From: Todd C. Miller <Todd.Miller@courtesan.com>
Date: Mon, 21 Jan 2008 15:01:37 +0000 (+0000)
Subject: regen
X-Git-Tag: SUDO_1_7_0~213
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bc5772f79891d0e17135598358de289ba5c5a7f9;p=sudo

regen
---

diff --git a/sudo.cat b/sudo.cat
index 1acfcc5a2..1df7a46c5 100644
--- a/sudo.cat
+++ b/sudo.cat
@@ -1,7 +1,7 @@
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 NNAAMMEE
@@ -10,554 +10,468 @@ NNAAMMEE
 SSYYNNOOPPSSIISS
        ssuuddoo --hh | --KK | --kk | --LL | --VV | --vv
 
-       ssuuddoo --ll [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d] [--UU _u_s_e_r_n_a_m_e] [--uu _u_s_e_r_-
-       _n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
+       ssuuddoo --ll [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d] [--UU _u_s_e_r_n_a_m_e] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
 
-       ssuuddoo [--bbEEHHPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
-       [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d]
-       [VVAARR=_v_a_l_u_e] [{--ii | --ss] [<_c_o_m_m_a_n_d}]
+       ssuuddoo [--bbEEHHPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-] [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d]
+       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] [{--ii | --ss] [<_c_o_m_m_a_n_d}]
 
-       ssuuddooeeddiitt [--SS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
-       [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] file
-       ...
+       ssuuddooeeddiitt [--SS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-] [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d]
+       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] file ...
 
 DDEESSCCRRIIPPTTIIOONN
-       ssuuddoo allows a permitted user to execute a _c_o_m_m_a_n_d as the
-       superuser or another user, as specified in the _s_u_d_o_e_r_s
-       file.  The real and effective uid and gid are set to match
-       those of the target user as specified in the passwd file
-       and the group vector is initialized based on the group
-       file (unless the --PP option was specified).  If the invok-
-       ing user is root or if the target user is the same as the
-       invoking user, no password is required.  Otherwise, ssuuddoo
-       requires that users authenticate themselves with a pass-
-       word by default (NOTE: in the default configuration this
-       is the user's password, not the root password).  Once a
-       user has been authenticated, a timestamp is updated and
-       the user may then use sudo without a password for a short
-       period of time (5 minutes unless overridden in _s_u_d_o_e_r_s).
+       ssuuddoo allows a permitted user to execute a _c_o_m_m_a_n_d as the superuser or
+       another user, as specified in the _s_u_d_o_e_r_s file.  The real and effective
+       uid and gid are set to match those of the target user as specified in
+       the passwd file and the group vector is initialized based on the group
+       file (unless the --PP option was specified).  If the invoking user is
+       root or if the target user is the same as the invoking user, no pass-
+       word is required.  Otherwise, ssuuddoo requires that users authenticate
+       themselves with a password by default (NOTE: in the default configura-
+       tion this is the user's password, not the root password).  Once a user
+       has been authenticated, a timestamp is updated and the user may then
+       use sudo without a password for a short period of time (5 minutes
+       unless overridden in _s_u_d_o_e_r_s).
 
-       When invoked as ssuuddooeeddiitt, the --ee option (described below),
-       is implied.
+       When invoked as ssuuddooeeddiitt, the --ee option (described below), is implied.
 
-       ssuuddoo determines who is an authorized user by consulting
-       the file _/_e_t_c_/_s_u_d_o_e_r_s.  By giving ssuuddoo the --vv flag, a user
-       can update the time stamp without running a _c_o_m_m_a_n_d. The
-       password prompt itself will also time out if the user's
-       password is not entered within 5 minutes (unless overrid-
-       den via _s_u_d_o_e_r_s).
+       ssuuddoo determines who is an authorized user by consulting the file
+       _/_e_t_c_/_s_u_d_o_e_r_s.  By giving ssuuddoo the --vv flag, a user can update the time
+       stamp without running a _c_o_m_m_a_n_d. The password prompt itself will also
+       time out if the user's password is not entered within 5 minutes (unless
+       overridden via _s_u_d_o_e_r_s).
 
-       If a user who is not listed in the _s_u_d_o_e_r_s file tries to
-       run a command via ssuuddoo, mail is sent to the proper author-
-       ities, as defined at configure time or in the _s_u_d_o_e_r_s file
-       (defaults to root).  Note that the mail will not be sent
-       if an unauthorized user tries to run sudo with the --ll or
-       --vv flags.  This allows users to determine for themselves
-       whether or not they are allowed to use ssuuddoo.
+       If a user who is not listed in the _s_u_d_o_e_r_s file tries to run a command
+       via ssuuddoo, mail is sent to the proper authorities, as defined at config-
+       ure time or in the _s_u_d_o_e_r_s file (defaults to root).  Note that the mail
+       will not be sent if an unauthorized user tries to run sudo with the --ll
+       or --vv flags.  This allows users to determine for themselves whether or
+       not they are allowed to use ssuuddoo.
 
-       If ssuuddoo is run by root and the SUDO_USER environment vari-
-       able is set, ssuuddoo will use this value to determine who the
-       actual user is.  This can be used by a user to log
+       If ssuuddoo is run by root and the SUDO_USER environment variable is set,
+       ssuuddoo will use this value to determine who the actual user is.  This can
+       be used by a user to log commands through sudo even when a root shell
+       has been invoked.  It also allows the --ee flag to remain useful even
+       when being run via a sudo-run script or program.  Note however, that
+       the sudoers lookup is still done for root, not the user specified by
+       SUDO_USER.
 
+       ssuuddoo can log both successful and unsuccessful attempts (as well as
+       errors) to _s_y_s_l_o_g(3), a log file, or both.  By default ssuuddoo will log
+       via _s_y_s_l_o_g(3) but this is changeable at configure time or via the
 
 
-1.7                      January  1, 2008                       1
 
+1.7                      January 21, 2008                       1
 
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
 
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-       commands through sudo even when a root shell has been
-       invoked.  It also allows the --ee flag to remain useful even
-       when being run via a sudo-run script or program.  Note
-       however, that the sudoers lookup is still done for root,
-       not the user specified by SUDO_USER.
 
-       ssuuddoo can log both successful and unsuccessful attempts (as
-       well as errors) to _s_y_s_l_o_g(3), a log file, or both.  By
-       default ssuuddoo will log via _s_y_s_l_o_g(3) but this is changeable
-       at configure time or via the _s_u_d_o_e_r_s file.
+       _s_u_d_o_e_r_s file.
 
 OOPPTTIIOONNSS
        ssuuddoo accepts the following command line options:
 
-       -a _t_y_p_e     The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes
-                   ssuuddoo to use the specified authentication type
-                   when validating the user, as allowed by
-                   _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The system administrator may
-                   specify a list of sudo-specific authentication
-                   methods by adding an "auth-sudo" entry in
-                   _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  This option is only avail-
-                   able on systems that support BSD authentica-
-                   tion.
-
-       -b          The --bb (_b_a_c_k_g_r_o_u_n_d) option tells ssuuddoo to run
-                   the given command in the background.  Note
-                   that if you use the --bb option you cannot use
-                   shell job control to manipulate the process.
-
-       -C _f_d       Normally, ssuuddoo will close all open file
-                   descriptors other than standard input, stan-
-                   dard output and standard error.  The --CC (_c_l_o_s_e
-                   _f_r_o_m) option allows the user to specify a
-                   starting point above the standard error (file
-                   descriptor three).  Values less than three are
-                   not permitted.  This option is only available
-                   if the administrator has enabled the _c_l_o_s_e_-
-                   _f_r_o_m___o_v_e_r_r_i_d_e option in _s_u_d_o_e_r_s(5).
-
-       -c _c_l_a_s_s    The --cc (_c_l_a_s_s) option causes ssuuddoo to run the
-                   specified command with resources limited by
-                   the specified login class.  The _c_l_a_s_s argument
-                   can be either a class name as defined in
-                   _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single '-' character.
-                   Specifying a _c_l_a_s_s of - indicates that the
-                   command should be run restricted by the
-                   default login capabilities for the user the
-                   command is run as.  If the _c_l_a_s_s argument
-                   specifies an existing user class, the command
-                   must be run as root, or the ssuuddoo command must
-                   be run from a shell that is already root.
-                   This option is only available on systems with
-                   BSD login classes.
+       -a _t_y_p_e     The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes ssuuddoo to use the
+                   specified authentication type when validating the user, as
+                   allowed by _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The system administrator may
+                   specify a list of sudo-specific authentication methods by
+                   adding an "auth-sudo" entry in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  This
+                   option is only available on systems that support BSD
+                   authentication.
+
+       -b          The --bb (_b_a_c_k_g_r_o_u_n_d) option tells ssuuddoo to run the given com-
+                   mand in the background.  Note that if you use the --bb option
+                   you cannot use shell job control to manipulate the process.
+
+       -C _f_d       Normally, ssuuddoo will close all open file descriptors other
+                   than standard input, standard output and standard error.
+                   The --CC (_c_l_o_s_e _f_r_o_m) option allows the user to specify a
+                   starting point above the standard error (file descriptor
+                   three).  Values less than three are not permitted.  This
+                   option is only available if the administrator has enabled
+                   the _c_l_o_s_e_f_r_o_m___o_v_e_r_r_i_d_e option in _s_u_d_o_e_r_s(4).
+
+       -c _c_l_a_s_s    The --cc (_c_l_a_s_s) option causes ssuuddoo to run the specified com-
+                   mand with resources limited by the specified login class.
+                   The _c_l_a_s_s argument can be either a class name as defined in
+                   _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single '-' character.  Specifying a
+                   _c_l_a_s_s of - indicates that the command should be run
+                   restricted by the default login capabilities for the user
+                   the command is run as.  If the _c_l_a_s_s argument specifies an
+                   existing user class, the command must be run as root, or
+                   the ssuuddoo command must be run from a shell that is already
+                   root.  This option is only available on systems with BSD
+                   login classes.
+
+       -E          The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option will override the
+                   _e_n_v___r_e_s_e_t option in _s_u_d_o_e_r_s(4)).  It is only available when
+                   either the matching command has the SETENV tag or the
+                   _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s(4).
+
+       -e          The --ee (_e_d_i_t) option indicates that, instead of running a
+                   command, the user wishes to edit one or more files.  In
+                   lieu of a command, the string "sudoedit" is used when con-
+                   sulting the _s_u_d_o_e_r_s file.  If the user is authorized by
+                   _s_u_d_o_e_r_s the following steps are taken:
 
+                   1.  Temporary copies are made of the files to be edited
+                       with the owner set to the invoking user.
 
+                   2.  The editor specified by the VISUAL or EDITOR environ-
+                       ment variables is run to edit the temporary files.  If
+                       neither VISUAL nor EDITOR are set, the program listed
 
 
-1.7                      January  1, 2008                       2
 
+1.7                      January 21, 2008                       2
 
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
 
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-       -E          The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option will
-                   override the _e_n_v___r_e_s_e_t option in _s_u_d_o_e_r_s(5)).
-                   It is only available when either the matching
-                   command has the SETENV tag or the _s_e_t_e_n_v
-                   option is set in _s_u_d_o_e_r_s(5).
 
-       -e          The --ee (_e_d_i_t) option indicates that, instead
-                   of running a command, the user wishes to edit
-                   one or more files.  In lieu of a command, the
-                   string "sudoedit" is used when consulting the
-                   _s_u_d_o_e_r_s file.  If the user is authorized by
-                   _s_u_d_o_e_r_s the following steps are taken:
+                       in the _e_d_i_t_o_r _s_u_d_o_e_r_s variable is used.
 
-                   1.  Temporary copies are made of the files to
-                       be edited with the owner set to the invok-
-                       ing user.
+                   3.  If they have been modified, the temporary files are
+                       copied back to their original location and the tempo-
+                       rary versions are removed.
 
-                   2.  The editor specified by the VISUAL or EDI-
-                       TOR environment variables is run to edit
-                       the temporary files.  If neither VISUAL
-                       nor EDITOR are set, the program listed in
-                       the _e_d_i_t_o_r _s_u_d_o_e_r_s variable is used.
+                   If the specified file does not exist, it will be created.
+                   Note that unlike most commands run by ssuuddoo, the editor is
+                   run with the invoking user's environment unmodified.  If,
+                   for some reason, ssuuddoo is unable to update a file with its
+                   edited version, the user will receive a warning and the
+                   edited copy will remain in a temporary file.
 
-                   3.  If they have been modified, the temporary
-                       files are copied back to their original
-                       location and the temporary versions are
-                       removed.
+       -g _g_r_o_u_p    Normally, ssuuddoo sets the primary group to the one specified
+                   by the passwd database for the user the command is being
+                   run as (by default, root).  The --gg (_g_r_o_u_p) option causes
+                   ssuuddoo to run the specified command with the primary group
+                   set to _g_r_o_u_p.  To specify a _g_i_d instead of a _g_r_o_u_p _n_a_m_e,
+                   use _#_g_i_d.  When running commands as a _g_i_d, many shells
+                   require that the '#' be escaped with a backslash ('\').  If
+                   no --uu option is specified, the command will be run as the
+                   invoking user (not root).  In either case, the primary
+                   group will be set to _g_r_o_u_p.
 
-                   If the specified file does not exist, it will
-                   be created.  Note that unlike most commands
-                   run by ssuuddoo, the editor is run with the invok-
-                   ing user's environment unmodified.  If, for
-                   some reason, ssuuddoo is unable to update a file
-                   with its edited version, the user will receive
-                   a warning and the edited copy will remain in a
-                   temporary file.
+       -H          The --HH (_H_O_M_E) option sets the HOME environment variable to
+                   the homedir of the target user (root by default) as speci-
+                   fied in _p_a_s_s_w_d(4).  By default, ssuuddoo does not modify HOME
+                   (see _s_e_t___h_o_m_e and _a_l_w_a_y_s___s_e_t___h_o_m_e in _s_u_d_o_e_r_s(4)).
 
-       -g _g_r_o_u_p    Normally, ssuuddoo sets the primary group to the
-                   one specified by the passwd database for the
-                   user the command is being run as (by default,
-                   root).  The --gg (_g_r_o_u_p) option causes ssuuddoo to
-                   run the specified command with the primary
-                   group set to _g_r_o_u_p.  To specify a _g_i_d instead
-                   of a _g_r_o_u_p _n_a_m_e, use _#_g_i_d.  When running com-
-                   mands as a _g_i_d, many shells require that the
-                   '#' be escaped with a backslash ('\').  If no
-                   --uu option is specified, the command will be
-                   run as the invoking user (not root).  In
-                   either case, the primary group will be set to
-                   _g_r_o_u_p.
+       -h          The --hh (_h_e_l_p) option causes ssuuddoo to print a usage message
+                   and exit.
 
-       -H          The --HH (_H_O_M_E) option sets the HOME environment
-                   variable to the homedir of the target user
-                   (root by default) as specified in _p_a_s_s_w_d(5).
+       -i [command]
+                   The --ii (_s_i_m_u_l_a_t_e _i_n_i_t_i_a_l _l_o_g_i_n) option runs the shell spec-
+                   ified in the _p_a_s_s_w_d(4) entry of the target user as a login
+                   shell.  This means that login-specific resource files such
+                   as .profile or .login will be read by the shell.  If a com-
+                   mand is specified, it is passed to the shell for execution.
+                   Otherwise, an interactive shell is executed.  ssuuddoo attempts
+                   to change to that user's home directory before running the
+                   shell.  It also initializes the environment, leaving _D_I_S_-
+                   _P_L_A_Y and _T_E_R_M unchanged, setting _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_-
+                   _N_A_M_E, and _P_A_T_H, as well as the contents of _/_e_t_c_/_e_n_v_i_r_o_n_-
+                   _m_e_n_t.  All other environment variables are removed.
 
+       -K          The --KK (sure _k_i_l_l) option is like --kk except that it removes
+                   the user's timestamp entirely.  Like --kk, this option does
+                   not require a password.
 
+       -k          The --kk (_k_i_l_l) option to ssuuddoo invalidates the user's times-
+                   tamp by setting the time on it to the Epoch.  The next time
+                   ssuuddoo is run a password will be required.  This option does
+                   not require a password and was added to allow a user to
+                   revoke ssuuddoo permissions from a .logout file.
 
-1.7                      January  1, 2008                       3
 
 
+1.7                      January 21, 2008                       3
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
 
 
-                   By default, ssuuddoo does not modify HOME (see
-                   _s_e_t___h_o_m_e and _a_l_w_a_y_s___s_e_t___h_o_m_e in _s_u_d_o_e_r_s(5)).
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-       -h          The --hh (_h_e_l_p) option causes ssuuddoo to print a
-                   usage message and exit.
 
-       -i [command]
-                   The --ii (_s_i_m_u_l_a_t_e _i_n_i_t_i_a_l _l_o_g_i_n) option runs
-                   the shell specified in the _p_a_s_s_w_d(5) entry of
-                   the target user as a login shell.  This means
-                   that login-specific resource files such as
-                   .profile or .login will be read by the shell.
-                   If a command is specified, it is passed to the
-                   shell for execution.  Otherwise, an interac-
-                   tive shell is executed.  ssuuddoo attempts to
-                   change to that user's home directory before
-                   running the shell.  It also initializes the
-                   environment, leaving _D_I_S_P_L_A_Y and _T_E_R_M
-                   unchanged, setting _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_N_A_M_E,
-                   and _P_A_T_H, as well as the contents of
-                   _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t.  All other environment vari-
-                   ables are removed.
-
-       -K          The --KK (sure _k_i_l_l) option is like --kk except
-                   that it removes the user's timestamp entirely.
-                   Like --kk, this option does not require a pass-
-                   word.
-
-       -k          The --kk (_k_i_l_l) option to ssuuddoo invalidates the
-                   user's timestamp by setting the time on it to
-                   the Epoch.  The next time ssuuddoo is run a pass-
-                   word will be required.  This option does not
-                   require a password and was added to allow a
-                   user to revoke ssuuddoo permissions from a .logout
-                   file.
-
-       -L          The --LL (_l_i_s_t defaults) option will list out
-                   the parameters that may be set in a _D_e_f_a_u_l_t_s
-                   line along with a short description for each.
-                   This option is useful in conjunction with
-                   _g_r_e_p(1).
+       -L          The --LL (_l_i_s_t defaults) option will list out the parameters
+                   that may be set in a _D_e_f_a_u_l_t_s line along with a short
+                   description for each.  This option is useful in conjunction
+                   with _g_r_e_p(1).
 
        -l [_c_o_m_m_a_n_d]
-                   If no _c_o_m_m_a_n_d is specified, the --ll (_l_i_s_t)
-                   option will list the allowed (and forbidden)
-                   commands for the invoking user (or the user
-                   specified by the --UU option) on the current
-                   host.  If a _c_o_m_m_a_n_d is specified and is per-
-                   mitted by _s_u_d_o_e_r_s, the fully-qualified path to
-                   the command is displayed along with any com-
-                   mand line arguments.  If _c_o_m_m_a_n_d is not
-                   allowed, ssuuddoo will exit with a return value of
-                   1.
-
-
-
-
-1.7                      January  1, 2008                       4
-
-
-
-
-
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
+                   If no _c_o_m_m_a_n_d is specified, the --ll (_l_i_s_t) option will list
+                   the allowed (and forbidden) commands for the invoking user
+                   (or the user specified by the --UU option) on the current
+                   host.  If a _c_o_m_m_a_n_d is specified and is permitted by _s_u_d_o_-
+                   _e_r_s, the fully-qualified path to the command is displayed
+                   along with any command line arguments.  If _c_o_m_m_a_n_d is not
+                   allowed, ssuuddoo will exit with a return value of 1.
 
+       -P          The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes ssuuddoo to pre-
+                   serve the invoking user's group vector unaltered.  By
+                   default, ssuuddoo will initialize the group vector to the list
+                   of groups the target user is in.  The real and effective
+                   group IDs, however, are still set to match the target user.
 
-       -P          The --PP (_p_r_e_s_e_r_v_e _g_r_o_u_p _v_e_c_t_o_r) option causes
-                   ssuuddoo to preserve the invoking user's group
-                   vector unaltered.  By default, ssuuddoo will ini-
-                   tialize the group vector to the list of groups
-                   the target user is in.  The real and effective
-                   group IDs, however, are still set to match the
-                   target user.
+       -p _p_r_o_m_p_t   The --pp (_p_r_o_m_p_t) option allows you to override the default
+                   password prompt and use a custom one.  The following per-
+                   cent (`%') escapes are supported:
 
-       -p _p_r_o_m_p_t   The --pp (_p_r_o_m_p_t) option allows you to override
-                   the default password prompt and use a custom
-                   one.  The following percent (`%') escapes are
-                   supported:
+                   %H  expanded to the local hostname including the domain
+                       name (on if the machine's hostname is fully qualified
+                       or the _f_q_d_n _s_u_d_o_e_r_s option is set)
 
-                   %H  expanded to the local hostname including
-                       the domain name (on if the machine's host-
-                       name is fully qualified or the _f_q_d_n _s_u_d_o_-
-                       _e_r_s option is set)
+                   %h  expanded to the local hostname without the domain name
 
-                   %h  expanded to the local hostname without the
-                       domain name
+                   %p  expanded to the user whose password is being asked for
+                       (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and _r_u_n_a_s_p_w flags in
+                       _s_u_d_o_e_r_s)
 
-                   %U  expanded to the login name of the user the
-                       command will be run as (defaults to root)
+                   %U  expanded to the login name of the user the command will
+                       be run as (defaults to root)
 
                    %u  expanded to the invoking user's login name
 
-                   %%  two consecutive % characters are collapsed
-                       into a single % character
+                   %%  two consecutive % characters are collapsed into a sin-
+                       gle % character
 
-                   The prompt specified by the --pp option will
-                   override the system password prompt on systems
-                   that support PAM unless the _p_a_s_s_p_r_o_m_p_t___o_v_e_r_-
-                   _r_i_d_e flag is disabled in _s_u_d_o_e_r_s.
+                   The prompt specified by the --pp option will override the
+                   system password prompt on systems that support PAM unless
+                   the _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag is disabled in _s_u_d_o_e_r_s.
 
-       -S          The --SS (_s_t_d_i_n) option causes ssuuddoo to read the
-                   password from the standard input instead of
-                   the terminal device.
+       -S          The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password from
+                   the standard input instead of the terminal device.
 
        -s [command]
-                   The --ss (_s_h_e_l_l) option runs the shell specified
-                   by the _S_H_E_L_L environment variable if it is set
-                   or the shell as specified in _p_a_s_s_w_d(5).  If a
-                   command is specified, it is passed to the
-                   shell for execution.  Otherwise, an interac-
-                   tive shell is executed.
+                   The --ss (_s_h_e_l_l) option runs the shell specified by the _S_H_E_L_L
+                   environment variable if it is set or the shell as specified
+                   in _p_a_s_s_w_d(4).  If a command is specified, it is passed to
+                   the shell for execution.  Otherwise, an interactive shell
 
-       -U _u_s_e_r     The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunc-
-                   tion with the --ll option to specify the user
-                   whose privileges should be listed.  Only root
-                   or a user with ssuuddoo ALL on the current host
-                   may use this option.
 
-       -u _u_s_e_r     The --uu (_u_s_e_r) option causes ssuuddoo to run the
-                   specified command as a user other than _r_o_o_t.
 
+1.7                      January 21, 2008                       4
 
 
-1.7                      January  1, 2008                       5
 
 
 
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
+                   is executed.
 
+       -U _u_s_e_r     The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with the
+                   --ll option to specify the user whose privileges should be
+                   listed.  Only root or a user with ssuuddoo ALL on the current
+                   host may use this option.
 
