From 5ab2e076771b490a1de64f669cb8f110a758ee1d Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Date: Wed, 15 Aug 2007 15:21:14 +0000
Subject: [PATCH] regen

---
 sudo.cat       |  368 +++++------
 sudo.man.in    |  226 +++----
 sudoers.cat    | 1642 +++++++++++++++++++++++-------------------------
 sudoers.man.in |  643 +++++++++----------
 visudo.cat     |   42 +-
 visudo.man.in  |   37 +-
 6 files changed, 1428 insertions(+), 1530 deletions(-)

diff --git a/sudo.cat b/sudo.cat
index 4f953eacb..cf188abbd 100644
--- a/sudo.cat
+++ b/sudo.cat
@@ -8,16 +8,16 @@ NNAAMMEE
        sudo, sudoedit - execute a command as another user
 
 SSYYNNOOPPSSIISS
-       ssuuddoo --KK | --kk | --hh | --LL | --VV | --vv
+       ssuuddoo --hh | --KK | --kk | --LL | --VV | --vv
 
        ssuuddoo --ll [--UU _u_s_e_r_n_a_m_e] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
 
        ssuuddoo [--bbEEHHPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
-       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e]
-       {--ee file [...] | --ii | --ss | _c_o_m_m_a_n_d}
+       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] {--ii | --ss | _c_o_m_-
+       _m_a_n_d}
 
-       ssuuddooeeddiitt [--aa _a_u_t_h___t_y_p_e] [--pp _p_r_o_m_p_t] [--SS] [--uu _u_s_e_r_­
-       _n_a_m_e|_#_u_i_d] file [...]
+       ssuuddooeeddiitt [--SS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
+       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] file ...
 
 DDEESSCCRRIIPPTTIIOONN
        ssuuddoo allows a permitted user to execute a _c_o_m_m_a_n_d as the
@@ -25,10 +25,10 @@ DDEESSCCRRIIPPTTIIOONN
        file.  The real and effective uid and gid are set to match
        those of the target user as specified in the passwd file
        and the group vector is initialized based on the group
-       file (unless the --PP option was specified).  If the invok­
+       file (unless the --PP option was specified).  If the invok-
        ing user is root or if the target user is the same as the
        invoking user, no password is required.  Otherwise, ssuuddoo
-       requires that users authenticate themselves with a pass­
+       requires that users authenticate themselves with a pass-
        word by default (NOTE: in the default configuration this
        is the user's password, not the root password).  Once a
        user has been authenticated, a timestamp is updated and
@@ -39,29 +39,29 @@ DDEESSCCRRIIPPTTIIOONN
        is implied.
 
        ssuuddoo determines who is an authorized user by consulting
-       the file _/_e_t_c_/_s_u_d_o_e_r_s.  By giving ssuuddoo the --vv flag a user
-       can update the time stamp without running a _c_o_m_m_a_n_d_. The
+       the file _/_e_t_c_/_s_u_d_o_e_r_s.  By giving ssuuddoo the --vv flag, a user
+       can update the time stamp without running a _c_o_m_m_a_n_d. The
        password prompt itself will also time out if the user's
-       password is not entered within 5 minutes (unless overrid­
+       password is not entered within 5 minutes (unless overrid-
        den via _s_u_d_o_e_r_s).
 
        If a user who is not listed in the _s_u_d_o_e_r_s file tries to
-       run a command via ssuuddoo, mail is sent to the proper author­
+       run a command via ssuuddoo, mail is sent to the proper author-
        ities, as defined at configure time or in the _s_u_d_o_e_r_s file
        (defaults to root).  Note that the mail will not be sent
        if an unauthorized user tries to run sudo with the --ll or
        --vv flags.  This allows users to determine for themselves
        whether or not they are allowed to use ssuuddoo.
 
