments\n"));
     lbuf_print(&lbuf);
     lbuf_destroy(&lbuf);
diff --git a/src/sudo.c b/src/sudo.c
index e9eac66ca..8815ecfc4 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -83,10 +83,10 @@
 # include <prot.h>
 #endif /* HAVE_GETPRPWNAM && HAVE_SET_AUTH_PARAMETERS */
 
+#include <sudo_usage.h>
 #include "sudo.h"
 #include "sudo_plugin.h"
 #include "sudo_plugin_int.h"
-#include "sudo_usage.h"
 
 /*
  * Local variables
diff --git a/src/sudo_usage.h.in b/src/sudo_usage.h.in
index b78198803..fb520afcb 100644
--- a/src/sudo_usage.h.in
+++ b/src/sudo_usage.h.in
@@ -23,11 +23,11 @@
  * Usage strings for sudo.  These are here because we
  * need to be able to substitute values from configure.
  */
-#define SUDO_USAGE1 " [-D level] -h | -K | -k | -V"
-#define SUDO_USAGE2 " -v [-AknS] @BSDAUTH_USAGE@[-D level] [-g groupname|#gid] [-h hostname] [-p prompt] [-u user name|#uid]"
-#define SUDO_USAGE3 " -l[l] [-AknS] @BSDAUTH_USAGE@[-D level] [-g groupname|#gid] [-h hostname] [-p prompt] [-U user name] [-u user name|#uid] [command]"
-#define SUDO_USAGE4 " [-AbEHknPS] @BSDAUTH_USAGE@@SELINUX_USAGE@[-C fd] [-D level] @LOGINCAP_USAGE@[-g groupname|#gid] [-h hostname] [-p prompt] [-u user name|#uid] [VAR=value] [-i|-s] [<command>]"
-#define SUDO_USAGE5 " -e [-AknS] @BSDAUTH_USAGE@@SELINUX_USAGE@[-C fd] [-D level] @LOGINCAP_USAGE@[-g groupname|#gid] [-h hostname] [-p prompt] [-u user name|#uid] file ..."
+#define SUDO_USAGE1 " -h | -K | -k | -V"
+#define SUDO_USAGE2 " -v [-AknS] @BSDAUTH_USAGE@[-g group name|#gid] [-h remote host] [-p prompt] [-u user name|#uid]"
+#define SUDO_USAGE3 " -l[l] [-AknS] @BSDAUTH_USAGE@[-g group name|#gid] [-h remote host] [-p prompt] [-U user name] [-u user name|#uid] [command]"
+#define SUDO_USAGE4 " [-AbEHknPS] @BSDAUTH_USAGE@@SELINUX_USAGE@[-C fd] @LOGINCAP_USAGE@[-g group name|#gid] [-h remote host] [-p prompt] [-u user name|#uid] [VAR=value] [-i|-s] [<command>]"
+#define SUDO_USAGE5 " -e [-AknS] @BSDAUTH_USAGE@@SELINUX_USAGE@[-C fd] @LOGINCAP_USAGE@[-g group name|#gid] [-h remote host] [-p prompt] [-u user name|#uid] file ..."
 
 /*
  * Configure script arguments used to build sudo.