-                   To specify a _u_i_d instead of a _u_s_e_r _n_a_m_e, use
-                   _#_u_i_d.  When running commands as a _u_i_d, many
-                   shells require that the '#' be escaped with a
-                   backslash ('\').  Note that if the _t_a_r_g_e_t_p_w
-                   Defaults option is set (see _s_u_d_o_e_r_s(5)) it is
-                   not possible to run commands with a uid not
-                   listed in the password database.
+       -u _u_s_e_r     The --uu (_u_s_e_r) option causes ssuuddoo to run the specified com-
+                   mand as a user other than _r_o_o_t.  To specify a _u_i_d instead
+                   of a _u_s_e_r _n_a_m_e, use _#_u_i_d.  When running commands as a _u_i_d,
+                   many shells require that the '#' be escaped with a back-
+                   slash ('\').  Note that if the _t_a_r_g_e_t_p_w Defaults option is
+                   set (see _s_u_d_o_e_r_s(4)) it is not possible to run commands
+                   with a uid not listed in the password database.
 
-       -V          The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print
-                   the version number and exit.  If the invoking
-                   user is already root the --VV option will print
-                   out a list of the defaults ssuuddoo was compiled
-                   with as well as the machine's local network
+       -V          The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the version
+                   number and exit.  If the invoking user is already root the
+                   --VV option will print out a list of the defaults ssuuddoo was
+                   compiled with as well as the machine's local network
                    addresses.
 
-       -v          If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will
-                   update the user's timestamp, prompting for the
-                   user's password if necessary.  This extends
-                   the ssuuddoo timeout for another 5 minutes (or
-                   whatever the timeout is set to in _s_u_d_o_e_r_s) but
+       -v          If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
+                   user's timestamp, prompting for the user's password if nec-
+                   essary.  This extends the ssuuddoo timeout for another 5 min-
+                   utes (or whatever the timeout is set to in _s_u_d_o_e_r_s) but
                    does not run a command.
 
-       --          The ---- flag indicates that ssuuddoo should stop
-                   processing command line arguments.  It is most
-                   useful in conjunction with the --ss flag.
-
-       Environment variables to be set for the command may also
-       be passed on the command line in the form of VVAARR=_v_a_l_u_e,
-       e.g.  LLDD__LLIIBBRRAARRYY__PPAATTHH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  Variables
-       passed on the command line are subject to the same
-       restrictions as normal environment variables with one
-       important exception.  If the _s_e_t_e_n_v option is set in _s_u_d_o_-
-       _e_r_s, the command to be run has the SETENV tag set or the
-       command matched is ALL, the user may set variables that
-       would overwise be forbidden.  See _s_u_d_o_e_r_s(5) for more
-       information.
+       --          The ---- flag indicates that ssuuddoo should stop processing com-
+                   mand line arguments.  It is most useful in conjunction with
+                   the --ss flag.
+
+       Environment variables to be set for the command may also be passed on
+       the command line in the form of VVAARR=_v_a_l_u_e, e.g.
+       LLDD__LLIIBBRRAARRYY__PPAATTHH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  Variables passed on the command
+       line are subject to the same restrictions as normal environment vari-
+       ables with one important exception.  If the _s_e_t_e_n_v option is set in
+       _s_u_d_o_e_r_s, the command to be run has the SETENV tag set or the command
+       matched is ALL, the user may set variables that would overwise be for-
+       bidden.  See _s_u_d_o_e_r_s(4) for more information.
 
 RREETTUURRNN VVAALLUUEESS
-       Upon successful execution of a program, the return value
-       from ssuuddoo will simply be the return value of the program
-       that was executed.
+       Upon successful execution of a program, the return value from ssuuddoo will
+       simply be the return value of the program that was executed.
 
-       Otherwise, ssuuddoo quits with an exit value of 1 if there is
-       a configuration/permission problem or if ssuuddoo cannot exe-
-       cute the given command.  In the latter case the error
-       string is printed to stderr.  If ssuuddoo cannot _s_t_a_t(2) one
-       or more entries in the user's PATH an error is printed on
-       stderr.  (If the directory does not exist or if it is not
-       really a directory, the entry is ignored and no error is
-       printed.)  This should not happen under normal circum-
-       stances.  The most common reason for _s_t_a_t(2) to return
-       "permission denied" is if you are running an automounter
-       and one of the directories in your PATH is on a machine
-       that is currently unreachable.
+       Otherwise, ssuuddoo quits with an exit value of 1 if there is a configura-
+       tion/permission problem or if ssuuddoo cannot execute the given command.
+       In the latter case the error string is printed to stderr.  If ssuuddoo can-
+       not _s_t_a_t(2) one or more entries in the user's PATH an error is printed
+       on stderr.  (If the directory does not exist or if it is not really a
+       directory, the entry is ignored and no error is printed.)  This should
+       not happen under normal circumstances.  The most common reason for
+       _s_t_a_t(2) to return "permission denied" is if you are running an auto-
+       mounter and one of the directories in your PATH is on a machine that is
+       currently unreachable.
 
 
 
-1.7                      January  1, 2008                       6
+1.7                      January 21, 2008                       5
 
 
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
 SSEECCUURRIITTYY NNOOTTEESS
        ssuuddoo tries to be safe when executing external commands.
 
-       There are two distinct ways to deal with environment vari-
-       ables.  By default, the _e_n_v___r_e_s_e_t _s_u_d_o_e_r_s option is
-       enabled.  This causes commands to be executed with a mini-
-       mal environment containing TERM, PATH, HOME, SHELL, LOG-
-       NAME, USER and USERNAME in addition to variables from the
-       invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p
-       _s_u_d_o_e_r_s options.  There is effectively a whitelist for
-       environment variables.
-
-       If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s,
-       any variables not explicitly denied by the _e_n_v___c_h_e_c_k and
-       _e_n_v___d_e_l_e_t_e options are inherited from the invoking pro-
-       cess.  In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e behave like
-       a blacklist.  Since it is not possible to blacklist all
-       potentially dangerous environment variables, use of the
+       There are two distinct ways to deal with environment variables.  By
+       default, the _e_n_v___r_e_s_e_t _s_u_d_o_e_r_s option is enabled.  This causes commands
+       to be executed with a minimal environment containing TERM, PATH, HOME,
+       SHELL, LOGNAME, USER and USERNAME in addition to variables from the
+       invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p _s_u_d_o_e_r_s
+       options.  There is effectively a whitelist for environment variables.
+
+       If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s, any variables
+       not explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are
+       inherited from the invoking process.  In this case, _e_n_v___c_h_e_c_k and
+       _e_n_v___d_e_l_e_t_e behave like a blacklist.  Since it is not possible to black-
+       list all potentially dangerous environment variables, use of the
        default _e_n_v___r_e_s_e_t behavior is encouraged.
 
-       In all cases, environment variables with a value beginning
-       with () are removed as they could be interpreted as bbaasshh
-       functions.  The list of environment variables that ssuuddoo
-       allows or denies is contained in the output of sudo -V
-       when run as root.
+       In all cases, environment variables with a value beginning with () are
+       removed as they could be interpreted as bbaasshh functions.  The list of
+       environment variables that ssuuddoo allows or denies is contained in the
+       output of sudo -V when run as root.
 
-       Note that the dynamic linker on most operating systems
-       will remove variables that can control dynamic linking
-       from the environment of setuid executables, including
-       ssuuddoo.  Depending on the operating system this may include
-       _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and oth-
-       ers.  These type of variables are removed from the envi-
-       ronment before ssuuddoo even begins execution and, as such, it
-       is not possible for ssuuddoo to preserve them.
+       Note that the dynamic linker on most operating systems will remove
+       variables that can control dynamic linking from the environment of
+       setuid executables, including ssuuddoo.  Depending on the operating system
+       this may include _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and
+       others.  These type of variables are removed from the environment
+       before ssuuddoo even begins execution and, as such, it is not possible for
+       ssuuddoo to preserve them.
 
-       To prevent command spoofing, ssuuddoo checks "." and "" (both
-       denoting current directory) last when searching for a com-
-       mand in the user's PATH (if one or both are in the PATH).
-       Note, however, that the actual PATH environment variable
-       is _n_o_t modified and is passed unchanged to the program
-       that ssuuddoo executes.
+       To prevent command spoofing, ssuuddoo checks "." and "" (both denoting cur-
+       rent directory) last when searching for a command in the user's PATH
+       (if one or both are in the PATH).  Note, however, that the actual PATH
+       environment variable is _n_o_t modified and is passed unchanged to the
+       program that ssuuddoo executes.
 
-       ssuuddoo will check the ownership of its timestamp directory
-       (_/_v_a_r_/_r_u_n_/_s_u_d_o by default) and ignore the directory's con-
-       tents if it is not owned by root or if it is writable by a
-       user other than root.  On systems that allow non-root
-       users to give away files via _c_h_o_w_n(2), if the timestamp
-       directory is located in a directory writable by anyone
-       (e.g., _/_t_m_p), it is possible for a user to create the
-       timestamp directory before ssuuddoo is run.  However, because
-       ssuuddoo checks the ownership and mode of the directory and
-       its contents, the only damage that can be done is to
-       "hide" files by putting them in the timestamp dir.  This
-       is unlikely to happen since once the timestamp dir is
+       ssuuddoo will check the ownership of its timestamp directory (_/_v_a_r_/_r_u_n_/_s_u_d_o
+       by default) and ignore the directory's contents if it is not owned by
+       root or if it is writable by a user other than root.  On systems that
+       allow non-root users to give away files via _c_h_o_w_n(2), if the timestamp
+       directory is located in a directory writable by anyone (e.g., _/_t_m_p), it
+       is possible for a user to create the timestamp directory before ssuuddoo is
+       run.  However, because ssuuddoo checks the ownership and mode of the direc-
+       tory and its contents, the only damage that can be done is to "hide"
+       files by putting them in the timestamp dir.  This is unlikely to happen
+       since once the timestamp dir is owned by root and inaccessible by any
+       other user, the user placing files there would be unable to get them
+       back out.  To get around this issue you can use a directory that is not
+       world-writable for the timestamps (_/_v_a_r_/_a_d_m_/_s_u_d_o for instance) or cre-
+       ate _/_v_a_r_/_r_u_n_/_s_u_d_o with the appropriate owner (root) and permissions
+       (0700) in the system startup files.
 
+       ssuuddoo will not honor timestamps set far in the future.  Timestamps with
+       a date greater than current_time + 2 * TIMEOUT will be ignored and sudo
 
 
-1.7                      January  1, 2008                       7
 
+1.7                      January 21, 2008                       6
 
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
 
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-       owned by root and inaccessible by any other user, the user
-       placing files there would be unable to get them back out.
-       To get around this issue you can use a directory that is
-       not world-writable for the timestamps (_/_v_a_r_/_a_d_m_/_s_u_d_o for
-       instance) or create _/_v_a_r_/_r_u_n_/_s_u_d_o with the appropriate
-       owner (root) and permissions (0700) in the system startup
-       files.
 
-       ssuuddoo will not honor timestamps set far in the future.
-       Timestamps with a date greater than current_time + 2 *
-       TIMEOUT will be ignored and sudo will log and complain.
-       This is done to keep a user from creating his/her own
-       timestamp with a bogus date on systems that allow users to
+       will log and complain.  This is done to keep a user from creating
+       his/her own timestamp with a bogus date on systems that allow users to
        give away files.
 
-       Please note that ssuuddoo will normally only log the command
-       it explicitly runs.  If a user runs a command such as sudo
-       su or sudo sh, subsequent commands run from that shell
-       will _n_o_t be logged, nor will ssuuddoo's access control affect
-       them.  The same is true for commands that offer shell
-       escapes (including most editors).  Because of this, care
-       must be taken when giving users access to commands via
-       ssuuddoo to verify that the command does not inadvertently
-       give the user an effective root shell.  For more informa-
-       tion, please see the PREVENTING SHELL ESCAPES section in
-       _s_u_d_o_e_r_s(5).
+       Please note that ssuuddoo will normally only log the command it explicitly
+       runs.  If a user runs a command such as sudo su or sudo sh, subsequent
+       commands run from that shell will _n_o_t be logged, nor will ssuuddoo's access
+       control affect them.  The same is true for commands that offer shell
+       escapes (including most editors).  Because of this, care must be taken
+       when giving users access to commands via ssuuddoo to verify that the com-
+       mand does not inadvertently give the user an effective root shell.  For
+       more information, please see the PREVENTING SHELL ESCAPES section in
+       _s_u_d_o_e_r_s(4).
 
 EENNVVIIRROONNMMEENNTT
        ssuuddoo utilizes the following environment variables:
 
-       EDITOR          Default editor to use in --ee (sudoedit)
-                       mode if VISUAL is not set
+       EDITOR          Default editor to use in --ee (sudoedit) mode if VISUAL
+                       is not set
 
-       HOME            In --ss or --HH mode (or if sudo was config-
-                       ured with the --enable-shell-sets-home
-                       option), set to homedir of the target user
+       HOME            In --ss or --HH mode (or if sudo was configured with the
+                       --enable-shell-sets-home option), set to homedir of the
+                       target user
 
-       PATH            Set to a sane value if the _s_e_c_u_r_e___p_a_t_h
-                       sudoers option is set.
+       PATH            Set to a sane value if the _s_e_c_u_r_e___p_a_t_h sudoers option
+                       is set.
 
-       SHELL           Used to determine shell to run with -s
-                       option
+       SHELL           Used to determine shell to run with -s option
 
        SUDO_PROMPT     Used as the default password prompt
 
        SUDO_COMMAND    Set to the command run by sudo
 
-       SUDO_USER       Set to the login of the user who invoked
-                       sudo
+       SUDO_USER       Set to the login of the user who invoked sudo
 
-       SUDO_UID        Set to the uid of the user who invoked
-                       sudo
+       SUDO_UID        Set to the uid of the user who invoked sudo
 
-       SUDO_GID        Set to the gid of the user who invoked
+       SUDO_GID        Set to the gid of the user who invoked sudo
 
+       SUDO_PS1        If set, PS1 will be set to its value
 
+       USER            Set to the target user (root unless the --uu option is
+                       specified)
 
-1.7                      January  1, 2008                       8
+       VISUAL          Default editor to use in --ee (sudoedit) mode
 
+FFIILLEESS
+       _/_e_t_c_/_s_u_d_o_e_r_s        List of who can run what
+       _/_v_a_r_/_r_u_n_/_s_u_d_o       Directory containing timestamps
+       _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t    Initial environment for --ii mmooddee
 
+EEXXAAMMPPLLEESS
+       Note: the following examples assume suitable _s_u_d_o_e_r_s(4) entries.
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
 
+1.7                      January 21, 2008                       7
 
-                       sudo
 
-       SUDO_PS1        If set, PS1 will be set to its value
 
-       USER            Set to the target user (root unless the --uu
-                       option is specified)
 
-       VISUAL          Default editor to use in --ee (sudoedit)
-                       mode
 
-FFIILLEESS
-       _/_e_t_c_/_s_u_d_o_e_r_s        List of who can run what
-       _/_v_a_r_/_r_u_n_/_s_u_d_o       Directory containing timestamps
-       _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t    Initial environment for --ii mmooddee
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-EEXXAAMMPPLLEESS
-       Note: the following examples assume suitable _s_u_d_o_e_r_s(5)
-       entries.
 
        To get a file listing of an unreadable directory:
 
         $ sudo ls /usr/local/protected
 
-       To list the home directory of user yazza on a machine
-       where the file system holding ~yazza is not exported as
-       root:
+       To list the home directory of user yazza on a machine where the file
+       system holding ~yazza is not exported as root:
 
         $ sudo -u yazza ls ~yazza
 
@@ -569,83 +483,103 @@ EEXXAAMMPPLLEESS
 
         $ sudo shutdown -r +15 "quick reboot"
 
-       To make a usage listing of the directories in the /home
-       partition.  Note that this runs the commands in a sub-
-       shell to make the cd and file redirection work.
+       To make a usage listing of the directories in the /home partition.
+       Note that this runs the commands in a sub-shell to make the cd and file
+       redirection work.
 
         $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
 
 SSEEEE AALLSSOO
-       _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(5),
-       _s_u_d_o_e_r_s(5), _v_i_s_u_d_o(8)
+       _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(4), _s_u_d_o_e_r_s(4),
+       _v_i_s_u_d_o(1m)
 
 AAUUTTHHOORRSS
-       Many people have worked on ssuuddoo over the years; this ver-
-       sion consists of code written primarily by:
+       Many people have worked on ssuuddoo over the years; this version consists
+       of code written primarily by:
 
                Todd C. Miller
 
        See the HISTORY file in the ssuuddoo distribution or visit
+       http://www.sudo.ws/sudo/history.html for a short history of ssuuddoo.
 
+CCAAVVEEAATTSS
+       There is no easy way to prevent a user from gaining a root shell if
+       that user is allowed to run arbitrary commands via ssuuddoo.  Also, many
+       programs (such as editors) allow the user to run commands via shell
+       escapes, thus avoiding ssuuddoo's checks.  However, on most systems it is
+       possible to prevent shell escapes with ssuuddoo's _n_o_e_x_e_c functionality.
+       See the _s_u_d_o_e_r_s(4) manual for details.
 
+       It is not meaningful to run the cd command directly via sudo, e.g.,
 
-1.7                      January  1, 2008                       9
+        $ sudo cd /usr/local/protected
 
+       since when the command exits the parent process (your shell) will still
+       be the same.  Please see the EXAMPLES section for more information.
 
+       If users have sudo ALL there is nothing to prevent them from creating
+       their own program that gives them a root shell regardless of any '!'
+       elements in the user specification.
 
 
 
-SUDO(8)                MAINTENANCE COMMANDS               SUDO(8)
+1.7                      January 21, 2008                       8
 
 
-       http://www.sudo.ws/sudo/history.html for a short history
-       of ssuuddoo.
 
-CCAAVVEEAATTSS
-       There is no easy way to prevent a user from gaining a root
-       shell if that user is allowed to run arbitrary commands
-       via ssuuddoo.  Also, many programs (such as editors) allow the
-       user to run commands via shell escapes, thus avoiding
-       ssuuddoo's checks.  However, on most systems it is possible to
-       prevent shell escapes with ssuuddoo's _n_o_e_x_e_c functionality.
-       See the _s_u_d_o_e_r_s(5) manual for details.
 
-       It is not meaningful to run the cd command directly via
-       sudo, e.g.,
 
-        $ sudo cd /usr/local/protected
-
-       since when the command exits the parent process (your
-       shell) will still be the same.  Please see the EXAMPLES
-       section for more information.
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
-       If users have sudo ALL there is nothing to prevent them
-       from creating their own program that gives them a root
-       shell regardless of any '!' elements in the user specifi-
-       cation.
 
-       Running shell scripts via ssuuddoo can expose the same kernel
-       bugs that make setuid shell scripts unsafe on some operat-
-       ing systems (if your OS has a /dev/fd/ directory, setuid
-       shell scripts are generally safe).
+       Running shell scripts via ssuuddoo can expose the same kernel bugs that
+       make setuid shell scripts unsafe on some operating systems (if your OS
+       has a /dev/fd/ directory, setuid shell scripts are generally safe).
 
 BBUUGGSS
-       If you feel you have found a bug in ssuuddoo, please submit a
-       bug report at http://www.sudo.ws/sudo/bugs/
+       If you feel you have found a bug in ssuuddoo, please submit a bug report at
+       http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail-
-       ing list, see http://www.sudo.ws/mail-
-       man/listinfo/sudo-users to subscribe or search the
-       archives.
+       Limited free support is available via the sudo-users mailing list, see
+       http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
+       the archives.
 
 DDIISSCCLLAAIIMMEERR
-       ssuuddoo is provided ``AS IS'' and any express or implied war-
-       ranties, including, but not limited to, the implied war-
-       ranties of merchantability and fitness for a particular
-       purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
-       plete details.
+       ssuuddoo is provided ``AS IS'' and any express or implied warranties,
+       including, but not limited to, the implied warranties of merchantabil-
+       ity and fitness for a particular purpose are disclaimed.  See the
+       LICENSE file distributed with ssuuddoo or
+       http://www.sudo.ws/sudo/license.html for complete details.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -655,6 +589,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7                      January  1, 2008                      10
+1.7                      January 21, 2008                       9
 
 
diff --git a/sudo.man.in b/sudo.man.in
index 66d6b2eed..b47528ad7 100644
--- a/sudo.man.in
+++ b/sudo.man.in
@@ -150,7 +150,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDO @mansectsu@"
-.TH SUDO @mansectsu@ "January  1, 2008" "1.7" "MAINTENANCE COMMANDS"
+.TH SUDO @mansectsu@ "January 21, 2008" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 sudo, sudoedit \- execute a command as another user
 .SH "SYNOPSIS"
@@ -366,6 +366,11 @@ expanded to the local hostname including the domain name
 .el .IP "\f(CW%h\fR" 4
 .IX Item "%h"
 expanded to the local hostname without the domain name
+.ie n .IP "%p" 4
+.el .IP "\f(CW%p\fR" 4
+.IX Item "%p"
+expanded to the user whose password is being asked for (respects the
+\&\fIrootpw\fR, \fItargetpw\fR and \fIrunaspw\fR flags in \fIsudoers\fR)
 .ie n .IP "%U" 4
 .el .IP "\f(CW%U\fR" 4
 .IX Item "%U"
diff --git a/sudoers.cat b/sudoers.cat
index 41fc4fe8d..8866236c0 100644
--- a/sudoers.cat
+++ b/sudoers.cat
@@ -8,60 +8,60 @@ NNAAMMEE
        sudoers - list of which users may execute what
 
 DDEESSCCRRIIPPTTIIOONN
-       The _s_u_d_o_e_r_s file is composed of two types of entries:
-       aliases (basically variables) and user specifications
-       (which specify who may run what).
+       The _s_u_d_o_e_r_s file is composed of two types of entries: aliases (basi-
+       cally variables) and user specifications (which specify who may run
+       what).
 
-       When multiple entries match for a user, they are applied
-       in order.  Where there are multiple matches, the last
-       match is used (which is not necessarily the most specific
-       match).
+       When multiple entries match for a user, they are applied in order.
+       Where there are multiple matches, the last match is used (which is not
+       necessarily the most specific match).
 
-       The _s_u_d_o_e_r_s grammar will be described below in Extended
-       Backus-Naur Form (EBNF).  Don't despair if you don't know
-       what EBNF is; it is fairly simple, and the definitions
-       below are annotated.
+       The _s_u_d_o_e_r_s grammar will be described below in Extended Backus-Naur
+       Form (EBNF).  Don't despair if you don't know what EBNF is; it is
+       fairly simple, and the definitions below are annotated.
 
        QQuuiicckk gguuiiddee ttoo EEBBNNFF
 
-       EBNF is a concise and exact way of describing the grammar
-       of a language.  Each EBNF definition is made up of _p_r_o_d_u_c_-
-       _t_i_o_n _r_u_l_e_s.  E.g.,
+       EBNF is a concise and exact way of describing the grammar of a lan-
+       guage.  Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s.  E.g.,
 
         symbol ::= definition | alternate1 | alternate2 ...
 
-       Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a
-       grammar for the language.  EBNF also contains the follow-
-       ing operators, which many readers will recognize from reg-
-       ular expressions.  Do not, however, confuse them with
-       "wildcard" characters, which have different meanings.
+       Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a grammar for
+       the language.  EBNF also contains the following operators, which many
+       readers will recognize from regular expressions.  Do not, however, con-
+       fuse them with "wildcard" characters, which have different meanings.
 
-       ?   Means that the preceding symbol (or group of symbols)
-           is optional.  That is, it may appear once or not at
-           all.
+       ?   Means that the preceding symbol (or group of symbols) is optional.
+           That is, it may appear once or not at all.
 
-       *   Means that the preceding symbol (or group of symbols)
-           may appear zero or more times.
+       *   Means that the preceding symbol (or group of symbols) may appear
+           zero or more times.
 