-       If ssuuddoo is run by root and the SUDO_USER environment vari­
+       If ssuuddoo is run by root and the SUDO_USER environment vari-
        able is set, ssuuddoo will use this value to determine who the
-       actual user is.  This can be used by a user to log com­
+       actual user is.  This can be used by a user to log com-
        mands through sudo even when a root shell has been
        invoked.  It also allows the --ee flag to remain useful even
 
 
 
-1.7                       June 23, 2007                         1
+1.7                      August 15, 2007                        1
 
 
 
@@ -84,50 +84,50 @@ OOPPTTIIOONNSS
 
        -a  The --aa (_a_u_t_h_e_n_t_i_c_a_t_i_o_n _t_y_p_e) option causes ssuuddoo to use
            the specified authentication type when validating the
-           user, as allowed by /etc/login.conf.  The system
+           user, as allowed by _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  The system
            administrator may specify a list of sudo-specific
            authentication methods by adding an "auth-sudo" entry
-           in /etc/login.conf.  This option is only available on
-           systems that support BSD authentication where ssuuddoo has
-           been configured with the --with-bsdauth option.
+           in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f.  This option is only available on
+           systems that support BSD authentication.
 
        -b  The --bb (_b_a_c_k_g_r_o_u_n_d) option tells ssuuddoo to run the given
            command in the background.  Note that if you use the
-           --bb option you cannot use shell job control to manipu­
+           --bb option you cannot use shell job control to manipu-
            late the process.
 
        -C fd
            Normally, ssuuddoo will close all open file descriptors
-           other than standard input, standard output and stan­
+           other than standard input, standard output and stan-
            dard error.  The --CC (_c_l_o_s_e _f_r_o_m) option allows the
            user to specify a starting point above the standard
            error (file descriptor three).  Values less than three
            are not permitted.  This option is only available if
            the administrator has enabled the _c_l_o_s_e_f_r_o_m___o_v_e_r_r_i_d_e
-           option in sudoers(4).
+           option in _s_u_d_o_e_r_s(4).
 
        -c  The --cc (_c_l_a_s_s) option causes ssuuddoo to run the specified
            command with resources limited by the specified login
            class.  The _c_l_a_s_s argument can be either a class name
-           as defined in /etc/login.conf, or a single '-' charac­
-           ter.  Specifying a _c_l_a_s_s of - indicates that the com­
+           as defined in _/_e_t_c_/_l_o_g_i_n_._c_o_n_f, or a single '-' charac-
+           ter.  Specifying a _c_l_a_s_s of - indicates that the com-
            mand should be run restricted by the default login
            capabilities for the user the command is run as.  If
            the _c_l_a_s_s argument specifies an existing user class,
            the command must be run as root, or the ssuuddoo command
            must be run from a shell that is already root.  This
            option is only available on systems with BSD login
-           classes where ssuuddoo has been configured with the
-           --with-logincap option.
+           classes.
 
        -E  The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option will override the
-           _e_n_v___r_e_s_e_t option in sudoers(4)).  It is only available
+           _e_n_v___r_e_s_e_t option in _s_u_d_o_e_r_s(4)).  It is only available
            when either the matching command has the SETENV tag or
-           the _s_e_t_e_n_v option is set in sudoers(4).
+           the _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s(4).
 
+       -e  The --ee (_e_d_i_t) option indicates that, instead of
 
 
-1.7                       June 23, 2007                         2
+
+1.7                      August 15, 2007                        2
 
 
 
@@ -136,27 +136,25 @@ OOPPTTIIOONNSS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
-       -e  The --ee (_e_d_i_t) option indicates that, instead of run­
-           ning a command, the user wishes to edit one or more
+           running a command, the user wishes to edit one or more
            files.  In lieu of a command, the string "sudoedit" is
            used when consulting the _s_u_d_o_e_r_s file.  If the user is
            authorized by _s_u_d_o_e_r_s the following steps are taken:
 
-           1.      Temporary copies are made of the files to be
-                   edited with the owner set to the invoking
-                   user.
+           1.  Temporary copies are made of the files to be
+               edited with the owner set to the invoking user.
 
-           2.      The editor specified by the VISUAL or EDITOR
-                   environment variables is run to edit the tem­
-                   porary files.  If neither VISUAL nor EDITOR
-                   are set, the program listed in the _e_d_i_t_o_r
-                   _s_u_d_o_e_r_s variable is used.
+           2.  The editor specified by the VISUAL or EDITOR envi-
+               ronment variables is run to edit the temporary
+               files.  If neither VISUAL nor EDITOR are set, the
+               program listed in the _e_d_i_t_o_r _s_u_d_o_e_r_s variable is
+               used.
 
-           3.      If they have been modified, the temporary
-                   files are copied back to their original loca­
-                   tion and the temporary versions are removed.
+           3.  If they have been modified, the temporary files
+               are copied back to their original location and the
+               temporary versions are removed.
 
-           If the specified file does not exist, it will be cre­
+           If the specified file does not exist, it will be cre-
            ated.  Note that unlike most commands run by ssuuddoo, the
            editor is run with the invoking user's environment
            unmodified.  If, for some reason, ssuuddoo is unable to
@@ -164,23 +162,23 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
            receive a warning and the edited copy will remain in a
            temporary file.
 
-       -H  The --HH (_H_O_M_E) option sets the HOME environment vari­
+       -H  The --HH (_H_O_M_E) option sets the HOME environment vari-
            able to the homedir of the target user (root by
-           default) as specified in passwd(4).  By default, ssuuddoo
+           default) as specified in _p_a_s_s_w_d(4).  By default, ssuuddoo
            does not modify HOME (see _s_e_t___h_o_m_e and _a_l_w_a_y_s___s_e_t___h_o_m_e
-           in sudoers(4)).
+           in _s_u_d_o_e_r_s(4)).
 
-       -h  The --hh (_h_e_l_p) option causes ssuuddoo to print a usage mes­
+       -h  The --hh (_h_e_l_p) option causes ssuuddoo to print a usage mes-
            sage and exit.
 
        -i  The --ii (_s_i_m_u_l_a_t_e _i_n_i_t_i_a_l _l_o_g_i_n) option runs the shell
-           specified in the passwd(4) entry of the user that the
+           specified in the _p_a_s_s_w_d(4) entry of the user that the
            command is being run as.  The command name argument
            given to the shell begins with a `-' to tell the shell
            to run as a login shell.  ssuuddoo attempts to change to
            that user's home directory before running the shell.
            It also initializes the environment, leaving _D_I_S_P_L_A_Y
-           and _T_E_R_M unchanged, setting _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_­
+           and _T_E_R_M unchanged, setting _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_-
            _N_A_M_E, and _P_A_T_H, and unsetting all other environment
            variables.
 
@@ -190,10 +188,12 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        -k  The --kk (_k_i_l_l) option to ssuuddoo invalidates the user's
            timestamp by setting the time on it to the Epoch.  The
+           next time ssuuddoo is run a password will be required.
+           This option does not require a password and was added
 
 
 
-1.7                       June 23, 2007                         3
+1.7                      August 15, 2007                        3
 
 
 
@@ -202,12 +202,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
-           next time ssuuddoo is run a password will be required.
-           This option does not require a password and was added
            to allow a user to revoke ssuuddoo permissions from a
            .logout file.
 
-       -L  The --LL (_l_i_s_t defaults) option will list out the param­
+       -L  The --LL (_l_i_s_t defaults) option will list out the param-
            eters that may be set in a _D_e_f_a_u_l_t_s line along with a
            short description for each.  This option is useful in
            conjunction with _g_r_e_p(1).
@@ -218,7 +216,7 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
            invoking user (or the user specified by the --UU option)
            on the current host.  If a _c_o_m_m_a_n_d is specified and is
            permitted by _s_u_d_o_e_r_s, the fully-qualified path to the
-           command is displayed along with any command line argu­
+           command is displayed along with any command line argu-
            ments.  If _c_o_m_m_a_n_d is not allowed, ssuuddoo will exit with
            a return value of 1.
 