-       +   Means that the preceding symbol (or group of symbols)
-           may appear one or more times.
+       +   Means that the preceding symbol (or group of symbols) may appear
+           one or more times.
 
-       Parentheses may be used to group symbols together.  For
-       clarity, we will use single quotes ('') to designate what
-       is a verbatim character string (as opposed to a symbol
-       name).
+       Parentheses may be used to group symbols together.  For clarity, we
+       will use single quotes ('') to designate what is a verbatim character
+       string (as opposed to a symbol name).
 
        AAlliiaasseess
 
-       There are four kinds of aliases: User_Alias, Runas_Alias,
-       Host_Alias and Cmnd_Alias.
+       There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias
+       and Cmnd_Alias.
 
+        Alias ::= 'User_Alias'  User_Alias (':' User_Alias)* |
+                  'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
+                  'Host_Alias'  Host_Alias (':' Host_Alias)* |
+                  'Cmnd_Alias'  Cmnd_Alias (':' Cmnd_Alias)*
 
+        User_Alias ::= NAME '=' User_List
 
+        Runas_Alias ::= NAME '=' Runas_List
 
 
 
-1.7                     December 10, 2007                       1
+1.7                      January 21, 2008                       1
 
 
 
@@ -70,15 +70,6 @@ DDEESSCCRRIIPPTTIIOONN
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-        Alias ::= 'User_Alias'  User_Alias (':' User_Alias)* |
-                  'Runas_Alias' Runas_Alias (':' Runas_Alias)* |
-                  'Host_Alias'  Host_Alias (':' Host_Alias)* |
-                  'Cmnd_Alias'  Cmnd_Alias (':' Cmnd_Alias)*
-
-        User_Alias ::= NAME '=' User_List
-
-        Runas_Alias ::= NAME '=' Runas_List
-
         Host_Alias ::= NAME '=' Host_List
 
         Cmnd_Alias ::= NAME '=' Cmnd_List
@@ -89,17 +80,15 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
         Alias_Type NAME = item1, item2, ...
 
-       where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias,
-       Host_Alias, or Cmnd_Alias.  A NAME is a string of upper-
-       case letters, numbers, and underscore characters ('_').  A
-       NAME mmuusstt start with an uppercase letter.  It is possible
-       to put several alias definitions of the same type on a
-       single line, joined by a colon (':').  E.g.,
+       where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias, Host_Alias, or
+       Cmnd_Alias.  A NAME is a string of uppercase letters, numbers, and
+       underscore characters ('_').  A NAME mmuusstt start with an uppercase let-
+       ter.  It is possible to put several alias definitions of the same type
+       on a single line, joined by a colon (':').  E.g.,
 
         Alias_Type NAME = item1, item2, item3 : NAME = item4, item5
 
-       The definitions of what constitutes a valid _a_l_i_a_s member
-       follow.
+       The definitions of what constitutes a valid _a_l_i_a_s member follow.
 
         User_List ::= User |
                       User ',' User_List
@@ -110,24 +99,35 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                  '!'* '+'netgroup |
                  '!'* User_Alias
 
-       A User_List is made up of one or more usernames, uids
-       (prefixed with '#'), system groups (prefixed with '%'),
-       netgroups (prefixed with '+') and User_Aliases.  Each list
-       item may be prefixed with zero or more '!' operators.  An
-       odd number of '!' operators negate the value of the item;
-       an even number just cancel each other out.
+       A User_List is made up of one or more usernames, uids (prefixed with
+       '#'), system groups (prefixed with '%'), netgroups (prefixed with '+')
+       and User_Aliases.  Each list item may be prefixed with zero or more '!'
+       operators.  An odd number of '!' operators negate the value of the
+       item; an even number just cancel each other out.
 
         Runas_List ::= Runas_Member |
                        Runas_Member ',' Runas_List
 
+        Runas_Member ::= '!'* username |
+                         '!'* '#'uid |
+                         '!'* '%'group |
+                         '!'* +netgroup |
+                         '!'* Runas_Alias
 
+       A Runas_List is similar to a User_List except that instead of
+       User_Aliases it can contain Runas_Aliases.  Note that usernames and
+       groups are matched as strings.  In other words, two users (groups) with
+       the same uid (gid) are considered to be distinct.  If you wish to match
+       all usernames with the same uid (e.g. root and toor), you can use a uid
+       instead (#0 in the example given).
 
+        Host_List ::= Host |
+                      Host ',' Host_List
 
 
 
 
-
-1.7                     December 10, 2007                       2
+1.7                      January 21, 2008                       2
 
 
 
@@ -136,44 +136,24 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-        Runas_Member ::= '!'* username |
-                         '!'* '#'uid |
-                         '!'* '%'group |
-                         '!'* +netgroup |
-                         '!'* Runas_Alias
-
-       A Runas_List is similar to a User_List except that instead
-       of User_Aliases it can contain Runas_Aliases.  Note that
-       usernames and groups are matched as strings.  In other
-       words, two users (groups) with the same uid (gid) are con-
-       sidered to be distinct.  If you wish to match all user-
-       names with the same uid (e.g. root and toor), you can use
-       a uid instead (#0 in the example given).
-
-        Host_List ::= Host |
-                      Host ',' Host_List
-
         Host ::= '!'* hostname |
                  '!'* ip_addr |
                  '!'* network(/netmask)? |
                  '!'* '+'netgroup |
                  '!'* Host_Alias
 
-       A Host_List is made up of one or more hostnames, IP
-       addresses, network numbers, netgroups (prefixed with '+')
-       and other aliases.  Again, the value of an item may be
-       negated with the '!' operator.  If you do not specify a
-       netmask along with the network number, ssuuddoo will query
-       each of the local host's network interfaces and, if the
-       network number corresponds to one of the hosts's network
-       interfaces, the corresponding netmask will be used.  The
-       netmask may be specified either in standard IP address
-       notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
-       CIDR notation (number of bits, e.g. 24 or 64).  A hostname
-       may include shell-style wildcards (see the Wildcards sec-
-       tion below), but unless the hostname command on your
-       machine returns the fully qualified hostname, you'll need
-       to use the _f_q_d_n option for wildcards to be useful.
+       A Host_List is made up of one or more hostnames, IP addresses, network
+       numbers, netgroups (prefixed with '+') and other aliases.  Again, the
+       value of an item may be negated with the '!' operator.  If you do not
+       specify a netmask along with the network number, ssuuddoo will query each
+       of the local host's network interfaces and, if the network number cor-
+       responds to one of the hosts's network interfaces, the corresponding
+       netmask will be used.  The netmask may be specified either in standard
+       IP address notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
+       CIDR notation (number of bits, e.g. 24 or 64).  A hostname may include
+       shell-style wildcards (see the Wildcards section below), but unless the
+       hostname command on your machine returns the fully qualified hostname,
+       you'll need to use the _f_q_d_n option for wildcards to be useful.
 
         Cmnd_List ::= Cmnd |
                       Cmnd ',' Cmnd_List
@@ -187,52 +167,46 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                  '!'* "sudoedit" |
                  '!'* Cmnd_Alias
 
-       A Cmnd_List is a list of one or more commandnames, direc-
-       tories, and other aliases.  A commandname is a fully qual-
-       ified filename which may include shell-style wildcards
+       A Cmnd_List is a list of one or more commandnames, directories, and
+       other aliases.  A commandname is a fully qualified filename which may
+       include shell-style wildcards (see the Wildcards section below).  A
+       simple filename allows the user to run the command with any arguments
+       he/she wishes.  However, you may also specify command line arguments
+       (including wildcards).  Alternately, you can specify "" to indicate
+       that the command may only be run wwiitthhoouutt command line arguments.  A
+       directory is a fully qualified pathname ending in a '/'.  When you
+       specify a directory in a Cmnd_List, the user will be able to run any
+       file within that directory (but not in any subdirectories therein).
+
+       If a Cmnd has associated command line arguments, then the arguments in
+       the Cmnd must match exactly those given by the user on the command line
+       (or match the wildcards if there are any).  Note that the following
+       characters must be escaped with a '\' if they are used in command argu-
+       ments: ',', ':', '=', '\'.  The special command "sudoedit" is used to
+       permit a user to run ssuuddoo with the --ee flag (or as ssuuddooeeddiitt).  It may
+       take command line arguments just as a normal command does.
 
+       DDeeffaauullttss
 
+       Certain configuration options may be changed from their default values
+       at runtime via one or more Default_Entry lines.  These may affect all
 
-1.7                     December 10, 2007                       3
 
 
+1.7                      January 21, 2008                       3
 
 
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       (see the Wildcards section below).  A simple filename
-       allows the user to run the command with any arguments
-       he/she wishes.  However, you may also specify command line
-       arguments (including wildcards).  Alternately, you can
-       specify "" to indicate that the command may only be run
-       wwiitthhoouutt command line arguments.  A directory is a fully
-       qualified pathname ending in a '/'.  When you specify a
-       directory in a Cmnd_List, the user will be able to run any
-       file within that directory (but not in any subdirectories
-       therein).
-
-       If a Cmnd has associated command line arguments, then the
-       arguments in the Cmnd must match exactly those given by
-       the user on the command line (or match the wildcards if
-       there are any).  Note that the following characters must
-       be escaped with a '\' if they are used in command argu-
-       ments: ',', ':', '=', '\'.  The special command "sudoedit"
-       is used to permit a user to run ssuuddoo with the --ee flag (or
-       as ssuuddooeeddiitt).  It may take command line arguments just as
-       a normal command does.
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-       DDeeffaauullttss
 
-       Certain configuration options may be changed from their
-       default values at runtime via one or more Default_Entry
-       lines.  These may affect all users on any host, all users
-       on a specific host, a specific user, a specific command,
-       or commands being run as a specific user.  Note that per-
-       command entries may not include command line arguments.
-       If you need to specify arguments, define a Cmnd_Alias and
-       reference that instead.
+       users on any host, all users on a specific host, a specific user, a
+       specific command, or commands being run as a specific user.  Note that
+       per-command entries may not include command line arguments.  If you
+       need to specify arguments, define a Cmnd_Alias and reference that
+       instead.
 
         Default_Type ::= 'Defaults' |
                          'Defaults' '@' Host_List |
@@ -250,33 +224,19 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                       Parameter '-=' Value |
                       '!'* Parameter
 
-       Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or
-       lliissttss.  Flags are implicitly boolean and can be turned off
-       via the '!'  operator.  Some integer, string and list
-       parameters may also be used in a boolean context to dis-
-       able them.  Values may be enclosed in double quotes (")
-       when they contain multiple words.  Special characters may
-
-
-
-1.7                     December 10, 2007                       4
-
-
+       Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or lliissttss.  Flags are
+       implicitly boolean and can be turned off via the '!'  operator.  Some
+       integer, string and list parameters may also be used in a boolean con-
+       text to disable them.  Values may be enclosed in double quotes (") when
+       they contain multiple words.  Special characters may be escaped with a
+       backslash (\).
 
+       Lists have two additional assignment operators, += and -=.  These oper-
+       ators are used to add to and delete from a list respectively.  It is
+       not an error to use the -= operator to remove an element that does not
+       exist in a list.
 
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
-       be escaped with a backslash (\).
-
-       Lists have two additional assignment operators, += and -=.
-       These operators are used to add to and delete from a list
-       respectively.  It is not an error to use the -= operator
-       to remove an element that does not exist in a list.
-
-       See "SUDOERS OPTIONS" for a list of supported Defaults
-       parameters.
+       See "SUDOERS OPTIONS" for a list of supported Defaults parameters.
 
        UUsseerr SSppeecciiffiiccaattiioonn
 
@@ -293,189 +253,174 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
                       'SETENV:' | 'NOSETENV:' )
 
-       A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may
-       run (and as what user) on specified hosts.  By default,
-       commands are run as rroooott, but this can be changed on a
-       per-command basis.
-
-       Let's break that down into its constituent parts:
-
-       RRuunnaass__SSppeecc
+       A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may run (and as
+       what user) on specified hosts.  By default, commands are run as rroooott,
+       but this can be changed on a per-command basis.
 
-       A Runas_Spec determines the user and/or the group that a
-       command may be run as.  A fully-specified Runas_Spec con-
-       sists of two Runas_Lists (as defined above) separated by a
-       colon (':') and enclosed in a set of parentheses.  The
-       first Runas_List indicates which users the command may be
-       run as via ssuuddoo's --uu flag.  The second defines a list of
-       groups that can be specified via ssuuddoo's --gg flag.  If both
-       Runas_Lists are specified, the command may be run with any
-       combination of users and groups listed in their respective
-       Runas_Lists.  If only the first is specified, the command
-       may be run as any user in the list but no --gg flag may be
-       specified.  If the first Runas_List is empty but the sec-
-       ond is specified, the command may be run as the invoking
-       user with the group set to any listed in the Runas_List.
-       If no Runas_Spec is specified the command may be run as
-       rroooott and no group may be specified.
 
-       A Runas_Spec sets the default for the commands that follow
-       it.  What this means is that for the entry:
 
+1.7                      January 21, 2008                       4
 
 
 
-1.7                     December 10, 2007                       5
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       Let's break that down into its constituent parts:
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       RRuunnaass__SSppeecc
 
+       A Runas_Spec determines the user and/or the group that a command may be
+       run as.  A fully-specified Runas_Spec consists of two Runas_Lists (as
+       defined above) separated by a colon (':') and enclosed in a set of
+       parentheses.  The first Runas_List indicates which users the command
+       may be run as via ssuuddoo's --uu flag.  The second defines a list of groups
+       that can be specified via ssuuddoo's --gg flag.  If both Runas_Lists are
+       specified, the command may be run with any combination of users and
+       groups listed in their respective Runas_Lists.  If only the first is
+       specified, the command may be run as any user in the list but no --gg
+       flag may be specified.  If the first Runas_List is empty but the second
+       is specified, the command may be run as the invoking user with the
+       group set to any listed in the Runas_List.  If no Runas_Spec is speci-
+       fied the command may be run as rroooott and no group may be specified.
+
+       A Runas_Spec sets the default for the commands that follow it.  What
+       this means is that for the entry:
 
         dgb    boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
 
-       The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m
-       -- but only as ooppeerraattoorr.  E.g.,
+       The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m -- but only
+       as ooppeerraattoorr.  E.g.,
 
         $ sudo -u operator /bin/ls.
 
-       It is also possible to override a Runas_Spec later on in
-       an entry.  If we modify the entry like so:
+       It is also possible to override a Runas_Spec later on in an entry.  If
+       we modify the entry like so:
 
         dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
 
-       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr,
-       but  _/_b_i_n_/_k_i_l_l and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
+       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
+       and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
 
-       We can extend this to allow ddggbb to run /bin/ls with either
-       the user or group set to ooppeerraattoorr:
+       We can extend this to allow ddggbb to run /bin/ls with either the user or
+       group set to ooppeerraattoorr:
 
         dgb    boulder = (operator : operator) /bin/ls, (root) /bin/kill, \
                /usr/bin/lprm
 
-       In the following example, user ttccmm may run commands that
-       access a modem device file with the dialer group.  Note
-       that in this example only the group will be set, the com-
-       mand still runs as user ttccmm.
+       In the following example, user ttccmm may run commands that access a modem
+       device file with the dialer group.  Note that in this example only the
+       group will be set, the command still runs as user ttccmm.
 
         tcm    boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
                /usr/local/bin/minicom
 
        TTaagg__SSppeecc
 
-       A command may have zero or more tags associated with it.
-       There are eight possible tag values, NOPASSWD, PASSWD,
-       NOEXEC, EXEC, SETENV and NOSETENV.  Once a tag is set on a
-       Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the
-       tag unless it is overridden by the opposite tag (i.e.:
-       PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
+       A command may have zero or more tags associated with it.  There are
+       eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV and
+       NOSETENV.  Once a tag is set on a Cmnd, subsequent Cmnds in the
 
-       _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
 
-       By default, ssuuddoo requires that a user authenticate him or
-       herself before running a command.  This behavior can be
-       modified via the NOPASSWD tag.  Like a Runas_Spec, the
-       NOPASSWD tag sets a default for the commands that follow
-       it in the Cmnd_Spec_List.  Conversely, the PASSWD tag can
-       be used to reverse things.  For example:
 
-        ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
+1.7                      January 21, 2008                       5
 
-       would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and
-       _/_u_s_r_/_b_i_n_/_l_p_r_m as root on the machine rushmore as rroooott
-       without authenticating himself.  If we only want rraayy to be
-       able to run _/_b_i_n_/_k_i_l_l without a password the entry would
-       be:
 
 
 
-1.7                     December 10, 2007                       6
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       Cmnd_Spec_List, inherit the tag unless it is overridden by the opposite
+       tag (i.e.: PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
 
+       _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       By default, ssuuddoo requires that a user authenticate him or herself
+       before running a command.  This behavior can be modified via the
+       NOPASSWD tag.  Like a Runas_Spec, the NOPASSWD tag sets a default for
+       the commands that follow it in the Cmnd_Spec_List.  Conversely, the
+       PASSWD tag can be used to reverse things.  For example:
+
+        ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
 
+       would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and _/_u_s_r_/_b_i_n_/_l_p_r_m
+       as root on the machine rushmore as rroooott without authenticating himself.
+       If we only want rraayy to be able to run _/_b_i_n_/_k_i_l_l without a password the
+       entry would be:
 
         ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
 
-       Note, however, that the PASSWD tag has no effect on users
-       who are in the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
+       Note, however, that the PASSWD tag has no effect on users who are in
+       the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
 
-       By default, if the NOPASSWD tag is applied to any of the
-       entries for a user on the current host, he or she will be
-       able to run sudo -l without a password.  Additionally, a
-       user may only run sudo -v without a password if the
-       NOPASSWD tag is present for all a user's entries that per-
-       tain to the current host.  This behavior may be overridden
-       via the verifypw and listpw options.
+       By default, if the NOPASSWD tag is applied to any of the entries for a
+       user on the current host, he or she will be able to run sudo -l without
+       a password.  Additionally, a user may only run sudo -v without a pass-
+       word if the NOPASSWD tag is present for all a user's entries that per-
+       tain to the current host.  This behavior may be overridden via the ver-
+       ifypw and listpw options.
 
        _N_O_E_X_E_C _a_n_d _E_X_E_C
 
-       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the
-       underlying operating system supports it, the NOEXEC tag
-       can be used to prevent a dynamically-linked executable
-       from running further commands itself.
+       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying oper-
+       ating system supports it, the NOEXEC tag can be used to prevent a
+       dynamically-linked executable from running further commands itself.
 
-       In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e
-       and _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
+       In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
+       _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
 
         aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 
-       See the "PREVENTING SHELL ESCAPES" section below for more
-       details on how NOEXEC works and whether or not it will
-       work on your system.
+       See the "PREVENTING SHELL ESCAPES" section below for more details on
+       how NOEXEC works and whether or not it will work on your system.
 
        _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
 
-       These tags override the value of the _s_e_t_e_n_v option on a
-       per-command basis.  Note that if SETENV has been set for a
-       command, any environment variables set on the command line
-       way are not subject to the restrictions imposed by
-       _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only trusted
-       users should be allowed to set variables in this manner.
-       If the command matched is AALLLL, the SETENV tag is implied
-       for that command; this default may be overridden by use of
-       the UNSETENV tag.
+       These tags override the value of the _s_e_t_e_n_v option on a per-command
+       basis.  Note that if SETENV has been set for a command, any environment
+       variables set on the command line way are not subject to the restric-
+       tions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only
+       trusted users should be allowed to set variables in this manner.  If
+       the command matched is AALLLL, the SETENV tag is implied for that command;
+       this default may be overridden by use of the UNSETENV tag.
 
-       WWiillddccaarrddss
 
-       ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob char-
-       acters) to be used in pathnames as well as command line
-       arguments in the _s_u_d_o_e_r_s file.  Wildcard matching is done
-       via the PPOOSSIIXX _f_n_m_a_t_c_h(3) routine.  Note that these are _n_o_t
-       regular expressions.
 
-       *       Matches any set of zero or more characters.
 
-       ?       Matches any single character.
+1.7                      January 21, 2008                       6
 
-       [...]   Matches any character in the specified range.
 
 
 
-1.7                     December 10, 2007                       7
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       WWiillddccaarrddss
 
+       ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be
+       used in pathnames as well as command line arguments in the _s_u_d_o_e_r_s
+       file.  Wildcard matching is done via the PPOOSSIIXX _f_n_m_a_t_c_h(3) routine.
+       Note that these are _n_o_t regular expressions.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       *       Matches any set of zero or more characters.
+
+       ?       Matches any single character.
 
+       [...]   Matches any character in the specified range.
 
        [!...]  Matches any character nnoott in the specified range.
 
-       \x      For any character "x", evaluates to "x".  This is
-               used to escape special characters such as: "*",
-               "?", "[", and "}".
+       \x      For any character "x", evaluates to "x".  This is used to
+               escape special characters such as: "*", "?", "[", and "}".
 
-       Note that a forward slash ('/') will nnoott be matched by
-       wildcards used in the pathname.  When matching the command
-       line arguments, however, a slash ddooeess get matched by wild-
-       cards.  This is to make a path like:
+       Note that a forward slash ('/') will nnoott be matched by wildcards used
+       in the pathname.  When matching the command line arguments, however, a
+       slash ddooeess get matched by wildcards.  This is to make a path like:
 
            /usr/bin/*
 
@@ -485,45 +430,34 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        The following exceptions apply to the above rules:
 
-       ""      If the empty string "" is the only command line
-               argument in the _s_u_d_o_e_r_s entry it means that com-
-               mand is not allowed to be run with aannyy arguments.
+       ""      If the empty string "" is the only command line argument in the
+               _s_u_d_o_e_r_s entry it means that command is not allowed to be run
+               with aannyy arguments.
 
        IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
 
-       It is possible to include other _s_u_d_o_e_r_s files from within
-       the _s_u_d_o_e_r_s file currently being parsed using the #include
-       directive, similar to the one used by the C preprocessor.
-       This is useful, for example, for keeping a site-wide _s_u_d_o_-
-       _e_r_s file in addition to a per-machine local one.  For the
-       sake of this example the site-wide _s_u_d_o_e_r_s will be
-       _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will be _/_e_t_c_/_s_u_d_o_-
-       _e_r_s_._l_o_c_a_l.  To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from _/_e_t_c_/_s_u_d_o_-
-       _e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
+       It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s
+       file currently being parsed using the #include directive, similar to
+       the one used by the C preprocessor.  This is useful, for example, for
+       keeping a site-wide _s_u_d_o_e_r_s file in addition to a per-machine local
+       one.  For the sake of this example the site-wide _s_u_d_o_e_r_s will be
+       _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will be _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.  To
+       include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from _/_e_t_c_/_s_u_d_o_e_r_s we would use the following
+       line in _/_e_t_c_/_s_u_d_o_e_r_s:
 
         #include /etc/sudoers.local
 
-       When ssuuddoo reaches this line it will suspend processing of
-       the current file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_-
-       _e_r_s_._l_o_c_a_l.  Upon reaching the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l,
-       the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be processed.  Files that
-       are included may themselves include other files.  A hard
-       limit of 128 nested include files is enforced to prevent
-       include file loops.
-
-       OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
-
-       The pound sign ('#') is used to indicate a comment (unless
-       it is part of a #include directive or unless it occurs in
-       the context of a user name and is followed by one or more
-       digits, in which case it is treated as a uid).  Both the
-       comment character and any text after it, up to the end of
-       the line, are ignored.
+       When ssuuddoo reaches this line it will suspend processing of the current
+       file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l.  Upon reaching
+       the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l, the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be pro-
+       cessed.  Files that are included may themselves include other files.  A
+       hard limit of 128 nested include files is enforced to prevent include
+       file loops.
 