@@ -233,21 +231,20 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
            default password prompt and use a custom one.  The
            following percent (`%') escapes are supported:
 
-           %u      expanded to the invoking user's login name
+           %H  expanded to the local hostname including the
+               domain name (on if the machine's hostname is fully
+               qualified or the _f_q_d_n _s_u_d_o_e_r_s option is set)
 
-           %U      expanded to the login name of the user the
-                   command will be run as (defaults to root)
+           %h  expanded to the local hostname without the domain
+               name
 
-           %h      expanded to the local hostname without the
-                   domain name
+           %U  expanded to the login name of the user the command
+               will be run as (defaults to root)
 
-           %H      expanded to the local hostname including the
-                   domain name (on if the machine's hostname is
-                   fully qualified or the _f_q_d_n _s_u_d_o_e_r_s option is
-                   set)
+           %u  expanded to the invoking user's login name
 
-           %%      two consecutive % characters are collapsed
-                   into a single % character
+           %%  two consecutive % characters are collapsed into a
+               single % character
 
        -S  The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password
            from the standard input instead of the terminal
@@ -255,11 +252,14 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        -s  The --ss (_s_h_e_l_l) option runs the shell specified by the
            _S_H_E_L_L environment variable if it is set or the shell
-           as specified in passwd(4).
+           as specified in _p_a_s_s_w_d(4).
+
+       -U  The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with
+           the --ll option to specify the user whose privileges
 
 
 
-1.7                       June 23, 2007                         4
+1.7                      August 15, 2007                        4
 
 
 
@@ -268,40 +268,43 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
-       -U  The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with
-           the --ll option to specify the user whose privileges
            should be listed.  Only root or a user with ssuuddoo ALL
            on the current host may use this option.
 
        -u  The --uu (_u_s_e_r) option causes ssuuddoo to run the specified
            command as a user other than _r_o_o_t.  To specify a _u_i_d
-           instead of a _u_s_e_r_n_a_m_e, use _#_u_i_d.  Note that if the
-           _t_a_r_g_e_t_p_w Defaults option is set (see sudoers(4)) it is
+           instead of a _u_s_e_r_n_a_m_e, use _#_u_i_d.  When running com-
+           mands as a _u_i_d, many shells require that the '#' be
+           escaped with a backslash ('\').  Note that if the _t_a_r_-
+           _g_e_t_p_w Defaults option is set (see _s_u_d_o_e_r_s(4)) it is
            not possible to run commands with a uid not listed in
            the password database.
 
-       -V  The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the ver­
+       -V  The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the ver-
            sion number and exit.  If the invoking user is already
            root the --VV option will print out a list of the
            defaults ssuuddoo was compiled with as well as the
            machine's local network addresses.
 
        -v  If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update
-           the user's timestamp, prompting for the user's pass­
+           the user's timestamp, prompting for the user's pass-
            word if necessary.  This extends the ssuuddoo timeout for
            another 5 minutes (or whatever the timeout is set to
            in _s_u_d_o_e_r_s) but does not run a command.
 
        --  The ---- flag indicates that ssuuddoo should stop processing
-           command line arguments.  It is most useful in conjunc­
+           command line arguments.  It is most useful in conjunc-
            tion with the --ss flag.
 
        Environment variables to be set for the command may also
        be passed on the command line in the form of VVAARR=_v_a_l_u_e,
-       e.g.  LLDD__LLIIBBRRAARRYY__PPAATTHH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  This is only
-       permitted when the _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s or the
-       command to be run has the SETENV tag set.  See sudoers(4)
-       for more information.
+       e.g.  LLDD__LLIIBBRRAARRYY__PPAATTHH=_/_u_s_r_/_l_o_c_a_l_/_p_k_g_/_l_i_b.  Variables
+       passed on the command line are subject to the same
+       restrictions as normal environment variables with one
+       important exception.  If the _s_e_t_e_n_v option is set in _s_u_d_o_-
+       _e_r_s or the command to be run has the SETENV tag set the
+       user may set variables that would overwise be forbidden.
+       See _s_u_d_o_e_r_s(4) for more information.
 
 RREETTUURRNN VVAALLUUEESS
        Upon successful execution of a program, the return value
@@ -309,23 +312,20 @@ RREETTUURRNN VVAALLUUEESS
        that was executed.
 
        Otherwise, ssuuddoo quits with an exit value of 1 if there is
-       a configuration/permission problem or if ssuuddoo cannot exe­
+       a configuration/permission problem or if ssuuddoo cannot exe-
        cute the given command.  In the latter case the error
        string is printed to stderr.  If ssuuddoo cannot _s_t_a_t(2) one
        or more entries in the user's PATH an error is printed on
        stderr.  (If the directory does not exist or if it is not
        really a directory, the entry is ignored and no error is
-       printed.)  This should not happen under normal circum­
+       printed.)  This should not happen under normal circum-
        stances.  The most common reason for _s_t_a_t(2) to return
        "permission denied" is if you are running an automounter
        and one of the directories in your PATH is on a machine
-       that is currently unreachable.
-
-
 
 
 
-1.7                       June 23, 2007                         5
+1.7                      August 15, 2007                        5
 
 
 
@@ -334,43 +334,52 @@ RREETTUURRNN VVAALLUUEESS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       that is currently unreachable.
+
 SSEECCUURRIITTYY NNOOTTEESS
        ssuuddoo tries to be safe when executing external commands.
-       Variables that control how dynamic loading and binding is
-       done can be used to subvert the program that ssuuddoo runs.
-       To combat this the LD_*, _RLD_*, SHLIB_PATH (HP-UX only),
-       and LIBPATH (AIX only) environment variables are removed
-       from the environment passed on to all commands executed.
-       ssuuddoo will also remove the IFS, CDPATH, ENV, BASH_ENV,
-       KRB_CONF, KRBCONFDIR, KRBTKFILE, KRB5_CONFIG, LOCALDOMAIN,
-       RES_OPTIONS, HOSTALIASES, NLSPATH, PATH_LOCALE, TERMINFO,
-       TERMINFO_DIRS and TERMPATH variables as they too can pose
-       a threat.  If the TERMCAP variable is set and is a path­
-       name, it too is ignored.  Additionally, if the LC_* or
-       LANGUAGE variables contain the / or % characters, they are
-       ignored.  Environment variables with a value beginning
-       with () are also removed as they could be interpreted as
-       bbaasshh functions.  If ssuuddoo has been compiled with SecurID
-       support, the VAR_ACE, USR_ACE and DLC_ACE variables are
-       cleared as well.  The list of environment variables that
-       ssuuddoo clears is contained in the output of sudo -V when run
-       as root.
+
+       There are two distinct ways to deal with environment vari-
+       ables.  By default, the _e_n_v___r_e_s_e_t _s_u_d_o_e_r_s option is
+       enabled.  This causes commands to be executed with a mini-
+       mal environment containing TERM, PATH, HOME, SHELL, LOG-
+       NAME, USER and USERNAME in addition to variables from the
+       invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p
+       _s_u_d_o_e_r_s options.  There is effectively a whitelist for
+       environment variables.
+
+       If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s,
+       any variables not explicitly denied by the _e_n_v___c_h_e_c_k and
+       _e_n_v___d_e_l_e_t_e options are inherited from the invoking pro-
+       cess.  In this case, _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e behave like
+       a blacklist.  Since it is not possible to blacklist all
+       potentially dangerous environment variables, use of the
+       default _e_n_v___r_e_s_e_t behavior is encouraged.
+
+       In all cases, environment variables with a value beginning
+       with () are removed as they could be interpreted as bbaasshh
+       functions.  The list of environment variables that ssuuddoo
+       allows or denies is contained in the output of sudo -V
+       when run as root.
+
+       Note that the dynamic linker on most operating systems
+       will remove variables that can control dynamic linking
+       from the environment of setuid executables, including
+       ssuuddoo.  Depending on the operating system this may include
+       _RLD*, DYLD_*, LD_*, LDR_*, LIBPATH, SHLIB_PATH, and oth-
+       ers.  These type of variables are removed from the envi-
+       ronment before ssuuddoo even begins execution and, as such, it
+       is not possible for ssuuddoo to preserve them.
 