 
 
 
-1.7                     December 10, 2007                       8
+1.7                      January 21, 2008                       7
 
 
 
@@ -532,64 +466,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       The reserved word AALLLL is a built-in _a_l_i_a_s that always
-       causes a match to succeed.  It can be used wherever one
-       might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
-       or Host_Alias.  You should not try to define your own
-       _a_l_i_a_s called AALLLL as the built-in alias will be used in
-       preference to your own.  Please note that using AALLLL can be
-       dangerous since in a command context, it allows the user
-       to run aannyy command on the system.
-
-       An exclamation point ('!') can be used as a logical _n_o_t
-       operator both in an _a_l_i_a_s and in front of a Cmnd.  This
-       allows one to exclude certain values.  Note, however, that
-       using a ! in conjunction with the built-in ALL alias to
-       allow a user to run "all but a few" commands rarely works
+       OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
+
+       The pound sign ('#') is used to indicate a comment (unless it is part
+       of a #include directive or unless it occurs in the context of a user
+       name and is followed by one or more digits, in which case it is treated
+       as a uid).  Both the comment character and any text after it, up to the
+       end of the line, are ignored.
+
+       The reserved word AALLLL is a built-in _a_l_i_a_s that always causes a match to
+       succeed.  It can be used wherever one might otherwise use a Cmnd_Alias,
+       User_Alias, Runas_Alias, or Host_Alias.  You should not try to define
+       your own _a_l_i_a_s called AALLLL as the built-in alias will be used in prefer-
+       ence to your own.  Please note that using AALLLL can be dangerous since in
+       a command context, it allows the user to run aannyy command on the system.
+
+       An exclamation point ('!') can be used as a logical _n_o_t operator both
+       in an _a_l_i_a_s and in front of a Cmnd.  This allows one to exclude certain
+       values.  Note, however, that using a ! in conjunction with the built-in
+       ALL alias to allow a user to run "all but a few" commands rarely works
        as intended (see SECURITY NOTES below).
 
-       Long lines can be continued with a backslash ('\') as the
-       last character on the line.
+       Long lines can be continued with a backslash ('\') as the last charac-
+       ter on the line.
 
-       Whitespace between elements in a list as well as special
-       syntactic characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':',
-       '(', ')') is optional.
+       Whitespace between elements in a list as well as special syntactic
+       characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':', '(', ')') is optional.
 
-       The following characters must be escaped with a backslash
-       ('\') when used as part of a word (e.g. a username or
-       hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
+       The following characters must be escaped with a backslash ('\') when
+       used as part of a word (e.g. a username or hostname): '@', '!', '=',
+       ':', ',', '(', ')', '\'.
 
 SSUUDDOOEERRSS OOPPTTIIOONNSS
-       ssuuddoo's behavior can be modified by Default_Entry lines, as
-       explained earlier.  A list of all supported Defaults
-       parameters, grouped by type, are listed below.
+       ssuuddoo's behavior can be modified by Default_Entry lines, as explained
+       earlier.  A list of all supported Defaults parameters, grouped by type,
+       are listed below.
 
        FFllaaggss:
 
-       always_set_home If set, ssuuddoo will set the HOME environment
-                       variable to the home directory of the tar-
-                       get user (which is root unless the --uu
-                       option is used).  This effectively means
-                       that the --HH flag is always implied.  This
-                       flag is _o_f_f by default.
-
-       authenticate    If set, users must authenticate themselves
-                       via a password (or other means of authen-
-                       tication) before they may run commands.
-                       This default may be overridden via the
-                       PASSWD and NOPASSWD tags.  This flag is _o_n
+       always_set_home If set, ssuuddoo will set the HOME environment variable to
+                       the home directory of the target user (which is root
+                       unless the --uu option is used).  This effectively means
+                       that the --HH flag is always implied.  This flag is _o_f_f
                        by default.
 
-       closefrom_override
-                       If set, the user may use ssuuddoo's --CC option
-                       which overrides the default starting point
-                       at which ssuuddoo begins closing open file
-                       descriptors.  This flag is _o_f_f by default.
+       authenticate    If set, users must authenticate themselves via a pass-
+                       word (or other means of authentication) before they may
+                       run commands.  This default may be overridden via the
+                       PASSWD and NOPASSWD tags.  This flag is _o_n by default.
 
+       closefrom_override
+                       If set, the user may use ssuuddoo's --CC option which over-
+                       rides the default starting point at which ssuuddoo begins
+                       closing open file descriptors.  This flag is _o_f_f by
+                       default.
 
 
 
-1.7                     December 10, 2007                       9
+1.7                      January 21, 2008                       8
 
 
 
@@ -598,64 +532,64 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       env_editor      If set, vviissuuddoo will use the value of the
-                       EDITOR or VISUAL environment variables
-                       before falling back on the default editor
-                       list.  Note that this may create a secu-
-                       rity hole as it allows the user to run any
-                       arbitrary command as root without logging.
-                       A safer alternative is to place a colon-
-                       separated list of editors in the editor
-                       variable.  vviissuuddoo will then only use the
-                       EDITOR or VISUAL if they match a value
-                       specified in editor.  This flag is _o_f_f by
-                       default.
+       env_editor      If set, vviissuuddoo will use the value of the EDITOR or
+                       VISUAL environment variables before falling back on the
+                       default editor list.  Note that this may create a secu-
+                       rity hole as it allows the user to run any arbitrary
+                       command as root without logging.  A safer alternative
+                       is to place a colon-separated list of editors in the
+                       editor variable.  vviissuuddoo will then only use the EDITOR
+                       or VISUAL if they match a value specified in editor.
+                       This flag is _o_f_f by default.
 
-       env_reset       If set, ssuuddoo will reset the environment to
-                       only contain the LOGNAME, SHELL, USER,
-                       USERNAME and the SUDO_* variables.  Any
-                       variables in the caller's environment that
-                       match the env_keep and env_check lists are
-                       then added.  The default contents of the
-                       env_keep and env_check lists are displayed
-                       when ssuuddoo is run by root with the _-_V
-                       option.  If the _s_e_c_u_r_e___p_a_t_h option is set,
-                       its value will be used for the PATH envi-
-                       ronment variable.  This flag is _o_n by
-                       default.
+       env_reset       If set, ssuuddoo will reset the environment to only contain
+                       the LOGNAME, SHELL, USER, USERNAME and the SUDO_* vari-
+                       ables.  Any variables in the caller's environment that
+                       match the env_keep and env_check lists are then added.
+                       The default contents of the env_keep and env_check
+                       lists are displayed when ssuuddoo is run by root with the
+                       _-_V option.  If the _s_e_c_u_r_e___p_a_t_h option is set, its value
+                       will be used for the PATH environment variable.  This
+                       flag is _o_n by default.
+
+       fqdn            Set this flag if you want to put fully qualified host-
+                       names in the _s_u_d_o_e_r_s file.  I.e., instead of myhost you
+                       would use myhost.mydomain.edu.  You may still use the
+                       short form if you wish (and even mix the two).  Beware
+                       that turning on _f_q_d_n requires ssuuddoo to make DNS lookups
+                       which may make ssuuddoo unusable if DNS stops working (for
+                       example if the machine is not plugged into the net-
+                       work).  Also note that you must use the host's official
+                       name as DNS knows it.  That is, you may not use a host
+                       alias (CNAME entry) due to performance issues and the
+                       fact that there is no way to get all aliases from DNS.
+                       If your machine's hostname (as returned by the hostname
+                       command) is already fully qualified you shouldn't need
+                       to set _f_q_d_n.  This flag is _o_f_f by default.
+
+       ignore_dot      If set, ssuuddoo will ignore '.' or '' (current dir) in the
+                       PATH environment variable; the PATH itself is not modi-
+                       fied.  This flag is _o_f_f by default.
 
-       fqdn            Set this flag if you want to put fully
-                       qualified hostnames in the _s_u_d_o_e_r_s file.
-                       I.e., instead of myhost you would use
-                       myhost.mydomain.edu.  You may still use
-                       the short form if you wish (and even mix
-                       the two).  Beware that turning on _f_q_d_n
-                       requires ssuuddoo to make DNS lookups which
-                       may make ssuuddoo unusable if DNS stops work-
-                       ing (for example if the machine is not
-                       plugged into the network).  Also note that
-                       you must use the host's official name as
-                       DNS knows it.  That is, you may not use a
-                       host alias (CNAME entry) due to perfor-
-                       mance issues and the fact that there is no
-                       way to get all aliases from DNS.  If your
-                       machine's hostname (as returned by the
-                       hostname command) is already fully quali-
-                       fied you shouldn't need to set _f_q_d_n.  This
+       ignore_local_sudoers
+                       If set via LDAP, parsing of @sysconfdir@/sudoers will
+                       be skipped.  This is intended for Enterprises that wish
+                       to prevent the usage of local sudoers files so that
+                       only LDAP is used.  This thwarts the efforts of rogue
+                       operators who would attempt to add roles to
+                       @sysconfdir@/sudoers.  When this option is present,
+                       @sysconfdir@/sudoers does not even need to exist.
+                       Since this option tells ssuuddoo how to behave when no spe-
+                       cific LDAP entries have been matched, this sudoOption
+                       is only meaningful for the cn=defaults section.  This
                        flag is _o_f_f by default.
 
-       ignore_dot      If set, ssuuddoo will ignore '.' or '' (cur-
-                       rent dir) in the PATH environment vari-
-                       able; the PATH itself is not modified.
-                       This flag is _o_f_f by default.
-
-       ignore_local_sudoers
-                       If set via LDAP, parsing of
-                       @sysconfdir@/sudoers will be skipped.
+       insults         If set, ssuuddoo will insult users when they enter an
+                       incorrect password.  This flag is _o_f_f by default.
 
 
 
-1.7                     December 10, 2007                      10
+1.7                      January 21, 2008                       9
 
 
 
@@ -664,64 +598,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       This is intended for Enterprises that wish
-                       to prevent the usage of local sudoers
-                       files so that only LDAP is used.  This
-                       thwarts the efforts of rogue operators who
-                       would attempt to add roles to
-                       @sysconfdir@/sudoers.  When this option is
-                       present, @sysconfdir@/sudoers does not
-                       even need to exist.  Since this option
-                       tells ssuuddoo how to behave when no specific
-                       LDAP entries have been matched, this
-                       sudoOption is only meaningful for the
-                       cn=defaults section.  This flag is _o_f_f by
+       log_host        If set, the hostname will be logged in the (non-syslog)
+                       ssuuddoo log file.  This flag is _o_f_f by default.
+
+       log_year        If set, the four-digit year will be logged in the
+                       (non-syslog) ssuuddoo log file.  This flag is _o_f_f by
                        default.
 
-       insults         If set, ssuuddoo will insult users when they
-                       enter an incorrect password.  This flag is
-                       _o_f_f by default.
+       long_otp_prompt When validating with a One Time Password (OPT) scheme
+                       such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to
+                       make it easier to cut and paste the challenge to a
+                       local window.  It's not as pretty as the default but
+                       some people find it more convenient.  This flag is _o_f_f
+                       by default.
 
-       log_host        If set, the hostname will be logged in the
-                       (non-syslog) ssuuddoo log file.  This flag is
-                       _o_f_f by default.
+       mail_always     Send mail to the _m_a_i_l_t_o user every time a users runs
+                       ssuuddoo.  This flag is _o_f_f by default.
 
-       log_year        If set, the four-digit year will be logged
-                       in the (non-syslog) ssuuddoo log file.  This
-                       flag is _o_f_f by default.
+       mail_badpass    Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
+                       does not enter the correct password.  This flag is _o_f_f
+                       by default.
 
-       long_otp_prompt When validating with a One Time Password
-                       (OPT) scheme such as SS//KKeeyy or OOPPIIEE, a two-
-                       line prompt is used to make it easier to
-                       cut and paste the challenge to a local
-                       window.  It's not as pretty as the default
-                       but some people find it more convenient.
-                       This flag is _o_f_f by default.
+       mail_no_host    If set, mail will be sent to the _m_a_i_l_t_o user if the
+                       invoking user exists in the _s_u_d_o_e_r_s file, but is not
+                       allowed to run commands on the current host.  This flag
+                       is _o_f_f by default.
 
-       mail_always     Send mail to the _m_a_i_l_t_o user every time a
-                       users runs ssuuddoo.  This flag is _o_f_f by
+       mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o user if the
+                       invoking user is allowed to use ssuuddoo but the command
+                       they are trying is not listed in their _s_u_d_o_e_r_s file
+                       entry or is explicitly denied.  This flag is _o_f_f by
                        default.
 
-       mail_badpass    Send mail to the _m_a_i_l_t_o user if the user
-                       running ssuuddoo does not enter the correct
-                       password.  This flag is _o_f_f by default.
-
-       mail_no_host    If set, mail will be sent to the _m_a_i_l_t_o
-                       user if the invoking user exists in the
-                       _s_u_d_o_e_r_s file, but is not allowed to run
-                       commands on the current host.  This flag
-                       is _o_f_f by default.
+       mail_no_user    If set, mail will be sent to the _m_a_i_l_t_o user if the
+                       invoking user is not in the _s_u_d_o_e_r_s file.  This flag is
+                       _o_n by default.
+
+       noexec          If set, all commands run via ssuuddoo will behave as if the
+                       NOEXEC tag has been set, unless overridden by a EXEC
+                       tag.  See the description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
+                       well as the "PREVENTING SHELL ESCAPES" section at the
+                       end of this manual.  This flag is _o_f_f by default.
+
+       path_info       Normally, ssuuddoo will tell the user when a command could
+                       not be found in their PATH environment variable.  Some
+                       sites may wish to disable this as it could be used to
+                       gather information on the location of executables that
+                       the normal user does not have access to.  The disadvan-
+                       tage is that if the executable is simply not in the
+                       user's PATH, ssuuddoo will tell the user that they are not
+                       allowed to run it, which can be confusing.  This flag
+                       is _o_n by default.
 
-       mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o
-                       user if the invoking user is allowed to
-                       use ssuuddoo but the command they are trying
-                       is not listed in their _s_u_d_o_e_r_s file entry
-                       or is explicitly denied.  This flag is _o_f_f
-                       by default.
+       passprompt_override
+                       The password prompt specified by _p_a_s_s_p_r_o_m_p_t will
 
 
 
-1.7                     December 10, 2007                      11
+1.7                      January 21, 2008                      10
 
 
 
@@ -730,130 +664,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       mail_no_user    If set, mail will be sent to the _m_a_i_l_t_o
-                       user if the invoking user is not in the
-                       _s_u_d_o_e_r_s file.  This flag is _o_n by default.
+                       normally only be used if the passwod prompt provided by
+                       systems such as PAM matches the string "Password:".  If
+                       _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set, _p_a_s_s_p_r_o_m_p_t will always be
+                       used.  This flag is _o_f_f by default.
 
-       noexec          If set, all commands run via ssuuddoo will
-                       behave as if the NOEXEC tag has been set,
-                       unless overridden by a EXEC tag.  See the
-                       description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
-                       well as the "PREVENTING SHELL ESCAPES"
-                       section at the end of this manual.  This
+       preserve_groups By default ssuuddoo will initialize the group vector to the
+                       list of groups the target user is in.  When _p_r_e_-
+                       _s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group vector
+                       is left unaltered.  The real and effective group IDs,
+                       however, are still set to match the target user.  This
                        flag is _o_f_f by default.
 
-       path_info       Normally, ssuuddoo will tell the user when a
-                       command could not be found in their PATH
-                       environment variable.  Some sites may wish
-                       to disable this as it could be used to
-                       gather information on the location of exe-
-                       cutables that the normal user does not
-                       have access to.  The disadvantage is that
-                       if the executable is simply not in the
-                       user's PATH, ssuuddoo will tell the user that
-                       they are not allowed to run it, which can
-                       be confusing.  This flag is _o_n by default.
-
-       passprompt_override
-                       The password prompt specified by
-                       _p_a_s_s_p_r_o_m_p_t will normally only be used if
-                       the passwod prompt provided by systems
-                       such as PAM matches the string "Pass-
-                       word:".  If _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e is set,
-                       _p_a_s_s_p_r_o_m_p_t will always be used.  This flag
-                       is _o_f_f by default.
-
-       preserve_groups By default ssuuddoo will initialize the group
-                       vector to the list of groups the target
-                       user is in.  When _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set,
-                       the user's existing group vector is left
-                       unaltered.  The real and effective group
-                       IDs, however, are still set to match the
-                       target user.  This flag is _o_f_f by default.
-
-       requiretty      If set, ssuuddoo will only run when the user
-                       is logged in to a real tty.  This will
-                       disallow things like "rsh somehost sudo
-                       ls" since _r_s_h(1) does not allocate a tty.
-                       Because it is not possible to turn off
-                       echo when there is no tty present, some
-                       sites may wish to set this flag to prevent
-                       a user from entering a visible password.
+       requiretty      If set, ssuuddoo will only run when the user is logged in
+                       to a real tty.  This will disallow things like "rsh
+                       somehost sudo ls" since _r_s_h(1) does not allocate a tty.
+                       Because it is not possible to turn off echo when there
+                       is no tty present, some sites may wish to set this flag
+                       to prevent a user from entering a visible password.
                        This flag is _o_f_f by default.
 
-       root_sudo       If set, root is allowed to run ssuuddoo too.
-                       Disabling this prevents users from "chain-
-                       ing" ssuuddoo commands to get a root shell by
-
-
-
-1.7                     December 10, 2007                      12
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
-                       doing something like "sudo sudo /bin/sh".
-                       Note, however, that turning off _r_o_o_t___s_u_d_o
-                       will also prevent root and from running
-                       ssuuddooeeddiitt.  Disabling _r_o_o_t___s_u_d_o provides no
-                       real additional security; it exists purely
-                       for historical reasons.  This flag is _o_n
+       root_sudo       If set, root is allowed to run ssuuddoo too.  Disabling
+                       this prevents users from "chaining" ssuuddoo commands to
+                       get a root shell by doing something like "sudo sudo
+                       /bin/sh".  Note, however, that turning off _r_o_o_t___s_u_d_o
+                       will also prevent root and from running ssuuddooeeddiitt.  Dis-
+                       abling _r_o_o_t___s_u_d_o provides no real additional security;
+                       it exists purely for historical reasons.  This flag is
+                       _o_n by default.
+
+       rootpw          If set, ssuuddoo will prompt for the root password instead
+                       of the password of the invoking user.  This flag is _o_f_f
                        by default.
 
-       rootpw          If set, ssuuddoo will prompt for the root
-                       password instead of the password of the
-                       invoking user.  This flag is _o_f_f by
-                       default.
-
-       runaspw         If set, ssuuddoo will prompt for the password
-                       of the user defined by the _r_u_n_a_s___d_e_f_a_u_l_t
-                       option (defaults to root) instead of the
-                       password of the invoking user.  This flag
-                       is _o_f_f by default.
-
-       set_home        If set and ssuuddoo is invoked with the --ss
-                       flag the HOME environment variable will be
-                       set to the home directory of the target
-                       user (which is root unless the --uu option
-                       is used).  This effectively makes the --ss
-                       flag imply --HH.  This flag is _o_f_f by
-                       default.
-
-       set_logname     Normally, ssuuddoo will set the LOGNAME, USER
-                       and USERNAME environment variables to the
-                       name of the target user (usually root
-                       unless the --uu flag is given).  However,
-                       since some programs (including the RCS
-                       revision control system) use LOGNAME to
-                       determine the real identity of the user,
-                       it may be desirable to change this behav-
-                       ior.  This can be done by negating the
-                       set_logname option.  Note that if the
-                       _e_n_v___r_e_s_e_t option has not been disabled,
-                       entries in the _e_n_v___k_e_e_p list will override
-                       the value of _s_e_t___l_o_g_n_a_m_e.  This flag is
-                       _o_f_f by default.
+       runaspw         If set, ssuuddoo will prompt for the password of the user
+                       defined by the _r_u_n_a_s___d_e_f_a_u_l_t option (defaults to root)
+                       instead of the password of the invoking user.  This
+                       flag is _o_f_f by default.
 
-       setenv          Allow the user to disable the _e_n_v___r_e_s_e_t
-                       option from the command line.  Addition-
-                       ally, environment variables set via the
-                       command line are not subject to the
-                       restrictions imposed by _e_n_v___c_h_e_c_k,
-                       _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only
-                       trusted users should be allowed to set
-                       variables in this manner.  This flag is
-                       _o_f_f by default.
+       set_home        If set and ssuuddoo is invoked with the --ss flag the HOME
+                       environment variable will be set to the home directory
+                       of the target user (which is root unless the --uu option
+                       is used).  This effectively makes the --ss flag imply --HH.
+                       This flag is _o_f_f by default.
 
-       shell_noargs    If set and ssuuddoo is invoked with no argu-
-                       ments it acts as if the --ss flag had been
+       set_logname     Normally, ssuuddoo will set the LOGNAME, USER and USERNAME
+                       environment variables to the name of the target user
+                       (usually root unless the --uu flag is given).  However,
+                       since some programs (including the RCS revision control
+                       system) use LOGNAME to determine the real identity of
+                       the user, it may be desirable to change this behavior.
+                       This can be done by negating the set_logname option.
+                       Note that if the _e_n_v___r_e_s_e_t option has not been dis-
+                       abled, entries in the _e_n_v___k_e_e_p list will override the
+                       value of _s_e_t___l_o_g_n_a_m_e.  This flag is _o_f_f by default.
 
 
 
-1.7                     December 10, 2007                      13
+1.7                      January 21, 2008                      11
 
 
 
@@ -862,64 +730,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       given.  That is, it runs a shell as root
-                       (the shell is determined by the SHELL
-                       environment variable if it is set, falling
-                       back on the shell listed in the invoking
-                       user's /etc/passwd entry if not).  This
+       setenv          Allow the user to disable the _e_n_v___r_e_s_e_t option from the
+                       command line.  Additionally, environment variables set
+                       via the command line are not subject to the restric-
+                       tions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.
+                       As such, only trusted users should be allowed to set
+                       variables in this manner.  This flag is _o_f_f by default.
+
+       shell_noargs    If set and ssuuddoo is invoked with no arguments it acts as
+                       if the --ss flag had been given.  That is, it runs a
+                       shell as root (the shell is determined by the SHELL
+                       environment variable if it is set, falling back on the
+                       shell listed in the invoking user's /etc/passwd entry
+                       if not).  This flag is _o_f_f by default.
+
+       stay_setuid     Normally, when ssuuddoo executes a command the real and
+                       effective UIDs are set to the target user (root by
+                       default).  This option changes that behavior such that
+                       the real UID is left as the invoking user's UID.  In
+                       other words, this makes ssuuddoo act as a setuid wrapper.
+                       This can be useful on systems that disable some poten-
+                       tially dangerous functionality when a program is run
+                       setuid.  This option is only effective on systems with
+                       either the _s_e_t_r_e_u_i_d_(_) or _s_e_t_r_e_s_u_i_d_(_) function.  This
                        flag is _o_f_f by default.
 
-       stay_setuid     Normally, when ssuuddoo executes a command the
-                       real and effective UIDs are set to the
-                       target user (root by default).  This
-                       option changes that behavior such that the
-                       real UID is left as the invoking user's
-                       UID.  In other words, this makes ssuuddoo act
-                       as a setuid wrapper.  This can be useful
-                       on systems that disable some potentially
-                       dangerous functionality when a program is
-                       run setuid.  This option is only effective
-                       on systems with either the _s_e_t_r_e_u_i_d_(_) or
-                       _s_e_t_r_e_s_u_i_d_(_) function.  This flag is _o_f_f by
-                       default.
+       targetpw        If set, ssuuddoo will prompt for the password of the user
+                       specified by the --uu flag (defaults to root) instead of
+                       the password of the invoking user.  Note that this pre-
+                       cludes the use of a uid not listed in the passwd
+                       database as an argument to the --uu flag.  This flag is
+                       _o_f_f by default.
+
+       tty_tickets     If set, users must authenticate on a per-tty basis.
+                       Normally, ssuuddoo uses a directory in the ticket dir with
+                       the same name as the user running it.  With this flag
+                       enabled, ssuuddoo will use a file named for the tty the
+                       user is logged in on in that directory.  This flag is
+                       _o_f_f by default.
 