        To prevent command spoofing, ssuuddoo checks "." and "" (both
-       denoting current directory) last when searching for a com­
+       denoting current directory) last when searching for a com-
        mand in the user's PATH (if one or both are in the PATH).
        Note, however, that the actual PATH environment variable
        is _n_o_t modified and is passed unchanged to the program
        that ssuuddoo executes.
 
-       For security reasons, if your OS supports shared libraries
-       and does not disable user-defined library search paths for
-       setuid programs (most do), you should either use a linker
-       option that disables this behavior or link ssuuddoo stati­
-       cally.
-
        ssuuddoo will check the ownership of its timestamp directory
-       (_/_v_a_r_/_r_u_n_/_s_u_d_o by default) and ignore the directory's con­
+       (_/_v_a_r_/_r_u_n_/_s_u_d_o by default) and ignore the directory's con-
        tents if it is not owned by root or if it is writable by a
        user other than root.  On systems that allow non-root
        users to give away files via _c_h_o_w_n(2), if the timestamp
@@ -379,19 +388,10 @@ SSEECCUURRIITTYY NNOOTTEESS
        timestamp directory before ssuuddoo is run.  However, because
        ssuuddoo checks the ownership and mode of the directory and
        its contents, the only damage that can be done is to
-       "hide" files by putting them in the timestamp dir.  This
-       is unlikely to happen since once the timestamp dir is
-       owned by root and inaccessible by any other user, the user
-       placing files there would be unable to get them back out.
-       To get around this issue you can use a directory that is
-       not world-writable for the timestamps (_/_v_a_r_/_a_d_m_/_s_u_d_o for
-       instance) or create _/_v_a_r_/_r_u_n_/_s_u_d_o with the appropriate
-       owner (root) and permissions (0700) in the system startup
-       files.
 
 
 
-1.7                       June 23, 2007                         6
+1.7                      August 15, 2007                        6
 
 
 
@@ -400,6 +400,16 @@ SSEECCUURRIITTYY NNOOTTEESS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       "hide" files by putting them in the timestamp dir.  This
+       is unlikely to happen since once the timestamp dir is
+       owned by root and inaccessible by any other user, the user
+       placing files there would be unable to get them back out.
+       To get around this issue you can use a directory that is
+       not world-writable for the timestamps (_/_v_a_r_/_a_d_m_/_s_u_d_o for
+       instance) or create _/_v_a_r_/_r_u_n_/_s_u_d_o with the appropriate
+       owner (root) and permissions (0700) in the system startup
+       files.
+
        ssuuddoo will not honor timestamps set far in the future.
        Timestamps with a date greater than current_time + 2 *
        TIMEOUT will be ignored and sudo will log and complain.
@@ -415,59 +425,64 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
        escapes (including most editors).  Because of this, care
        must be taken when giving users access to commands via
        ssuuddoo to verify that the command does not inadvertently
-       give the user an effective root shell.  For more informa­
+       give the user an effective root shell.  For more informa-
        tion, please see the PREVENTING SHELL ESCAPES section in
-       sudoers(4).
+       _s_u_d_o_e_r_s(4).
 
 EENNVVIIRROONNMMEENNTT
        ssuuddoo utilizes the following environment variables:
 
-        EDITOR                 Default editor to use in -e (sudoedit) mode if
-                               VISUAL is not set
+       EDITOR          Default editor to use in --ee (sudoedit)
+                       mode if VISUAL is not set
 
-        HOME                   In -s or -H mode (or if sudo was configured with
-                               the --enable-shell-sets-home option), set to
-                               homedir of the target user
+       HOME            In --ss or --HH mode (or if sudo was config-
+                       ured with the --enable-shell-sets-home
+                       option), set to homedir of the target user
 
-        PATH                   Set to a sane value if sudo was configured with
-                               the --with-secure-path option
+       PATH            Set to a sane value if the _s_e_c_u_r_e___p_a_t_h
+                       sudoers option is set.
 