-       targetpw        If set, ssuuddoo will prompt for the password
-                       of the user specified by the --uu flag
-                       (defaults to root) instead of the password
-                       of the invoking user.  Note that this pre-
-                       cludes the use of a uid not listed in the
-                       passwd database as an argument to the --uu
-                       flag.  This flag is _o_f_f by default.
-
-       tty_tickets     If set, users must authenticate on a per-
-                       tty basis.  Normally, ssuuddoo uses a direc-
-                       tory in the ticket dir with the same name
-                       as the user running it.  With this flag
-                       enabled, ssuuddoo will use a file named for
-                       the tty the user is logged in on in that
-                       directory.  This flag is _o_f_f by default.
-
-       use_loginclass  If set, ssuuddoo will apply the defaults spec-
-                       ified for the target user's login class if
-                       one exists.  Only available if ssuuddoo is
-                       configured with the --with-logincap
+       use_loginclass  If set, ssuuddoo will apply the defaults specified for the
+                       target user's login class if one exists.  Only avail-
+                       able if ssuuddoo is configured with the --with-logincap
                        option.  This flag is _o_f_f by default.
 
        IInntteeggeerrss:
 
-       closefrom       Before it executes a command, ssuuddoo will
-                       close all open file descriptors other than
-                       standard input, standard output and stan-
-                       dard error (ie: file descriptors 0-2).
-                       The _c_l_o_s_e_f_r_o_m option can be used to spec-
-                       ify a different file descriptor at which
-                       to start closing.  The default is 3.
+       closefrom       Before it executes a command, ssuuddoo will close all open
+                       file descriptors other than standard input, standard
+                       output and standard error (ie: file descriptors 0-2).
+                       The _c_l_o_s_e_f_r_o_m option can be used to specify a different
+                       file descriptor at which to start closing.  The default
+                       is 3.
 
-       passwd_tries    The number of tries a user gets to enter
+       passwd_tries    The number of tries a user gets to enter his/her
 
 
 
-1.7                     December 10, 2007                      14
+1.7                      January 21, 2008                      12
 
 
 
@@ -928,64 +796,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       his/her password before ssuuddoo logs the
-                       failure and exits.  The default is 3.
+                       password before ssuuddoo logs the failure and exits.  The
+                       default is 3.
 
        IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-       loglinelen      Number of characters per line for the file
-                       log.  This value is used to decide when to
-                       wrap lines for nicer log files.  This has
-                       no effect on the syslog log file, only the
-                       file log.  The default is 80 (use 0 or
-                       negate the option to disable word wrap).
+       loglinelen      Number of characters per line for the file log.  This
+                       value is used to decide when to wrap lines for nicer
+                       log files.  This has no effect on the syslog log file,
+                       only the file log.  The default is 80 (use 0 or negate
+                       the option to disable word wrap).
 
-       passwd_timeout  Number of minutes before the ssuuddoo password
-                       prompt times out.  The default is 5; set
-                       this to 0 for no password timeout.
+       passwd_timeout  Number of minutes before the ssuuddoo password prompt times
+                       out.  The default is 5; set this to 0 for no password
+                       timeout.
 
        timestamp_timeout
-                       Number of minutes that can elapse before
-                       ssuuddoo will ask for a passwd again.  The
-                       default is 5.  Set this to 0 to always
-                       prompt for a password.  If set to a value
-                       less than 0 the user's timestamp will
-                       never expire.  This can be used to allow
-                       users to create or delete their own times-
-                       tamps via sudo -v and sudo -k respec-
+                       Number of minutes that can elapse before ssuuddoo will ask
+                       for a passwd again.  The default is 5.  Set this to 0
+                       to always prompt for a password.  If set to a value
+                       less than 0 the user's timestamp will never expire.
+                       This can be used to allow users to create or delete
+                       their own timestamps via sudo -v and sudo -k respec-
                        tively.
 
-       umask           Umask to use when running the command.
-                       Negate this option or set it to 0777 to
-                       preserve the user's umask.  The default is
-                       0022.
+       umask           Umask to use when running the command.  Negate this
+                       option or set it to 0777 to preserve the user's umask.
+                       The default is 0022.
 
        SSttrriinnggss:
 
-       badpass_message Message that is displayed if a user enters
-                       an incorrect password.  The default is
-                       Sorry, try again. unless insults are
-                       enabled.
-
-       editor          A colon (':') separated list of editors
-                       allowed to be used with vviissuuddoo.  vviissuuddoo
-                       will choose the editor that matches the
-                       user's EDITOR environment variable if pos-
-                       sible, or the first editor in the list
-                       that exists and is executable.  The
-                       default is the path to vi on your system.
-
-       mailsub         Subject of the mail sent to the _m_a_i_l_t_o
-                       user. The escape %h will expand to the
-                       hostname of the machine.  Default is ***
-                       SECURITY information for %h ***.
+       badpass_message Message that is displayed if a user enters an incorrect
+                       password.  The default is Sorry, try again. unless
+                       insults are enabled.
+
+       editor          A colon (':') separated list of editors allowed to be
+                       used with vviissuuddoo.  vviissuuddoo will choose the editor that
+                       matches the user's EDITOR environment variable if pos-
+                       sible, or the first editor in the list that exists and
+                       is executable.  The default is the path to vi on your
+                       system.
+
+       mailsub         Subject of the mail sent to the _m_a_i_l_t_o user. The escape
+                       %h will expand to the hostname of the machine.  Default
+                       is *** SECURITY information for %h ***.
+
+       noexec_file     Path to a shared library containing dummy versions of
+                       the _e_x_e_c_v_(_), _e_x_e_c_v_e_(_) and _f_e_x_e_c_v_e_(_) library functions
+                       that just return an error.  This is used to implement
+                       the _n_o_e_x_e_c functionality on systems that support
+                       LD_PRELOAD or its equivalent.  Defaults to
+                       _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c_._s_o.
 
-       noexec_file     Path to a shared library containing dummy
-                       versions of the _e_x_e_c_v_(_), _e_x_e_c_v_e_(_) and
+       passprompt      The default prompt to use when asking for a password;
+                       can be overridden via the --pp option or the SUDO_PROMPT
 
 
 
-1.7                     December 10, 2007                      15
+1.7                      January 21, 2008                      13
 
 
 
@@ -994,262 +862,196 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       _f_e_x_e_c_v_e_(_) library functions that just
-                       return an error.  This is used to imple-
-                       ment the _n_o_e_x_e_c functionality on systems
-                       that support LD_PRELOAD or its equivalent.
-                       Defaults to
-                       _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c_._s_o.
-
-       passprompt      The default prompt to use when asking for
-                       a password; can be overridden via the --pp
-                       option or the SUDO_PROMPT environment
-                       variable.  The following percent (`%')
+                       environment variable.  The following percent (`%')
                        escapes are supported:
 
-                       %H  expanded to the local hostname includ-
-                           ing the domain name (on if the
-                           machine's hostname is fully qualified
-                           or the _f_q_d_n option is set)
+                       %H  expanded to the local hostname including the domain
+                           name (on if the machine's hostname is fully quali-
+                           fied or the _f_q_d_n option is set)
 
-                       %h  expanded to the local hostname without
-                           the domain name
+                       %h  expanded to the local hostname without the domain
+                           name
 
-                       %U  expanded to the login name of the user
-                           the command will be run as (defaults
-                           to root)
+                       %p  expanded to the user whose password is being asked
+                           for (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and _r_u_n_a_s_p_w
+                           flags in _s_u_d_o_e_r_s)
 
-                       %u  expanded to the invoking user's login
-                           name
+                       %U  expanded to the login name of the user the command
+                           will be run as (defaults to root)
 
-                       %%  two consecutive % characters are col-
-                           lapsed into a single % character
+                       %u  expanded to the invoking user's login name
+
+                       %%  two consecutive % characters are collapsed into a
+                           single % character
 
                        The default value is Password:.
 
-       runas_default   The default user to run commands as if the
-                       --uu flag is not specified on the command
-                       line.  This defaults to root.  Note that
-                       if _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur
+       runas_default   The default user to run commands as if the --uu flag is
+                       not specified on the command line.  This defaults to
+                       root.  Note that if _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur
                        before any Runas_Alias specifications.
 
-       syslog_badpri   Syslog priority to use when user authenti-
-                       cates unsuccessfully.  Defaults to alert.
+       syslog_badpri   Syslog priority to use when user authenticates unsuc-
+                       cessfully.  Defaults to alert.
 
-       syslog_goodpri  Syslog priority to use when user authenti-
-                       cates successfully.  Defaults to notice.
+       syslog_goodpri  Syslog priority to use when user authenticates success-
+                       fully.  Defaults to notice.
 
-       timestampdir    The directory in which ssuuddoo stores its
-                       timestamp files.  The default is
-                       _/_v_a_r_/_r_u_n_/_s_u_d_o.
+       timestampdir    The directory in which ssuuddoo stores its timestamp files.
+                       The default is _/_v_a_r_/_r_u_n_/_s_u_d_o.
 
-       timestampowner  The owner of the timestamp directory and
-                       the timestamps stored therein.  The
-                       default is root.
+       timestampowner  The owner of the timestamp directory and the timestamps
+                       stored therein.  The default is root.
 
        SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
+       exempt_group
+                   Users in this group are exempt from password and PATH
+                   requirements.  This is not set by default.
 
+       lecture     This option controls when a short lecture will be printed
+                   along with the password prompt.  It has the following pos-
+                   sible values:
 
-1.7                     December 10, 2007                      16
+                   always  Always lecture the user.
 
+                   never   Never lecture the user.
 
 
 
+1.7                      January 21, 2008                      14
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       exempt_group
-                   Users in this group are exempt from password
-                   and PATH requirements.  This is not set by
-                   default.
 
-       lecture     This option controls when a short lecture will
-                   be printed along with the password prompt.  It
-                   has the following possible values:
 
-                   always  Always lecture the user.
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-                   never   Never lecture the user.
 
-                   once    Only lecture the user the first time
-                           they run ssuuddoo.
+                   once    Only lecture the user the first time they run ssuuddoo.
 
-                   If no value is specified, a value of _o_n_c_e is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _o_n_c_e.
+                   If no value is specified, a value of _o_n_c_e is implied.
+                   Negating the option results in a value of _n_e_v_e_r being used.
+                   The default value is _o_n_c_e.
 
        lecture_file
-                   Path to a file containing an alternate ssuuddoo
-                   lecture that will be used in place of the
-                   standard lecture if the named file exists.  By
-                   default, ssuuddoo uses a built-in lecture.
+                   Path to a file containing an alternate ssuuddoo lecture that
+                   will be used in place of the standard lecture if the named
+                   file exists.  By default, ssuuddoo uses a built-in lecture.
 
-       listpw      This option controls when a password will be
-                   required when a user runs ssuuddoo with the --ll
-                   flag.  It has the following possible values:
+       listpw      This option controls when a password will be required when
+                   a user runs ssuuddoo with the --ll flag.  It has the following
+                   possible values:
 
-                   all     All the user's _s_u_d_o_e_r_s entries for the
-                           current host must have the NOPASSWD
-                           flag set to avoid entering a password.
+                   all     All the user's _s_u_d_o_e_r_s entries for the current host
+                           must have the NOPASSWD flag set to avoid entering a
+                           password.
 
-                   always  The user must always enter a password
-                           to use the --ll flag.
+                   always  The user must always enter a password to use the --ll
+                           flag.
 
-                   any     At least one of the user's _s_u_d_o_e_r_s
-                           entries for the current host must have
-                           the NOPASSWD flag set to avoid enter-
-                           ing a password.
+                   any     At least one of the user's _s_u_d_o_e_r_s entries for the
+                           current host must have the NOPASSWD flag set to
+                           avoid entering a password.
 
-                   never   The user need never enter a password
-                           to use the --ll flag.
+                   never   The user need never enter a password to use the --ll
+                           flag.
 
-                   If no value is specified, a value of _a_n_y is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _a_n_y.
+                   If no value is specified, a value of _a_n_y is implied.
+                   Negating the option results in a value of _n_e_v_e_r being used.
+                   The default value is _a_n_y.
 
-       logfile     Path to the ssuuddoo log file (not the syslog log
-                   file).  Setting a path turns on logging to a
-                   file; negating this option turns it off.  By
+       logfile     Path to the ssuuddoo log file (not the syslog log file).  Set-
+                   ting a path turns on logging to a file; negating this
+                   option turns it off.  By default, ssuuddoo logs via syslog.
 
+       mailerflags Flags to use when invoking mailer. Defaults to --tt.
 
+       mailerpath  Path to mail program used to send warning mail.  Defaults
+                   to the path to sendmail found at configure time.
 
-1.7                     December 10, 2007                      17
+       mailto      Address to send warning and error mail to.  The address
+                   should be enclosed in double quotes (") to protect against
+                   ssuuddoo interpreting the @ sign.  Defaults to root.
 
+       secure_path Path used for every command run from ssuuddoo.  If you don't
+                   trust the people running ssuuddoo to have a sane PATH environ-
+                   ment variable you may want to use this.  Another use is if
+                   you want to have the "root path" be separate from the "user
+                   path."  Users in the group specified by the _e_x_e_m_p_t___g_r_o_u_p
+                   option are not affected by _s_e_c_u_r_e___p_a_t_h.  This is not set by
+                   default.
 
 
 
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+1.7                      January 21, 2008                      15
 
 
-                   default, ssuuddoo logs via syslog.
 
-       mailerflags Flags to use when invoking mailer. Defaults to
-                   --tt.
 
-       mailerpath  Path to mail program used to send warning
-                   mail.  Defaults to the path to sendmail found
-                   at configure time.
 
-       mailto      Address to send warning and error mail to.
-                   The address should be enclosed in double
-                   quotes (") to protect against ssuuddoo interpret-
-                   ing the @ sign.  Defaults to root.
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-       secure_path Path used for every command run from ssuuddoo.  If
-                   you don't trust the people running ssuuddoo to
-                   have a sane PATH environment variable you may
-                   want to use this.  Another use is if you want
-                   to have the "root path" be separate from the
-                   "user path."  Users in the group specified by
-                   the _e_x_e_m_p_t___g_r_o_u_p option are not affected by
-                   _s_e_c_u_r_e___p_a_t_h.  This is not set by default.
 
-       syslog      Syslog facility if syslog is being used for
-                   logging (negate to disable syslog logging).
-                   Defaults to local2.
+       syslog      Syslog facility if syslog is being used for logging (negate
+                   to disable syslog logging).  Defaults to local2.
 
-       verifypw    This option controls when a password will be
-                   required when a user runs ssuuddoo with the --vv
-                   flag.  It has the following possible values:
+       verifypw    This option controls when a password will be required when
+                   a user runs ssuuddoo with the --vv flag.  It has the following
+                   possible values:
 
-                   all     All the user's _s_u_d_o_e_r_s entries for the
-                           current host must have the NOPASSWD
-                           flag set to avoid entering a password.
+                   all     All the user's _s_u_d_o_e_r_s entries for the current host
+                           must have the NOPASSWD flag set to avoid entering a
+                           password.
 
-                   always  The user must always enter a password
-                           to use the --vv flag.
+                   always  The user must always enter a password to use the --vv
+                           flag.
 
-                   any     At least one of the user's _s_u_d_o_e_r_s
-                           entries for the current host must have
-                           the NOPASSWD flag set to avoid enter-
-                           ing a password.
+                   any     At least one of the user's _s_u_d_o_e_r_s entries for the
+                           current host must have the NOPASSWD flag set to
+                           avoid entering a password.
 
-                   never   The user need never enter a password
-                           to use the --vv flag.
+                   never   The user need never enter a password to use the --vv
+                           flag.
 
-                   If no value is specified, a value of _a_l_l is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _a_l_l.
+                   If no value is specified, a value of _a_l_l is implied.
+                   Negating the option results in a value of _n_e_v_e_r being used.
+                   The default value is _a_l_l.
 
        LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-       env_check       Environment variables to be removed from
+       env_check       Environment variables to be removed from the user's
+                       environment if the variable's value contains % or /
+                       characters.  This can be used to guard against printf-
+                       style format vulnerabilities in poorly-written pro-
+                       grams.  The argument may be a double-quoted, space-sep-
+                       arated list or a single value without double-quotes.
+                       The list can be replaced, added to, deleted from, or
+                       disabled by using the =, +=, -=, and ! operators
+                       respectively.  Regardless of whether the env_reset
+                       option is enabled or disabled, variables specified by
+                       env_check will be preserved in the environment if they
+                       pass the aforementioned check.  The default list of
+                       environment variables to check is displayed when ssuuddoo
+                       is run by root with the _-_V option.
 
+       env_delete      Environment variables to be removed from the user's
+                       environment.  The argument may be a double-quoted,
+                       space-separated list or a single value without dou-
+                       ble-quotes.  The list can be replaced, added to,
+                       deleted from, or disabled by using the =, +=, -=, and !
+                       operators respectively.  The default list of environ-
+                       ment variables to remove is displayed when ssuuddoo is run
+                       by root with the _-_V option.  Note that many operating
+                       systems will remove potentially dangerous variables
+                       from the environment of any setuid process (such as
+                       ssuuddoo).
 
 
-1.7                     December 10, 2007                      18
 
 
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
-                       the user's environment if the variable's
-                       value contains % or / characters.  This
-                       can be used to guard against printf-style
-                       format vulnerabilities in poorly-written
-                       programs.  The argument may be a dou-
-                       ble-quoted, space-separated list or a sin-
-                       gle value without double-quotes.  The list
-                       can be replaced, added to, deleted from,
-                       or disabled by using the =, +=, -=, and !
-                       operators respectively.  Regardless of
-                       whether the env_reset option is enabled or
-                       disabled, variables specified by env_check
-                       will be preserved in the environment if
-                       they pass the aforementioned check.  The
-                       default list of environment variables to
-                       check is displayed when ssuuddoo is run by
-                       root with the _-_V option.
-
-       env_delete      Environment variables to be removed from
-                       the user's environment.  The argument may
-                       be a double-quoted, space-separated list
-                       or a single value without double-quotes.
-                       The list can be replaced, added to,
-                       deleted from, or disabled by using the =,
-                       +=, -=, and ! operators respectively.  The
-                       default list of environment variables to
-                       remove is displayed when ssuuddoo is run by
-                       root with the _-_V option.  Note that many
-                       operating systems will remove potentially
-                       dangerous variables from the environment
-                       of any setuid process (such as ssuuddoo).
-
-       env_keep        Environment variables to be preserved in
-                       the user's environment when the _e_n_v___r_e_s_e_t
-                       option is in effect.  This allows fine-
-                       grained control over the environment
-                       ssuuddoo-spawned processes will receive.  The
-                       argument may be a double-quoted, space-
-                       separated list or a single value without
-                       double-quotes.  The list can be replaced,
-                       added to, deleted from, or disabled by
-                       using the =, +=, -=, and ! operators
-                       respectively.  The default list of vari-
-                       ables to keep is displayed when ssuuddoo is
-                       run by root with the _-_V option.
-
-       When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following
-       values for the syslog facility (the value of the ssyysslloogg
-       Parameter): aauutthhpprriivv (if your OS supports it), aauutthh, ddaaee--
-       mmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33, llooccaall44, llooccaall55,
-       llooccaall66, and llooccaall77.  The following syslog priorities are
-       supported: aalleerrtt, ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee,
-       and wwaarrnniinngg.
-
-
-
-
-1.7                     December 10, 2007                      19
+1.7                      January 21, 2008                      16
 
 
 
@@ -1258,14 +1060,32 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       env_keep        Environment variables to be preserved in the user's
+                       environment when the _e_n_v___r_e_s_e_t option is in effect.
+                       This allows fine-grained control over the environment
+                       ssuuddoo-spawned processes will receive.  The argument may
+                       be a double-quoted, space-separated list or a single
+                       value without double-quotes.  The list can be replaced,
+                       added to, deleted from, or disabled by using the =, +=,
+                       -=, and ! operators respectively.  The default list of
+                       variables to keep is displayed when ssuuddoo is run by root
+                       with the _-_V option.
+
+       When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following values for the
+       syslog facility (the value of the ssyysslloogg Parameter): aauutthhpprriivv (if your
+       OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33,
+       llooccaall44, llooccaall55, llooccaall66, and llooccaall77.  The following syslog priorities
+       are supported: aalleerrtt, ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee, and wwaarrnn--
+       iinngg.
+
 FFIILLEESS
        _/_e_t_c_/_s_u_d_o_e_r_s         List of who can run what
        _/_e_t_c_/_g_r_o_u_p           Local groups file
        _/_e_t_c_/_n_e_t_g_r_o_u_p        List of network groups
 
 EEXXAAMMPPLLEESS
-       Below are example _s_u_d_o_e_r_s entries.  Admittedly, some of
-       these are a bit contrived.  First, we define our _a_l_i_a_s_e_s:
+       Below are example _s_u_d_o_e_r_s entries.  Admittedly, some of these are a bit
+       contrived.  First, we define our _a_l_i_a_s_e_s:
 
         # User alias specification
         User_Alias     FULLTIMERS = millert, mikef, dowdy
@@ -1286,6 +1106,26 @@ EEXXAAMMPPLLEESS
         Host_Alias     SERVERS = master, mail, www, ns
         Host_Alias     CDROM = orion, perseus, hercules
 
+
+
+
+
+
+
+
+
+
+
+
+1.7                      January 21, 2008                      17
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
         # Cmnd alias specification
         Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
                                /usr/sbin/restore, /usr/sbin/rrestore
@@ -1300,29 +1140,16 @@ EEXXAAMMPPLLEESS
         Cmnd_Alias     SU = /usr/bin/su
         Cmnd_Alias     PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
 
-       Here we override some of the compiled in default values.
-       We want ssuuddoo to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility
-       in all cases.  We don't want to subject the full time
-       staff to the ssuuddoo lecture, user mmiilllleerrtt need not give a
-       password, and we don't want to reset the LOGNAME, USER or
-       USERNAME environment variables when running commands as
-       root.  Additionally, on the machines in the _S_E_R_V_E_R_S
-       Host_Alias, we keep an additional local log file and make
-       sure we log the year in each log line since the log
-       entries will be kept around for several years.  Lastly, we
-       disable shell escapes for the commands in the PAGERS
-       Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and _/_u_s_r_/_b_i_n_/_l_e_s_s).
-
-
-
-1.7                     December 10, 2007                      20
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
+       Here we override some of the compiled in default values.  We want ssuuddoo
+       to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility in all cases.  We don't
+       want to subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt
+       need not give a password, and we don't want to reset the LOGNAME, USER
+       or USERNAME environment variables when running commands as root.  Addi-
+       tionally, on the machines in the _S_E_R_V_E_R_S Host_Alias, we keep an addi-
+       tional local log file and make sure we log the year in each log line
+       since the log entries will be kept around for several years.  Lastly,
+       we disable shell escapes for the commands in the PAGERS Cmnd_Alias
+       (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and _/_u_s_r_/_b_i_n_/_l_e_s_s).
 
         # Override built-in defaults
         Defaults               syslog=auth
@@ -1332,188 +1159,163 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Defaults@SERVERS       log_year, logfile=/var/log/sudo.log
         Defaults!PAGERS        noexec
 
-       The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually deter-
-       mines who may run what.
+       The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run
+       what.
 
         root           ALL = (ALL) ALL
         %wheel         ALL = (ALL) ALL
 
-       We let rroooott and any user in group wwhheeeell run any command on
-       any host as any user.
+       We let rroooott and any user in group wwhheeeell run any command on any host as
+       any user.
 
         FULLTIMERS     ALL = NOPASSWD: ALL
 
-       Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run
-       any command on any host without authenticating themselves.
+       Full time sysadmins (mmiilllleerrtt, mmiikkeeff, and ddoowwddyy) may run any command on
+       any host without authenticating themselves.
 
         PARTTIMERS     ALL = ALL
 
-       Part time sysadmins (bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run
-       any command on any host but they must authenticate them-
-       selves first (since the entry lacks the NOPASSWD tag).
+       Part time sysadmins (bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run any command on
+       any host but they must authenticate themselves first (since the entry
+       lacks the NOPASSWD tag).
 
         jack           CSNETS = ALL
 
-       The user jjaacckk may run any command on the machines in the
-       _C_S_N_E_T_S alias (the networks 128.138.243.0, 128.138.204.0,
-       and 128.138.242.0).  Of those networks, only 128.138.204.0
-       has an explicit netmask (in CIDR notation) indicating it
-       is a class C network.  For the other networks in _C_S_N_E_T_S,
-       the local machine's netmask will be used during matching.
 
-        lisa           CUNETS = ALL
 
-       The user lliissaa may run any command on any host in the
-       _C_U_N_E_T_S alias (the class B network 128.138.0.0).
+1.7                      January 21, 2008                      18
 
-        operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
-                       sudoedit /etc/printcap, /usr/oper/bin/
 
-       The ooppeerraattoorr user may run commands limited to simple main-
-       tenance.  Here, those are commands related to backups,
-       killing processes, the printing system, shutting down the
-       system, and any commands in the directory _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
 
-        joe            ALL = /usr/bin/su operator
-
-       The user jjooee may only _s_u(1) to operator.
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-1.7                     December 10, 2007                      21
+       The user jjaacckk may run any command on the machines in the _C_S_N_E_T_S alias
+       (the networks 128.138.243.0, 128.138.204.0, and 128.138.242.0).  Of
+       those networks, only 128.138.204.0 has an explicit netmask (in CIDR
+       notation) indicating it is a class C network.  For the other networks
+       in _C_S_N_E_T_S, the local machine's netmask will be used during matching.
 
+        lisa           CUNETS = ALL
 
+       The user lliissaa may run any command on any host in the _C_U_N_E_T_S alias (the
+       class B network 128.138.0.0).
 
+        operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
+                       sudoedit /etc/printcap, /usr/oper/bin/
 
+       The ooppeerraattoorr user may run commands limited to simple maintenance.
+       Here, those are commands related to backups, killing processes, the
+       printing system, shutting down the system, and any commands in the
+       directory _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+        joe            ALL = /usr/bin/su operator
 
+       The user jjooee may only _s_u(1) to operator.
 
         pete           HPPA = /usr/bin/passwd [A-z]*, !/usr/bin/passwd root
 
-       The user ppeettee is allowed to change anyone's password
-       except for root on the _H_P_P_A machines.  Note that this
-       assumes _p_a_s_s_w_d(1) does not take multiple usernames on the
-       command line.
+       The user ppeettee is allowed to change anyone's password except for root on
+       the _H_P_P_A machines.  Note that this assumes _p_a_s_s_w_d(1) does not take mul-
+       tiple usernames on the command line.
 
         bob            SPARC = (OP) ALL : SGI = (OP) ALL
 
-       The user bboobb may run anything on the _S_P_A_R_C and _S_G_I
-       machines as any user listed in the _O_P Runas_Alias (rroooott
-       and ooppeerraattoorr).
+       The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user
+       listed in the _O_P Runas_Alias (rroooott and ooppeerraattoorr).
 
         jim            +biglab = ALL
 
-       The user jjiimm may run any command on machines in the _b_i_g_l_a_b
-       netgroup.  ssuuddoo knows that "biglab" is a netgroup due to
-       the '+' prefix.
+       The user jjiimm may run any command on machines in the _b_i_g_l_a_b netgroup.
+       ssuuddoo knows that "biglab" is a netgroup due to the '+' prefix.
 
         +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
 
-       Users in the sseeccrreettaarriieess netgroup need to help manage the
-       printers as well as add and remove users, so they are
-       allowed to run those commands on all machines.
+       Users in the sseeccrreettaarriieess netgroup need to help manage the printers as
+       well as add and remove users, so they are allowed to run those commands
+       on all machines.
 
         fred           ALL = (DB) NOPASSWD: ALL
 
-       The user ffrreedd can run commands as any user in the _D_B
-       Runas_Alias (oorraaccllee or ssyybbaassee) without giving a password.
+       The user ffrreedd can run commands as any user in the _D_B Runas_Alias (oorraa--
+       ccllee or ssyybbaassee) without giving a password.
 
         john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
 
-       On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except
-       root but he is not allowed to give _s_u(1) any flags.
+       On the _A_L_P_H_A machines, user jjoohhnn may su to anyone except root but he is
+       not allowed to give _s_u(1) any flags.
 
-        jen            ALL, !SERVERS = ALL
 
-       The user jjeenn may run any command on any machine except for
-       those in the _S_E_R_V_E_R_S Host_Alias (master, mail, www and
-       ns).
 
-        jill           SERVERS = /usr/bin/, !SU, !SHELLS
+1.7                      January 21, 2008                      19
 
-       For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run
-       any commands in the directory _/_u_s_r_/_b_i_n_/ except for those
-       commands belonging to the _S_U and _S_H_E_L_L_S Cmnd_Aliases.
 
-        steve          CSNETS = (operator) /usr/local/op_commands/
 
-       The user sstteevvee may run any command in the directory
-       /usr/local/op_commands/ but only as user operator.
-
-        matt           valkyrie = KILL
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-1.7                     December 10, 2007                      22
+        jen            ALL, !SERVERS = ALL
 
+       The user jjeenn may run any command on any machine except for those in the
+       _S_E_R_V_E_R_S Host_Alias (master, mail, www and ns).
 
+        jill           SERVERS = /usr/bin/, !SU, !SHELLS
 
+       For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in
+       the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U
+       and _S_H_E_L_L_S Cmnd_Aliases.
 
+        steve          CSNETS = (operator) /usr/local/op_commands/
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       The user sstteevvee may run any command in the directory /usr/local/op_com-
+       mands/ but only as user operator.
 
+        matt           valkyrie = KILL
 
-       On his personal workstation, valkyrie, mmaatttt needs to be
-       able to kill hung processes.
+       On his personal workstation, valkyrie, mmaatttt needs to be able to kill
+       hung processes.
 
         WEBMASTERS     www = (www) ALL, (root) /usr/bin/su www
 
-       On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias
-       (will, wendy, and wim), may run any command as user www
-       (which owns the web pages) or simply _s_u(1) to www.
+       On the host www, any user in the _W_E_B_M_A_S_T_E_R_S User_Alias (will, wendy,
+       and wim), may run any command as user www (which owns the web pages) or
+       simply _s_u(1) to www.
 
         ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
                        /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
 
-       Any user may mount or unmount a CD-ROM on the machines in
-       the CDROM Host_Alias (orion, perseus, hercules) without
-       entering a password.  This is a bit tedious for users to
-       type, so it is a prime candidate for encapsulating in a
-       shell script.
+       Any user may mount or unmount a CD-ROM on the machines in the CDROM
+       Host_Alias (orion, perseus, hercules) without entering a password.
+       This is a bit tedious for users to type, so it is a prime candidate for
+       encapsulating in a shell script.
 
 SSEECCUURRIITTYY NNOOTTEESS
-       It is generally not effective to "subtract" commands from
-       ALL using the '!' operator.  A user can trivially circum-
-       vent this by copying the desired command to a different
-       name and then executing that.  For example:
+       It is generally not effective to "subtract" commands from ALL using the
+       '!' operator.  A user can trivially circumvent this by copying the
+       desired command to a different name and then executing that.  For exam-
+       ple:
 
            bill        ALL = ALL, !SU, !SHELLS
 
-       Doesn't really prevent bbiillll from running the commands
-       listed in _S_U or _S_H_E_L_L_S since he can simply copy those com-
-       mands to a different name, or use a shell escape from an
-       editor or other program.  Therefore, these kind of
-       restrictions should be considered advisory at best (and
-       reinforced by policy).
+       Doesn't really prevent bbiillll from running the commands listed in _S_U or
+       _S_H_E_L_L_S since he can simply copy those commands to a different name, or
+       use a shell escape from an editor or other program.  Therefore, these
+       kind of restrictions should be considered advisory at best (and rein-
+       forced by policy).
 
 PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
-       Once ssuuddoo executes a program, that program is free to do
-       whatever it pleases, including run other programs.  This
-       can be a security issue since it is not uncommon for a
-       program to allow shell escapes, which lets a user bypass
-       ssuuddoo's access control and logging.  Common programs that
-       permit shell escapes include shells (obviously), editors,
-       paginators, mail and terminal programs.
-
-       There are two basic approaches to this problem:
-
-       restrict  Avoid giving users access to commands that allow
-                 the user to run arbitrary commands.  Many edi-
-                 tors have a restricted mode where shell escapes
-                 are disabled, though ssuuddooeeddiitt is a better solu-
-                 tion to running editors via ssuuddoo.  Due to the
-                 large number of programs that offer shell
-                 escapes, restricting users to the set of pro-
-                 grams that do not if often unworkable.
+       Once ssuuddoo executes a program, that program is free to do whatever it
+       pleases, including run other programs.  This can be a security issue
+       since it is not uncommon for a program to allow shell escapes, which
+       lets a user bypass ssuuddoo's access control and logging.  Common programs
 
-       noexec    Many systems that support shared libraries have
 
 
-
-1.7                     December 10, 2007                      23
+1.7                      January 21, 2008                      20
 
 
 
@@ -1522,64 +1324,64 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                 the ability to override default library func-
-                 tions by pointing an environment variable (usu-
-                 ally LD_PRELOAD) to an alternate shared library.
-                 On such systems, ssuuddoo's _n_o_e_x_e_c functionality can
-                 be used to prevent a program run by ssuuddoo from
-                 executing any other programs.  Note, however,
-                 that this applies only to native dynamically-
-                 linked executables.  Statically-linked executa-
-                 bles and foreign executables running under
-                 binary emulation are not affected.
+       that permit shell escapes include shells (obviously), editors, pagina-
+       tors, mail and terminal programs.
+
+       There are two basic approaches to this problem:
 
-                 To tell whether or not ssuuddoo supports _n_o_e_x_e_c, you
-                 can run the following as root:
+       restrict  Avoid giving users access to commands that allow the user to
+                 run arbitrary commands.  Many editors have a restricted mode
+                 where shell escapes are disabled, though ssuuddooeeddiitt is a better
+                 solution to running editors via ssuuddoo.  Due to the large num-
+                 ber of programs that offer shell escapes, restricting users
+                 to the set of programs that do not if often unworkable.
+
+       noexec    Many systems that support shared libraries have the ability
+                 to override default library functions by pointing an environ-
+                 ment variable (usually LD_PRELOAD) to an alternate shared
+                 library.  On such systems, ssuuddoo's _n_o_e_x_e_c functionality can be
+                 used to prevent a program run by ssuuddoo from executing any
+                 other programs.  Note, however, that this applies only to
+                 native dynamically-linked executables.  Statically-linked
+                 executables and foreign executables running under binary emu-
+                 lation are not affected.
+
+                 To tell whether or not ssuuddoo supports _n_o_e_x_e_c, you can run the
+                 following as root:
 
                      sudo -V | grep "dummy exec"
 
-                 If the resulting output contains a line that
-                 begins with:
+                 If the resulting output contains a line that begins with:
 
                      File containing dummy exec functions:
 
-                 then ssuuddoo may be able to replace the exec family
-                 of functions in the standard library with its
-                 own that simply return an error.  Unfortunately,
-                 there is no foolproof way to know whether or not
-                 _n_o_e_x_e_c will work at compile-time.  _n_o_e_x_e_c should
-                 work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64
-                 UNIX, MacOS X, and HP-UX 11.x.  It is known nnoott
-                 to work on AIX and UnixWare.  _n_o_e_x_e_c is expected
-                 to work on most operating systems that support
-                 the LD_PRELOAD environment variable.  Check your
-                 operating system's manual pages for the dynamic
-                 linker (usually ld.so, ld.so.1, dyld, dld.sl,
-                 rld, or loader) to see if LD_PRELOAD is sup-
-                 ported.
-
-                 To enable _n_o_e_x_e_c for a command, use the NOEXEC
-                 tag as documented in the User Specification sec-
-                 tion above.  Here is that example again:
+                 then ssuuddoo may be able to replace the exec family of functions
+                 in the standard library with its own that simply return an
+                 error.  Unfortunately, there is no foolproof way to know
+                 whether or not _n_o_e_x_e_c will work at compile-time.  _n_o_e_x_e_c
+                 should work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64 UNIX,
+                 MacOS X, and HP-UX 11.x.  It is known nnoott to work on AIX and
+                 UnixWare.  _n_o_e_x_e_c is expected to work on most operating sys-
+                 tems that support the LD_PRELOAD environment variable.  Check
+                 your operating system's manual pages for the dynamic linker
+                 (usually ld.so, ld.so.1, dyld, dld.sl, rld, or loader) to see
+                 if LD_PRELOAD is supported.
+
+                 To enable _n_o_e_x_e_c for a command, use the NOEXEC tag as docu-
+                 mented in the User Specification section above.  Here is that
+                 example again:
 
                   aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 
-                 This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and
-                 _/_u_s_r_/_b_i_n_/_v_i with _n_o_e_x_e_c enabled.  This will pre-
-                 vent those two commands from executing other
-                 commands (such as a shell).  If you are unsure
-                 whether or not your system is capable of sup-
-                 porting _n_o_e_x_e_c you can always just try it out
-                 and see if it works.
+                 This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i
+                 with _n_o_e_x_e_c enabled.  This will prevent those two commands
+                 from executing other commands (such as a shell).  If you are
+                 unsure whether or not your system is capable of supporting
+                 _n_o_e_x_e_c you can always just try it out and see if it works.
 
-       Note that restricting shell escapes is not a panacea.
-       Programs running as root are still capable of many poten-
-       tially hazardous operations (such as changing or overwrit-
-       ing files) that could lead to unintended privilege
 
 
-
-1.7                     December 10, 2007                      24
+1.7                      January 21, 2008                      21
 
 
 
@@ -1588,42 +1390,42 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       escalation.  In the specific case of an editor, a safer
+       Note that restricting shell escapes is not a panacea.  Programs running
+       as root are still capable of many potentially hazardous operations
+       (such as changing or overwriting files) that could lead to unintended
+       privilege escalation.  In the specific case of an editor, a safer
        approach is to give the user permission to run ssuuddooeeddiitt.
 
 SSEEEE AALLSSOO
        _r_s_h(1), _s_u(1), _f_n_m_a_t_c_h(3), _s_u_d_o(1m), _v_i_s_u_d_o(8)
 
 CCAAVVEEAATTSS
-       The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo
-       command which locks the file and does grammatical check-
-       ing. It is imperative that _s_u_d_o_e_r_s be free of syntax
-       errors since ssuuddoo will not run with a syntactically incor-
-       rect _s_u_d_o_e_r_s file.
-
-       When using netgroups of machines (as opposed to users), if
-       you store fully qualified hostnames in the netgroup (as is
-       usually the case), you either need to have the machine's
-       hostname be fully qualified as returned by the hostname
-       command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
+       The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which
+       locks the file and does grammatical checking. It is imperative that
+       _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a syntac-
+       tically incorrect _s_u_d_o_e_r_s file.
+
+       When using netgroups of machines (as opposed to users), if you store
+       fully qualified hostnames in the netgroup (as is usually the case), you
+       either need to have the machine's hostname be fully qualified as
+       returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
 
 BBUUGGSS
-       If you feel you have found a bug in ssuuddoo, please submit a
-       bug report at http://www.sudo.ws/sudo/bugs/
+       If you feel you have found a bug in ssuuddoo, please submit a bug report at
+       http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail-
-       ing list, see http://www.sudo.ws/mail-
-       man/listinfo/sudo-users to subscribe or search the
-       archives.
+       Limited free support is available via the sudo-users mailing list, see
+       http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
+       the archives.
 
 DDIISSCCLLAAIIMMEERR
-       ssuuddoo is provided ``AS IS'' and any express or implied war-
-       ranties, including, but not limited to, the implied war-
-       ranties of merchantability and fitness for a particular
-       purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
-       plete details.
+       ssuuddoo is provided ``AS IS'' and any express or implied warranties,
+       including, but not limited to, the implied warranties of merchantabil-
+       ity and fitness for a particular purpose are disclaimed.  See the
+       LICENSE file distributed with ssuuddoo or
+       http://www.sudo.ws/sudo/license.html for complete details.
+
 
 
 
@@ -1645,6 +1447,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7                     December 10, 2007                      25
+1.7                      January 21, 2008                      22
 
 
diff --git a/sudoers.ldap.cat b/sudoers.ldap.cat
index d650c33ec..84015a64f 100644
--- a/sudoers.ldap.cat
+++ b/sudoers.ldap.cat
@@ -8,60 +8,60 @@ NNAAMMEE
        sudoers.ldap - sudo LDAP configuration
 
 DDEESSCCRRIIPPTTIIOONN
-       In addition to the standard _s_u_d_o_e_r_s file, ssuuddoo may be con-
-       figured via LAP.  This can be especially useful for syn-
-       chronizing _s_u_d_o_e_r_s in a large, distributed environment.
+       In addition to the standard _s_u_d_o_e_r_s file, ssuuddoo may be configured via
+       LAP.  This can be especially useful for synchronizing _s_u_d_o_e_r_s in a
+       large, distributed environment.
 
        Using LDAP for _s_u_d_o_e_r_s has several benefits:
 
-       +o   ssuuddoo no longer needs to read _s_u_d_o_e_r_s in its entirety.
-           When LDAP is used, there are only two or three LDAP
-           queries per invocation.  This makes it especially fast
-           and particularly usable in LDAP environments.
+       +o   ssuuddoo no longer needs to read _s_u_d_o_e_r_s in its entirety.  When LDAP is
+           used, there are only two or three LDAP queries per invocation.
+           This makes it especially fast and particularly usable in LDAP envi-
+           ronments.
+
+       +o   ssuuddoo no longer exits if there is a typo in _s_u_d_o_e_r_s.  It is not pos-
+           sible to load LDAP data into the server that does not conform to
+           the sudoers schema, so proper syntax is guaranteed.  It is still
+           possible to have typos in a user or host name, but this will not
+           prevent ssuuddoo from running.
+
+       +o   It is possible to specify per-entry options that override the
+           global default options.  _/_e_t_c_/_s_u_d_o_e_r_s only supports default options
+           and limited options associated with user/host/commands/aliases.
+           The syntax is complicated and can be difficult for users to under-
+           stand.  Placing the options directly in the entry is more natural.
+
+       +o   The vviissuuddoo program is no longer needed.  vviissuuddoo provides locking
+           and syntax checking of the _/_e_t_c_/_s_u_d_o_e_r_s file.  Since LDAP updates
+           are atomic, locking is no longer necessary.  Because syntax is
+           checked when the data is inserted into LDAP, there is no need for a
+           specialized tool to check syntax.
+
+       Another major difference between LDAP and file-based _s_u_d_o_e_r_s is that in
+       LDAP, ssuuddoo-specific Aliases are not supported.
+
+       For the most part, there is really no need for ssuuddoo-specific Aliases.
+       Unix groups or user netgroups can be used in place of User_Aliases and
+       RunasAliases.  Host netgroups can be used in place of HostAliases.
+       Since Unix groups and netgroups can also be stored in LDAP there is no
+       real need for ssuuddoo-specific aliases.
+
+       Cmnd_Aliases are not really required either since it is possible to
+       have multiple users listed in a sudoRole.  Instead of defining a
+       Cmnd_Alias that is referenced by multiple users, one can create a sudo-
+       Role that contains the commands and assign multiple users to it.
 
-       +o   ssuuddoo no longer exits if there is a typo in _s_u_d_o_e_r_s.
-           It is not possible to load LDAP data into the server
-           that does not conform to the sudoers schema, so proper
-           syntax is guaranteed.  It is still possible to have
-           typos in a user or host name, but this will not pre-
-           vent ssuuddoo from running.
-
-       +o   It is possible to specify per-entry options that over-
-           ride the global default options.  _/_e_t_c_/_s_u_d_o_e_r_s only
-           supports default options and limited options associ-
-           ated with user/host/commands/aliases.  The syntax is
-           complicated and can be difficult for users to under-
-           stand.  Placing the options directly in the entry is
-           more natural.
-
-       +o   vviissuuddoo is no longer needed.  vviissuuddoo provides locking
-           and syntax checking of the _/_e_t_c_/_s_u_d_o_e_r_s file.  Since
-           LDAP updates are atomic, locking is no longer neces-
-           sary.  Because syntax is checked when the data is
-           inserted into LDAP, there is no need for a specialized
-           tool to check syntax.
-
-       Another major difference between LDAP and file-based _s_u_d_o_-
-       _e_r_s is that in LDAP, ssuuddoo-specific Aliases are not sup-
-       ported.
-
-       For the most part, there is really no need for ssuuddoo-spe-
-       cific Aliases.  Unix groups or user netgroups can be used
-       in place of User_Aliases and RunasAliases.  Host netgroups
-       can be used in place of HostAliases.  Since Unix groups
-       and netgroups can also be stored in LDAP there is no real
-       need for ssuuddoo-specific aliases.
+       SSUUDDOOeerrss LLDDAAPP ccoonnttaaiinneerr
 
-       Cmnd_Aliases are not really required either since it is
-       possible to have multiple users listed in a sudoRole.
-       Instead of defining a Cmnd_Alias that is referenced by
-       multiple users, one can create a sudoRole that contains
-       the commands and assign multiple users to it.
+       The _s_u_d_o_e_r_s configuration is contained in the ou=SUDOers LDAP con-
+       tainer.
 
+       Sudo first looks for the cn=default entry in the SUDOers container.  If
+       found, the multi-valued sudoOption attribute is parsed in the same
 
 
 
-1.7                      January 20, 2008                       1
+1.7                      January 21, 2008                       1
 
 
 
@@ -70,17 +70,9 @@ DDEESSCCRRIIPPTTIIOONN
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-       SSUUDDOOeerrss LLDDAAPP ccoonnttaaiinneerr
-
-       The _s_u_d_o_e_r_s configuration is contained in the ou=SUDOers
-       LDAP container.
-
-       Sudo first looks for the cn=default entry in the SUDOers
-       container.  If found, the multi-valued sudoOption
-       attribute is parsed in the same manner as a global
-       Defaults line in _/_e_t_c_/_s_u_d_o_e_r_s.  In the following example,
-       the SSH_AUTH_SOCK variable will be preserved in the envi-
-       ronment for all users.
+       manner as a global Defaults line in _/_e_t_c_/_s_u_d_o_e_r_s.  In the following
+       example, the SSH_AUTH_SOCK variable will be preserved in the environ-
+       ment for all users.
 
            dn: cn=defaults,ou=SUDOers,dc=example,dc=com
            objectClass: top
@@ -89,63 +81,60 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            description: Default sudoOption's go here
            sudoOption: env_keep+=SSH_AUTH_SOCK
 
-       The equivalent of a sudoer in LDAP is a sudoRole.  It con-
-       sists of the following components:
+       The equivalent of a sudoer in LDAP is a sudoRole.  It consists of the
+       following components:
 
        ssuuddooUUsseerr
-           A user name, uid (prefixed with '#'), Unix group (pre-
-           fixed with a '%') or user netgroup (prefixed with a
-           '+').
+           A user name, uid (prefixed with '#'), Unix group (prefixed with a
+           '%') or user netgroup (prefixed with a '+').
 
        ssuuddooHHoosstt
-           A host name, IP address, IP network, or host netgroup
-           (prefixed with a '+').  The special value ALL will
-           match any host.
+           A host name, IP address, IP network, or host netgroup (prefixed
+           with a '+').  The special value ALL will match any host.
 
        ssuuddooCCoommmmaanndd
-           A Unix command with optional command line arguments,
-           potentially including globbing characters (aka wild
-           cards).  The special value ALL will match any command.
-           If a command is prefixed with an exclamation point
-           '!', the user will be prohibited from running that
-           command.
+           A Unix command with optional command line arguments, potentially
+           including globbing characters (aka wild cards).  The special value
+           ALL will match any command.  If a command is prefixed with an
+           exclamation point '!', the user will be prohibited from running
+           that command.
 
        ssuuddooOOppttiioonn
-           Identical in function to the global options described
-           above, but specific to the sudoRole in which it
-           resides.
+           Identical in function to the global options described above, but
+           specific to the sudoRole in which it resides.
 
        ssuuddooRRuunnAAssUUsseerr
-           A user name or uid (prefixed with '#') that commands
-           may be run as or a Unix group (prefixed with a '%') or
-           user netgroup (prefixed with a '+') that contains a
-           list of users that commands may be run as.  The spe-
-           cial value ALL will match any user.
+           A user name or uid (prefixed with '#') that commands may be run as
+           or a Unix group (prefixed with a '%') or user netgroup (prefixed
+           with a '+') that contains a list of users that commands may be run
+           as.  The special value ALL will match any user.
 
        ssuuddooRRuunnAAssGGrroouupp
-           A Unix group or gid (prefixed with '#') that commands
+           A Unix group or gid (prefixed with '#') that commands may be run
+           as.  The special value ALL will match any group.
 
+       Each component listed above should contain a single value, but there
+       may be multiple instances of each component type.  A sudoRole must con-
+       tain at least one sudoUser, sudoHost and sudoCommand.
+
+       The following example allows users in group wheel to run any command on
+       any host via ssuuddoo:
 
 
-1.7                      January 20, 2008                       2
 
 
 
 
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
+1.7                      January 21, 2008                       2
 
-           may be run as.  The special value ALL will match any
-           group.
 
-       Each component listed above should contain a single value,
-       but there may be multiple instances of each component
-       type.  A sudoRole must contain at least one sudoUser,
-       sudoHost and sudoCommand.
 
-       The following example allows users in group wheel to run
-       any command on any host via ssuuddoo:
+
+
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+
 
            dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
            objectClass: top
@@ -157,25 +146,22 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
        AAnnaattoommyy ooff LLDDAAPP ssuuddooeerrss llooookkuupp
 
-       When looking up a sudoer using LDAP there are only two or
-       three LDAP queries per invocation.  The first query is to
-       parse the global options.  The second is to match against
-       the user's name and the groups that the user belongs to.
-       (The special ALL tag is matched in this query too.)  If no
-       match is returned for the user's name and groups, a third
-       query returns all entries containing user netgroups and
-       checks to see if the user belongs to any of them.
+       When looking up a sudoer using LDAP there are only two or three LDAP
+       queries per invocation.  The first query is to parse the global
+       options.  The second is to match against the user's name and the groups
+       that the user belongs to.  (The special ALL tag is matched in this
+       query too.)  If no match is returned for the user's name and groups, a
+       third query returns all entries containing user netgroups and checks to
+       see if the user belongs to any of them.
 
        DDiiffffeerreenncceess bbeettwweeeenn LLDDAAPP aanndd nnoonn--LLDDAAPP ssuuddooeerrss
 
-       There are some subtle differences in the way sudoers is
-       handled once in LDAP.  Probably the biggest is that
-       according to the RFC, LDAP ordering is arbitrary and you
-       cannot expect that Attributes and Entries are returned in
-       any specific order.  If there are conflicting command
-       rules on an entry, the negative takes precedence.  This is
-       called paranoid behavior (not necessarily the most spe-
-       cific match).
+       There are some subtle differences in the way sudoers is handled once in
+       LDAP.  Probably the biggest is that according to the RFC, LDAP ordering
+       is arbitrary and you cannot expect that Attributes and Entries are
+       returned in any specific order.  If there are conflicting command rules
+       on an entry, the negative takes precedence.  This is called paranoid
+       behavior (not necessarily the most specific match).
 
        Here is an example:
 
@@ -185,6 +171,16 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            # Always allows all commands because ALL is matched last
            puddles ALL=(root) !/bin/sh,ALL
 
+           # LDAP equivalent of johnny
+           # Allows all commands except shell
+           dn: cn=role1,ou=Sudoers,dc=my-domain,dc=com
+           objectClass: sudoRole
+           objectClass: top
+           cn: role1
+           sudoUser: johnny
+           sudoHost: ALL
+           sudoCommand: ALL
+           sudoCommand: !/bin/sh
 
 
 
@@ -193,25 +189,18 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
 
-1.7                      January 20, 2008                       3
 
 
 
 
+1.7                      January 21, 2008                       3
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           # LDAP equivalent of johnny
-           # Allows all commands except shell
-           dn: cn=role1,ou=Sudoers,dc=my-domain,dc=com
-           objectClass: sudoRole
-           objectClass: top
-           cn: role1
-           sudoUser: johnny
-           sudoHost: ALL
-           sudoCommand: ALL
-           sudoCommand: !/bin/sh
+
+
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+
 
            # LDAP equivalent of puddles
            # Notice that even though ALL comes last, it still behaves like
@@ -225,9 +214,9 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            sudoCommand: !/bin/sh
            sudoCommand: ALL
 
-       Another difference is that negations on the Host, User or
-       Runas are currently ignorred.  For example, the following
-       attributes do not behave the way one might expect.
+       Another difference is that negations on the Host, User or Runas are
+       currently ignorred.  For example, the following attributes do not
+       behave the way one might expect.
 
            # does not match all but joe
            # rather, does not match anyone
@@ -245,194 +234,178 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
        SSuuddooeerrss SScchheemmaa
 
-       In order to use ssuuddoo's LDAP support, the ssuuddoo schema must
-       be installed on your LDAP server.  In addition, be sure to
-       index the 'sudoUser' attribute.
-
-       Two versions of the schema, one for OpenLDAP servers
-       (_s_c_h_e_m_a_._O_p_e_n_L_D_A_P) and another for Netscape-derived servers
-       (_s_c_h_e_m_a_._i_P_l_a_n_e_t), may be found in the ssuuddoo distribution.
+       In order to use ssuuddoo's LDAP support, the ssuuddoo schema must be installed
+       on your LDAP server.  In addition, be sure to index the 'sudoUser'
+       attribute.
 
-       The schema for ssuuddoo in OpenLDAP form is included in the
-       EXAMPLES section.
+       Two versions of the schema, one for OpenLDAP servers (_s_c_h_e_m_a_._O_p_e_n_L_D_A_P)
+       and another for Netscape-derived servers (_s_c_h_e_m_a_._i_P_l_a_n_e_t), may be found
+       in the ssuuddoo distribution.
 
+       The schema for ssuuddoo in OpenLDAP form is included in the EXAMPLES sec-
+       tion.
 
+       CCoonnffiigguurriinngg llddaapp..ccoonnff
 
+       Sudo reads the _/_e_t_c_/_l_d_a_p_._c_o_n_f file for LDAP-specific configuration.
+       Typically, this file is shared amongst different LDAP-aware clients.
+       As such, most of the settings are not ssuuddoo-specific.  Note that ssuuddoo
+       parses _/_e_t_c_/_l_d_a_p_._c_o_n_f itself and may support options that differ from
+       those described in the _l_d_a_p_._c_o_n_f(4) manual.
 
-1.7                      January 20, 2008                       4
+       Also note that on systems using the OpenLDAP libraries, default values
+       specified in _/_e_t_c_/_o_p_e_n_l_d_a_p_/_l_d_a_p_._c_o_n_f or the user's _._l_d_a_p_r_c files are
+       not used.
 
 
 
+1.7                      January 21, 2008                       4
 
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-       CCoonnffiigguurriinngg llddaapp..ccoonnff
 
-       Sudo reads the _/_e_t_c_/_l_d_a_p_._c_o_n_f file for LDAP-specific con-
-       figuration.  Typically, this file is shared amongst dif-
-       ferent LDAP-aware clients.  As such, most of the settings
-       are not ssuuddoo-specific.  Note that ssuuddoo parses
-       _/_e_t_c_/_l_d_a_p_._c_o_n_f itself and may support options that differ
-       from those described in the _l_d_a_p_._c_o_n_f(4) manual.
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
-       Also note that on systems using the OpenLDAP libraries,
-       default values specified in _/_e_t_c_/_o_p_e_n_l_d_a_p_/_l_d_a_p_._c_o_n_f or the
-       user's _._l_d_a_p_r_c files are not used.
 
-       Only those options explicitly listed in _/_e_t_c_/_l_d_a_p_._c_o_n_f
-       that are supported by ssuuddoo are honored.  Configuration
-       options are listed below in upper case but are parsed in a
-       case-independent manner.
+       Only those options explicitly listed in _/_e_t_c_/_l_d_a_p_._c_o_n_f that are sup-
+       ported by ssuuddoo are honored.  Configuration options are listed below in
+       upper case but are parsed in a case-independent manner.
 
        UURRII ldap[s]://[hostname[:port]] ...
-           Specifies a whitespace-delimited list of one or more
-           URIs describing the LDAP server(s) to connect to.  The
-           _p_r_o_t_o_c_o_l may be either llddaapp or llddaappss, the latter being
-           for servers that support TLS (SSL) encryption.  If no
-           _p_o_r_t is specified, the default is port 389 for ldap://
-           or port 636 for ldaps://.  If no _h_o_s_t_n_a_m_e is speci-
-           fied, ssuuddoo will connect to llooccaallhhoosstt.  Only systems
-           using the OpenSSL libraries support the mixing of
-           ldap:// and ldaps:// URIs.  The Netscape-derived
-           libraries used on most commercial versions of Unix are
-           only capable of supporting one or the other.
+           Specifies a whitespace-delimited list of one or more URIs describ-
+           ing the LDAP server(s) to connect to.  The _p_r_o_t_o_c_o_l may be either
+           llddaapp or llddaappss, the latter being for servers that support TLS (SSL)
+           encryption.  If no _p_o_r_t is specified, the default is port 389 for
+           ldap:// or port 636 for ldaps://.  If no _h_o_s_t_n_a_m_e is specified,
+           ssuuddoo will connect to llooccaallhhoosstt.  Only systems using the OpenSSL
+           libraries support the mixing of ldap:// and ldaps:// URIs.  The
+           Netscape-derived libraries used on most commercial versions of Unix
+           are only capable of supporting one or the other.
 
        HHOOSSTT name[:port] ...
-           If no UURRII is specified, the HHOOSSTT parameter specifies a
-           whitespace-delimited list of LDAP servers to connect
-           to.  Each host may include an optional _p_o_r_t separated
-           by a colon (':').  The HHOOSSTT parameter is deprecated in
-           favor of the UURRII specification and is included for
-           backwards compatibility.
+           If no UURRII is specified, the HHOOSSTT parameter specifies a whitespace-
+           delimited list of LDAP servers to connect to.  Each host may
+           include an optional _p_o_r_t separated by a colon (':').  The HHOOSSTT
+           parameter is deprecated in favor of the UURRII specification and is
+           included for backwards compatibility.
 
        PPOORRTT port_number
-           If no UURRII is specified, the PPOORRTT parameter specifies
-           the default port to connect to on the LDAP server if a
-           HHOOSSTT parameter does not specify the port itself.  If
-           no PPOORRTT parameter is used, the default is port 389 for
-           LDAP and port 636 for LDAP over TLS (SSL).  The PPOORRTT
-           parameter is deprecated in favor of the UURRII specifica-
-           tion and is included for backwards compatibility.
+           If no UURRII is specified, the PPOORRTT parameter specifies the default
+           port to connect to on the LDAP server if a HHOOSSTT parameter does not
+           specify the port itself.  If no PPOORRTT parameter is used, the default
+           is port 389 for LDAP and port 636 for LDAP over TLS (SSL).  The
+           PPOORRTT parameter is deprecated in favor of the UURRII specification and
+           is included for backwards compatibility.
 
        BBIINNDD__TTIIMMEELLIIMMIITT seconds
-           The BBIINNDD__TTIIMMEELLIIMMIITT parameter specifies the amount of
-           time, in seconds, to wait while trying to connect to
-           an LDAP server.  If multiple UURRIIs or HHOOSSTTs are speci-
-           fied, this is the amount of time to wait before trying
-           the next one in the list.
+           The BBIINNDD__TTIIMMEELLIIMMIITT parameter specifies the amount of time, in sec-
+           onds, to wait while trying to connect to an LDAP server.  If multi-
+           ple UURRIIs or HHOOSSTTs are specified, this is the amount of time to wait
+           before trying the next one in the list.
 
+       TTIIMMEELLIIMMIITT seconds
+           The TTIIMMEELLIIMMIITT parameter specifies the amount of time, in seconds,
+           to wait for a response to an LDAP query.
 
+       SSUUDDOOEERRSS__BBAASSEE base
+           The base DN to use when performing ssuuddoo LDAP queries.  Typically
+           this is of the form ou=SUDOers,dc=example,dc=com for the domain
+           example.com.
 
-1.7                      January 20, 2008                       5
+       SSUUDDOOEERRSS__DDEEBBUUGG debug_level
+           This sets the debug level for ssuuddoo LDAP queries.  Debugging infor-
+           mation is printed to the standard error.  A value of 1 results in a
+           moderate amount of debugging information.  A value of 2 shows the
+           results of the matches themselves.  This parameter should not be
+           set in a production environment as the extra information is likely
+           to confuse users.
 
 
 
 
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+1.7                      January 21, 2008                       5
 
 
-       TTIIMMEELLIIMMIITT seconds
-           The TTIIMMEELLIIMMIITT parameter specifies the amount of time,
-           in seconds, to wait for a response to an LDAP query.
 
-       SSUUDDOOEERRSS__BBAASSEE base
-           The base DN to use when performing ssuuddoo LDAP queries.
-           Typically this is of the form ou=SUDOers,dc=exam-
-           ple,dc=com for the domain example.com.
 
-       SSUUDDOOEERRSS__DDEEBBUUGG debug_level
-           This sets the debug level for ssuuddoo LDAP queries.
-           Debugging information is printed to the standard
-           error.  A value of 1 results in a moderate amount of
-           debugging information.  A value of 2 shows the results
-           of the matches themselves.  This parameter should not
-           be set in a production environment as the extra infor-
-           mation is likely to confuse users.
+
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+
 
        BBIINNDDDDNN DN
-           The BBIINNDDDDNN parameter specifies the identity, in the
-           form of a Distinguished Name (DN), to use when per-
-           forming LDAP operations.  If not specified, LDAP oper-
-           ations are performed with an anonymous identity.  By
-           default, most LDAP servers will allow anonymous
+           The BBIINNDDDDNN parameter specifies the identity, in the form of a Dis-
+           tinguished Name (DN), to use when performing LDAP operations.  If
+           not specified, LDAP operations are performed with an anonymous
+           identity.  By default, most LDAP servers will allow anonymous
            access.
 
        BBIINNDDPPWW secret
-           The BBIINNDDPPWW parameter specifies the password to use
-           when performing LDAP operations.  This is typically
-           used in conjunction with the BBIINNDDDDNN parameter.
+           The BBIINNDDPPWW parameter specifies the password to use when performing
+           LDAP operations.  This is typically used in conjunction with the
+           BBIINNDDDDNN parameter.
 
        RROOOOTTBBIINNDDDDNN DN
-           The RROOOOTTBBIINNDDDDNN parameter specifies the identity, in
-           the form of a Distinguished Name (DN), to use when
-           performing privileged LDAP operations, such as _s_u_d_o_e_r_s
-           queries.  The password corresponding to the identity
-           should be stored in _/_e_t_c_/_l_d_a_p_._s_e_c_r_e_t.  If not speci-
+           The RROOOOTTBBIINNDDDDNN parameter specifies the identity, in the form of a
+           Distinguished Name (DN), to use when performing privileged LDAP
+           operations, such as _s_u_d_o_e_r_s queries.  The password corresponding to
+           the identity should be stored in _/_e_t_c_/_l_d_a_p_._s_e_c_r_e_t.  If not speci-
            fied, the BBIINNDDDDNN identity is used (if any).
 
        LLDDAAPP__VVEERRSSIIOONN number
-           The version of the LDAP protocol to use when connect-
-           ing to the server.  The default value is protocol ver-
-           sion 3.
+           The version of the LDAP protocol to use when connecting to the
+           server.  The default value is protocol version 3.
 
        SSSSLL on/true/yes/off/false/no
-           If the SSSSLL parameter is set to on, true or yes, TLS
-           (SSL) encryption is always used when communicating
-           with the LDAP server.  Typically, this involves con-
-           necting to the server on port 636 (ldaps).
+           If the SSSSLL parameter is set to on, true or yes, TLS (SSL) encryp-
+           tion is always used when communicating with the LDAP server.  Typi-
+           cally, this involves connecting to the server on port 636 (ldaps).
 
        SSSSLL start_tls
-           If the SSSSLL parameter is set to start_tls, the LDAP
-           server connection is initiated normally and TLS
-           encryption is begun before the bind credentials are
+           If the SSSSLL parameter is set to start_tls, the LDAP server connec-
+           tion is initiated normally and TLS encryption is begun before the
+           bind credentials are sent.  This has the advantage of not requiring
+           a dedicated port for encrypted communications.  This parameter is
+           only supported by LDAP servers that honor the start_tls extension,
+           such as the OpenLDAP server.
 
+       TTLLSS__CCHHEECCKKPPEEEERR on/true/yes/off/false/no
+           If enabled, TTLLSS__CCHHEECCKKPPEEEERR will cause the LDAP server's TLS certifi-
+           cated to be verified.  If the server's TLS certificate cannot be
+           verified (usually because it is signed by an unknown certificate
+           authority), ssuuddoo will be unable to connect to it.  If TTLLSS__CCHHEECCKKPPEEEERR
+           is disabled, no check is made.
 
+       TTLLSS__CCAACCEERRTTFFIILLEE file name
+           The path to a certificate authority bundle which contains the cer-
+           tificates for all the Certificate Authorities the client knows to
+           be valid, e.g. _/_e_t_c_/_s_s_l_/_c_a_-_b_u_n_d_l_e_._p_e_m.  This option is only sup-
+           ported by the OpenLDAP libraries.
 
-1.7                      January 20, 2008                       6
+       TTLLSS__CCAACCEERRTTDDIIRR directory
+           Similar to TTLLSS__CCAACCEERRTTFFIILLEE but instead of a file, it is a directory
+           containing individual Certificate Authority certificates, e.g.
+           _/_e_t_c_/_s_s_l_/_c_e_r_t_s.  The directory specified by TTLLSS__CCAACCEERRTTDDIIRR is
+           checked after TTLLSS__CCAACCEERRTTFFIILLEE.  This option is only supported by the
 
 
 
+1.7                      January 21, 2008                       6
 
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           sent.  This has the advantage of not requiring a dedi-
-           cated port for encrypted communications.  This parame-
-           ter is only supported by LDAP servers that honor the
-           start_tls extension, such as the OpenLDAP server.
 
-       TTLLSS__CCHHEECCKKPPEEEERR on/true/yes/off/false/no
-           If enabled, TTLLSS__CCHHEECCKKPPEEEERR will cause the LDAP server's
-           TLS certificated to be verified.  If the server's TLS
-           certificate cannot be verified (usually because it is
-           signed by an unknown certificate authority), ssuuddoo will
-           be unable to connect to it.  If TTLLSS__CCHHEECCKKPPEEEERR is dis-
-           abled, no check is made.
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
-       TTLLSS__CCAACCEERRTTFFIILLEE file name
-           The path to a certificate authority bundle which con-
-           tains the certificates for all the Certificate Author-
-           ities the client knows to be valid, e.g.
-           _/_e_t_c_/_s_s_l_/_c_a_-_b_u_n_d_l_e_._p_e_m.  This option is only supported
-           by the OpenLDAP libraries.
 
-       TTLLSS__CCAACCEERRTTDDIIRR directory
-           Similar to TTLLSS__CCAACCEERRTTFFIILLEE but instead of a file, it is
-           a directory containing individual Certificate Author-
-           ity certificates, e.g. _/_e_t_c_/_s_s_l_/_c_e_r_t_s.  The directory
-           specified by TTLLSS__CCAACCEERRTTDDIIRR is checked after TTLLSS__CCAACC--
-           EERRTTFFIILLEE.  This option is only supported by the OpenL-
-           DAP libraries.
+           OpenLDAP libraries.
 
        TTLLSS__CCEERRTT file name
-           The path to a file containing the client certificate
-           which can be used to authenticate the client to the
-           LDAP server.  The certificate type depends on the LDAP
-           libraries used.
+           The path to a file containing the client certificate which can be
+           used to authenticate the client to the LDAP server.  The certifi-
+           cate type depends on the LDAP libraries used.
 
            OpenLDAP:
                tls_cert /etc/ssl/client_cert.pem
@@ -440,14 +413,14 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            Netscape-derived:
                tls_cert /var/ldap/cert7.db
 
-           When using Netscape-derived libraries, this file may
-           also contain Certificate Authority certificates.
+           When using Netscape-derived libraries, this file may also contain
+           Certificate Authority certificates.
 
        TTLLSS__KKEEYY file name
-           The path to a file containing the private key which
-           matches the certificate specified by TTLLSS__CCEERRTT.  The
-           private key must not be password-protected.  The key
-           type depends on the LDAP libraries used.
+           The path to a file containing the private key which matches the
+           certificate specified by TTLLSS__CCEERRTT.  The private key must not be
+           password-protected.  The key type depends on the LDAP libraries
+           used.
 
            OpenLDAP:
                tls_cert /etc/ssl/client_key.pem
@@ -455,92 +428,72 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            Netscape-derived:
                tls_cert /var/ldap/key3.db
 
-
-
-1.7                      January 20, 2008                       7
-
-
-
-
-
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
-
-
        TTLLSS__RRAANNDDFFIILLEE file name
-           The TTLLSS__RRAANNDDFFIILLEE parameter specifies the path to an
-           entropy source for systems that lack a random device.
-           It is generally used in conjunction with _p_r_n_g_d or _e_g_d.
-           This option is only supported by the OpenLDAP
-           libraries.
+           The TTLLSS__RRAANNDDFFIILLEE parameter specifies the path to an entropy source
+           for systems that lack a random device.  It is generally used in
+           conjunction with _p_r_n_g_d or _e_g_d.  This option is only supported by
+           the OpenLDAP libraries.
 
        TTLLSS__CCIIPPHHEERRSS cipher list
-           The TTLLSS__CCIIPPHHEERRSS parameter allows the administer to
-           restrict which encryption algorithms may be used for
-           TLS (SSL) connections.  See the OpenSSL manual for a
-           list of valid ciphers.  This option is only supported
-           by the OpenLDAP libraries.
+           The TTLLSS__CCIIPPHHEERRSS parameter allows the administer to restrict which
+           encryption algorithms may be used for TLS (SSL) connections.  See
+           the OpenSSL manual for a list of valid ciphers.  This option is
+           only supported by the OpenLDAP libraries.
 
        UUSSEE__SSAASSLL on/true/yes/off/false/no
-           Enable UUSSEE__SSAASSLL for LDAP servers that support SASL
-           authentication.
+           Enable UUSSEE__SSAASSLL for LDAP servers that support SASL authentication.
 
        SSAASSLL__AAUUTTHH__IIDD identity
-           The SASL user name to use when connecting to the LDAP
-           server.  By default, ssuuddoo will use an anonymous con-
-           nection.
+           The SASL user name to use when connecting to the LDAP server.  By
+           default, ssuuddoo will use an anonymous connection.
 
        RROOOOTTUUSSEE__SSAASSLL on/true/yes/off/false/no
-           Enable RROOOOTTUUSSEE__SSAASSLL to enable SASL authentication when
-           connecting to an LDAP server from a privileged pro-
-           cess, such as ssuuddoo.
+           Enable RROOOOTTUUSSEE__SSAASSLL to enable SASL authentication when connecting
+           to an LDAP server from a privileged process, such as ssuuddoo.
 
        RROOOOTTSSAASSLL__AAUUTTHH__IIDD identity
-           The SASL user name to use when RROOOOTTUUSSEE__SSAASSLL is
-           enabled.
+           The SASL user name to use when RROOOOTTUUSSEE__SSAASSLL is enabled.
 
-       SSAASSLL__SSEECCPPRROOPPSS none/properties
-           SASL security properties or _n_o_n_e for no properties.
-           See the SASL programmer's manual for details.
 
-       KKRRBB55__CCCCNNAAMMEE file name
-           The path to the Kerberos 5 credential cache to use
-           when authenticating with the remote server.
 
-       See the ldap.conf entry in the EXAMPLES section.
 
-       CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff
+1.7                      January 21, 2008                       7
 
-       Sudo consults the Name Service Switch file, _/_e_t_c_/_n_s_s_-
-       _w_i_t_c_h_._c_o_n_f, to specify the _s_u_d_o_e_r_s search order.  Sudo
-       looks for a line beginning with sudoers: and uses this to
-       determine the search order.  Note that ssuuddoo does not stop
-       searching after the first match and later matches take
-       precedence over earlier ones.
-
-       The following sources are recognized:
 
 
 
 
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
-1.7                      January 20, 2008                       8
 
+       SSAASSLL__SSEECCPPRROOPPSS none/properties
+           SASL security properties or _n_o_n_e for no properties.  See the SASL
+           programmer's manual for details.
 
+       KKRRBB55__CCCCNNAAMMEE file name
+           The path to the Kerberos 5 credential cache to use when authenti-
+           cating with the remote server.
 
+       See the ldap.conf entry in the EXAMPLES section.
 
+       CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+       Sudo consults the Name Service Switch file, _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, to
+       specify the _s_u_d_o_e_r_s search order.  Sudo looks for a line beginning with
+       sudoers: and uses this to determine the search order.  Note that ssuuddoo
+       does not stop searching after the first match and later matches take
+       precedence over earlier ones.
 
+       The following sources are recognized:
 
            files       read sudoers from F</etc/sudoers>
            ldap        read sudoers from LDAP
 
-       In addition, the entry [NOTFOUND=return] will short-cir-
-       cuit the search if the user was not found in the preceding
-       source.
+       In addition, the entry [NOTFOUND=return] will short-circuit the search
+       if the user was not found in the preceding source.
 
-       To consult LDAP first followed by the local sudoers file
-       (if it exists), use:
+       To consult LDAP first followed by the local sudoers file (if it
+       exists), use:
 
            sudoers: ldap files
 
@@ -548,14 +501,13 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
            sudoers: ldap
 
-       If the _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f file is not present or there is
-       no sudoers line, the following default is assumed:
+       If the _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f file is not present or there is no sudoers
+       line, the following default is assumed:
 
            sudoers: files
 
-       Note that _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f is supported even when the
-       underlying operating system does not use an nsswitch.conf
-       file.
+       Note that _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f is supported even when the underlying
+       operating system does not use an nsswitch.conf file.
 
 FFIILLEESS
        _/_e_t_c_/_l_d_a_p_._c_o_n_f          LDAP configuration file
@@ -571,25 +523,7 @@ EEXXAAMMPPLLEESS
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-1.7                      January 20, 2008                       9
+1.7                      January 21, 2008                       8
 
 
 
@@ -655,7 +589,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
 
-1.7                      January 20, 2008                      10
+1.7                      January 21, 2008                       9
 
 
 
@@ -708,20 +642,20 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
        SSuuddoo sscchheemmaa ffoorr OOppeennLLDDAAPP
 
-       The following schema is in OpenLDAP format.  Simply copy
-       it to the schema directory (e.g. _/_e_t_c_/_o_p_e_n_l_d_a_p_/_s_c_h_e_m_a),
-       add the proper include line in slapd.conf and restart
-       ssllaappdd.
-
-
-
-
-
+       The following schema is in OpenLDAP format.  Simply copy it to the
+       schema directory (e.g. _/_e_t_c_/_o_p_e_n_l_d_a_p_/_s_c_h_e_m_a), add the proper include
+       line in slapd.conf and restart ssllaappdd.
 
+        attributetype ( 1.3.6.1.4.1.15953.9.1.1
+           NAME 'sudoUser'
+           DESC 'User(s) who may  run sudo'
+           EQUALITY caseExactIA5Match
+           SUBSTR caseExactIA5SubstringsMatch
+           SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
 
 
 
-1.7                      January 20, 2008                      11
+1.7                      January 21, 2008                      10
 
 
 
@@ -730,13 +664,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-        attributetype ( 1.3.6.1.4.1.15953.9.1.1
-           NAME 'sudoUser'
-           DESC 'User(s) who may  run sudo'
-           EQUALITY caseExactIA5Match
-           SUBSTR caseExactIA5SubstringsMatch
-           SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
-
         attributetype ( 1.3.6.1.4.1.15953.9.1.2
            NAME 'sudoHost'
            DESC 'Host(s) who may run sudo'
@@ -781,54 +708,61 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
                  sudoRunAsGroup $ sudoOption $ description )
            )
 
+       XXXXXX nnsssswwiittcchh..ccoonnff eexxaammppllee??
 
 
+       XXXXXX mmoorree eexxhhaauussttiivvee ssuuddooeerrss llddiiff eexxaammppllee??
 
 
-
-
-1.7                      January 20, 2008                      12
+SSEEEE AALLSSOO
+       _l_d_a_p_._c_o_n_f(4), _s_u_d_o_e_r_s(5)
 
 
 
 
 
-SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
+1.7                      January 21, 2008                      11
 
 
-       XXXXXX nnsssswwiittcchh..ccoonnff eexxaammppllee??
 
 
-       XXXXXX mmoorree eexxhhaauussttiivvee ssuuddooeerrss llddiiff eexxaammppllee??
 
+SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
-SSEEEE AALLSSOO
-       _l_d_a_p_._c_o_n_f(4), _s_u_d_o_e_r_s(5)
 
 CCAAVVEEAATTSS
-       The way that _s_u_d_o_e_r_s is parsed differs between Note that
-       there are differences in the way that LDAP-based _s_u_d_o_e_r_s
-       is parsed compared to file-based _s_u_d_o_e_r_s.  See the "Dif-
-       ferences between LDAP and non-LDAP sudoers" section for
-       more information.
+       The way that _s_u_d_o_e_r_s is parsed differs between Note that there are dif-
+       ferences in the way that LDAP-based _s_u_d_o_e_r_s is parsed compared to file-
+       based _s_u_d_o_e_r_s.  See the "Differences between LDAP and non-LDAP sudoers"
+       section for more information.
 
 BBUUGGSS
-       If you feel you have found a bug in ssuuddoo, please submit a
-       bug report at http://www.sudo.ws/sudo/bugs/
+       If you feel you have found a bug in ssuuddoo, please submit a bug report at
+       http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail-
-       ing list, see http://www.sudo.ws/mail-
-       man/listinfo/sudo-users to subscribe or search the
-       archives.
+       Limited free support is available via the sudo-users mailing list, see
+       http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
+       the archives.
 
 DDIISSCCLLAAIIMMEERR
-       ssuuddoo is provided ``AS IS'' and any express or implied war-
-       ranties, including, but not limited to, the implied war-
-       ranties of merchantability and fitness for a particular
-       purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
-       plete details.
+       ssuuddoo is provided ``AS IS'' and any express or implied warranties,
+       including, but not limited to, the implied warranties of merchantabil-
+       ity and fitness for a particular purpose are disclaimed.  See the
+       LICENSE file distributed with ssuuddoo or
+       http://www.sudo.ws/sudo/license.html for complete details.
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -853,6 +787,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7                      January 20, 2008                      13
+1.7                      January 21, 2008                      12
 
 
diff --git a/sudoers.ldap.man.in b/sudoers.ldap.man.in
index a9ba18438..2a40c0d10 100644
--- a/sudoers.ldap.man.in
+++ b/sudoers.ldap.man.in
@@ -146,7 +146,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOERS.LDAP @mansectform@"
-.TH SUDOERS.LDAP @mansectform@ "January 20, 2008" "1.7" "MAINTENANCE COMMANDS"
+.TH SUDOERS.LDAP @mansectform@ "January 21, 2008" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 sudoers.ldap \- sudo LDAP configuration
 .SH "DESCRIPTION"
@@ -174,11 +174,11 @@ limited options associated with user/host/commands/aliases.  The
 syntax is complicated and can be difficult for users to understand.
 Placing the options directly in the entry is more natural.
 .IP "\(bu" 4
-\&\fBvisudo\fR is no longer needed.  \fBvisudo\fR provides locking and
-syntax checking of the \fI@sysconfdir@/sudoers\fR file.  Since \s-1LDAP\s0 updates
-are atomic, locking is no longer necessary.  Because syntax is
-checked when the data is inserted into \s-1LDAP\s0, there is no need
-for a specialized tool to check syntax.
+The \fBvisudo\fR program is no longer needed.  \fBvisudo\fR provides
+locking and syntax checking of the \fI@sysconfdir@/sudoers\fR file.
+Since \s-1LDAP\s0 updates are atomic, locking is no longer necessary.
+Because syntax is checked when the data is inserted into \s-1LDAP\s0, there
+is no need for a specialized tool to check syntax.
 .PP
 Another major difference between \s-1LDAP\s0 and file-based \fIsudoers\fR
 is that in \s-1LDAP\s0, \fBsudo\fR\-specific Aliases are not supported.
diff --git a/sudoers.man.in b/sudoers.man.in
index 09e040c4c..8368bd0f0 100644
--- a/sudoers.man.in
+++ b/sudoers.man.in
@@ -150,7 +150,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOERS @mansectform@"
-.TH SUDOERS @mansectform@ "December 10, 2007" "1.7" "MAINTENANCE COMMANDS"
+.TH SUDOERS @mansectform@ "January 21, 2008" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 sudoers \- list of which users may execute what
 .SH "DESCRIPTION"
@@ -967,6 +967,11 @@ option is set)
 .el .IP "\f(CW%h\fR" 4
 .IX Item "%h"
 expanded to the local hostname without the domain name
+.ie n .IP "%p" 4
+.el .IP "\f(CW%p\fR" 4
+.IX Item "%p"
+expanded to the user whose password is being asked for (respects the 
+\&\fIrootpw\fR, \fItargetpw\fR and \fIrunaspw\fR flags in \fIsudoers\fR)
 .ie n .IP "%U" 4
 .el .IP "\f(CW%U\fR" 4
 .IX Item "%U"
diff --git a/visudo.cat b/visudo.cat
index 2035e7aaa..f2c951db1 100644
--- a/visudo.cat
+++ b/visudo.cat
@@ -11,91 +11,80 @@ SSYYNNOOPPSSIISS
        vviissuuddoo [--cc] [--qq] [--ss] [--VV] [--ff _s_u_d_o_e_r_s]
 
 DDEESSCCRRIIPPTTIIOONN
-       vviissuuddoo edits the _s_u_d_o_e_r_s file in a safe fashion, analogous
-       to _v_i_p_w(1m).  vviissuuddoo locks the _s_u_d_o_e_r_s file against multi-
-       ple simultaneous edits, provides basic sanity checks, and
-       checks for parse errors.  If the _s_u_d_o_e_r_s file is currently
-       being edited you will receive a message to try again
+       vviissuuddoo edits the _s_u_d_o_e_r_s file in a safe fashion, analogous to _v_i_p_w(1m).
+       vviissuuddoo locks the _s_u_d_o_e_r_s file against multiple simultaneous edits, pro-
+       vides basic sanity checks, and checks for parse errors.  If the _s_u_d_o_e_r_s
+       file is currently being edited you will receive a message to try again
        later.
 
-       There is a hard-coded list of editors that vviissuuddoo will use
-       set at compile-time that may be overridden via the _e_d_i_t_o_r
-       _s_u_d_o_e_r_s Default variable.  This list defaults to the path
-       to _v_i(1) on your system, as determined by the _c_o_n_f_i_g_u_r_e
-       script.  Normally, vviissuuddoo does not honor the VISUAL or
-       EDITOR environment variables unless they contain an editor
-       in the aforementioned editors list.  However, if vviissuuddoo is
-       configured with the _-_-_w_i_t_h_-_e_n_v_e_d_i_t_o_r flag or the _e_n_v___e_d_i_-
-       _t_o_r Default variable is set in _s_u_d_o_e_r_s, vviissuuddoo will use
-       any the editor defines by VISUAL or EDITOR.  Note that
-       this can be a security hole since it allows the user to
-       execute any program they wish simply by setting VISUAL or
-       EDITOR.
-
-       vviissuuddoo parses the _s_u_d_o_e_r_s file after the edit and will not
-       save the changes if there is a syntax error.  Upon finding
-       an error, vviissuuddoo will print a message stating the line
-       number(s) where the error occurred and the user will
-       receive the "What now?" prompt.  At this point the user
-       may enter "e" to re-edit the _s_u_d_o_e_r_s file, "x" to exit
-       without saving the changes, or "Q" to quit and save
-       changes.  The "Q" option should be used with extreme care
-       because if vviissuuddoo believes there to be a parse error, so
-       will ssuuddoo and no one will be able to ssuuddoo again until the
-       error is fixed.  If "e" is typed to edit the  _s_u_d_o_e_r_s file
-       after a parse error has been detected, the cursor will be
-       placed on the line where the error occurred (if the editor
-       supports this feature).
+       There is a hard-coded list of editors that vviissuuddoo will use set at com-
+       pile-time that may be overridden via the _e_d_i_t_o_r _s_u_d_o_e_r_s Default vari-
+       able.  This list defaults to the path to _v_i(1) on your system, as
+       determined by the _c_o_n_f_i_g_u_r_e script.  Normally, vviissuuddoo does not honor
+       the VISUAL or EDITOR environment variables unless they contain an edi-
+       tor in the aforementioned editors list.  However, if vviissuuddoo is config-
+       ured with the _-_-_w_i_t_h_-_e_n_v_e_d_i_t_o_r flag or the _e_n_v___e_d_i_t_o_r Default variable
+       is set in _s_u_d_o_e_r_s, vviissuuddoo will use any the editor defines by VISUAL or
+       EDITOR.  Note that this can be a security hole since it allows the user
+       to execute any program they wish simply by setting VISUAL or EDITOR.
+
+       vviissuuddoo parses the _s_u_d_o_e_r_s file after the edit and will not save the
+       changes if there is a syntax error.  Upon finding an error, vviissuuddoo will
+       print a message stating the line number(s) where the error occurred and
+       the user will receive the "What now?" prompt.  At this point the user
+       may enter "e" to re-edit the _s_u_d_o_e_r_s file, "x" to exit without saving
+       the changes, or "Q" to quit and save changes.  The "Q" option should be
+       used with extreme care because if vviissuuddoo believes there to be a parse
+       error, so will ssuuddoo and no one will be able to ssuuddoo again until the
+       error is fixed.  If "e" is typed to edit the  _s_u_d_o_e_r_s file after a
+       parse error has been detected, the cursor will be placed on the line
+       where the error occurred (if the editor supports this feature).
 
 OOPPTTIIOONNSS
        vviissuuddoo accepts the following command line options:
 
-       -c          Enable cchheecckk--oonnllyy mode.  The existing _s_u_d_o_e_r_s
-                   file will be checked for syntax and a message
-                   will be printed to the standard output detail-
-                   ing the status of _s_u_d_o_e_r_s.  If the syntax
-                   check completes successfully, vviissuuddoo will exit
-                   with a value of 0.  If a syntax error is
-                   encountered, vviissuuddoo will exit with a value of
-                   1.
+       -c          Enable cchheecckk--oonnllyy mode.  The existing _s_u_d_o_e_r_s file will be
+                   checked for syntax and a message will be printed to the
+                   standard output detailing the status of _s_u_d_o_e_r_s.  If the
+                   syntax check completes successfully, vviissuuddoo will exit with
+                   a value of 0.  If a syntax error is encountered, vviissuuddoo
+                   will exit with a value of 1.
+
+       -f _s_u_d_o_e_r_s  Specify and alternate _s_u_d_o_e_r_s file location.  With this
+                   option vviissuuddoo will edit (or check) the _s_u_d_o_e_r_s file of your
+                   choice, instead of the default, _/_e_t_c_/_s_u_d_o_e_r_s.  The lock
+                   file used is the specified _s_u_d_o_e_r_s file with ".tmp"
+                   appended to it.
 
+       -q          Enable qquuiieett mode.  In this mode details about syntax
+                   errors are not printed.  This option is only useful when
 
 
-1.7                      October 20, 2007                       1
 
+1.7                      January 21, 2008                       1
 
 
 
 
-VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
 
+VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
 
-       -f _s_u_d_o_e_r_s  Specify and alternate _s_u_d_o_e_r_s file location.
-                   With this option vviissuuddoo will edit (or check)
-                   the _s_u_d_o_e_r_s file of your choice, instead of
-                   the default, _/_e_t_c_/_s_u_d_o_e_r_s.  The lock file used
-                   is the specified _s_u_d_o_e_r_s file with ".tmp"
-                   appended to it.
 
-       -q          Enable qquuiieett mode.  In this mode details about
-                   syntax errors are not printed.  This option is
-                   only useful when combined with the --cc flag.
+                   combined with the --cc flag.
 
-       -s          Enable ssttrriicctt checking of the _s_u_d_o_e_r_s file.
-                   If an alias is used before it is defined,
-                   vviissuuddoo will consider this a parse error.  Note
-                   that it is not possible to differentiate
-                   between an alias and a hostname or username
-                   that consists solely of uppercase letters,
-                   digits, and the underscore ('_') character.
+       -s          Enable ssttrriicctt checking of the _s_u_d_o_e_r_s file.  If an alias is
+                   used before it is defined, vviissuuddoo will consider this a
+                   parse error.  Note that it is not possible to differentiate
+                   between an alias and a hostname or username that consists
+                   solely of uppercase letters, digits, and the underscore
+                   ('_') character.
 
-       -V          The --VV (version) option causes vviissuuddoo to print
-                   its version number and exit.
+       -V          The --VV (version) option causes vviissuuddoo to print its version
+                   number and exit.
 
 EENNVVIIRROONNMMEENNTT
-       The following environment variables may be consulted
-       depending on the value of the _e_d_i_t_o_r and _e_n_v___e_d_i_t_o_r _s_u_d_o_-
-       _e_r_s variables:
+       The following environment variables may be consulted depending on the
+       value of the _e_d_i_t_o_r and _e_n_v___e_d_i_t_o_r _s_u_d_o_e_r_s variables:
 
        VISUAL          Invoked by visudo as the editor to use
 
@@ -115,39 +104,37 @@ DDIIAAGGNNOOSSTTIICCSS
        Can't find you in the passwd database
            Your userid does not appear in the system passwd file.
 
-       Warning: {User,Runas,Host,Cmnd}_Alias referenced but not
-       defined
+       Warning: {User,Runas,Host,Cmnd}_Alias referenced but not defined
            Either you are trying to use an undeclare
-           {User,Runas,Host,Cmnd}_Alias or you have a user or
-           hostname listed that consists solely of uppercase let-
-           ters, digits, and the underscore ('_') character.  In
-           the latter case, you can ignore the warnings (ssuuddoo
-           will not complain).  In --ss (strict) mode these are
+           {User,Runas,Host,Cmnd}_Alias or you have a user or hostname listed
+           that consists solely of uppercase letters, digits, and the under-
+           score ('_') character.  In the latter case, you can ignore the
+           warnings (ssuuddoo will not complain).  In --ss (strict) mode these are
            errors, not warnings.
 
+       Warning: unused {User,Runas,Host,Cmnd}_Alias
+           The specified {User,Runas,Host,Cmnd}_Alias was defined but never
+           used.  You may wish to comment out or remove the unused alias.  In
+           --ss (strict) mode this is an error, not a warning.
 
+SSEEEE AALLSSOO
+       _v_i(1), _s_u_d_o_e_r_s(4), _s_u_d_o(1m), _v_i_p_w(8)
 
-1.7                      October 20, 2007                       2
+AAUUTTHHOORR
+       Many people have worked on _s_u_d_o over the years; this version of vviissuuddoo
+       was written by:
 
 
 
 
+1.7                      January 21, 2008                       2
 
-VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
 
 
-       Warning: unused {User,Runas,Host,Cmnd}_Alias
-           The specified {User,Runas,Host,Cmnd}_Alias was defined
-           but never used.  You may wish to comment out or remove
-           the unused alias.  In --ss (strict) mode this is an
-           error, not a warning.
 
-SSEEEE AALLSSOO
-       _v_i(1), _s_u_d_o_e_r_s(4), _s_u_d_o(1m), _v_i_p_w(8)
 
-AAUUTTHHOORR
-       Many people have worked on _s_u_d_o over the years; this ver-
-       sion of vviissuuddoo was written by:
+VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
+
 
         Todd Miller
 
@@ -155,26 +142,39 @@ AAUUTTHHOORR
        http://www.sudo.ws/sudo/history.html for more details.
 
 CCAAVVEEAATTSS
-       There is no easy way to prevent a user from gaining a root
-       shell if the editor used by vviissuuddoo allows shell escapes.
+       There is no easy way to prevent a user from gaining a root shell if the
+       editor used by vviissuuddoo allows shell escapes.
 
 BBUUGGSS
-       If you feel you have found a bug in vviissuuddoo, please submit
-       a bug report at http://www.sudo.ws/sudo/bugs/
+       If you feel you have found a bug in vviissuuddoo, please submit a bug report
+       at http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail-
-       ing list, see http://www.sudo.ws/mail-
-       man/listinfo/sudo-users to subscribe or search the
-       archives.
+       Limited free support is available via the sudo-users mailing list, see
+       http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or search
+       the archives.
 
 DDIISSCCLLAAIIMMEERR
-       vviissuuddoo is provided ``AS IS'' and any express or implied
-       warranties, including, but not limited to, the implied
-       warranties of merchantability and fitness for a particular
-       purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
-       plete details.
+       vviissuuddoo is provided ``AS IS'' and any express or implied warranties,
+       including, but not limited to, the implied warranties of merchantabil-
+       ity and fitness for a particular purpose are disclaimed.  See the
+       LICENSE file distributed with ssuuddoo or
+       http://www.sudo.ws/sudo/license.html for complete details.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
 
 
@@ -193,6 +193,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7                      October 20, 2007                       3
+1.7                      January 21, 2008                       3
 
 
diff --git a/visudo.man.in b/visudo.man.in
index cb32f061f..ecefe4477 100644
--- a/visudo.man.in
+++ b/visudo.man.in
@@ -149,7 +149,7 @@
 .\" ========================================================================
 .\"
 .IX Title "VISUDO @mansectsu@"
-.TH VISUDO @mansectsu@ "October 20, 2007" "1.7" "MAINTENANCE COMMANDS"
+.TH VISUDO @mansectsu@ "January 21, 2008" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 visudo \- edit the sudoers file
 .SH "SYNOPSIS"