-        SHELL                  Used to determine shell to run with -s option
+       SHELL           Used to determine shell to run with -s
+                       option
 
-        SUDO_PROMPT            Used as the default password prompt
+       SUDO_PROMPT     Used as the default password prompt
 
-        SUDO_COMMAND           Set to the command run by sudo
+       SUDO_COMMAND    Set to the command run by sudo
 
-        SUDO_USER              Set to the login of the user who invoked sudo
+       SUDO_USER       Set to the login of the user who invoked
+                       sudo
 
-        SUDO_UID               Set to the uid of the user who invoked sudo
+       SUDO_UID        Set to the uid of the user who invoked
+                       sudo
 
-        SUDO_GID               Set to the gid of the user who invoked sudo
 
-        SUDO_PS1               If set, PS1 will be set to its value
 
-        USER                   Set to the target user (root unless the -u option
-                               is specified)
+1.7                      August 15, 2007                        7
 
-        VISUAL                 Default editor to use in -e (sudoedit) mode
 
-FFIILLEESS
-        /etc/sudoers           List of who can run what
-        /var/run/sudo              Directory containing timestamps
 
 
 
-1.7                       June 23, 2007                         7
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       SUDO_GID        Set to the gid of the user who invoked
+                       sudo
 
+       SUDO_PS1        If set, PS1 will be set to its value
 
+       USER            Set to the target user (root unless the --uu
+                       option is specified)
 
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+       VISUAL          Default editor to use in --ee (sudoedit)
+                       mode
 
+FFIILLEESS
+       _/_e_t_c_/_s_u_d_o_e_r_s        List of who can run what
+       _/_v_a_r_/_r_u_n_/_s_u_d_o       Directory containing timestamps
 
 EEXXAAMMPPLLEESS
-       Note: the following examples assume suitable sudoers(4)
+       Note: the following examples assume suitable _s_u_d_o_e_r_s(4)
        entries.
 
        To get a file listing of an unreadable directory:
@@ -495,16 +510,28 @@ EEXXAAMMPPLLEESS
         $ sudo sh -c "cd /home ; du -s * | sort -rn > USAGE"
 
 SSEEEE AALLSSOO
-       _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), sudoers(4),
-       passwd(4), visudo(1m)
+       _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(4),
+       _s_u_d_o_e_r_s(4), _v_i_s_u_d_o(1m)
 
 AAUUTTHHOORRSS
-       Many people have worked on ssuuddoo over the years; this ver­
+       Many people have worked on ssuuddoo over the years; this ver-
        sion consists of code written primarily by:
 
                Todd C. Miller
 
        See the HISTORY file in the ssuuddoo distribution or visit
+
+
+
+1.7                      August 15, 2007                        8
+
+
+
+
+
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+
+
        http://www.sudo.ws/sudo/history.html for a short history
        of ssuuddoo.
 
@@ -515,23 +542,11 @@ CCAAVVEEAATTSS
        user to run commands via shell escapes, thus avoiding
        ssuuddoo's checks.  However, on most systems it is possible to
        prevent shell escapes with ssuuddoo's _n_o_e_x_e_c functionality.
-       See the sudoers(4) manual for details.
+       See the _s_u_d_o_e_r_s(4) manual for details.
 
        It is not meaningful to run the cd command directly via
        sudo, e.g.,
 
-
-
-
-1.7                       June 23, 2007                         8
-
-
-
-
-
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
-
-
         $ sudo cd /usr/local/protected
 
        since when the command exits the parent process (your
@@ -540,11 +555,11 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        If users have sudo ALL there is nothing to prevent them
        from creating their own program that gives them a root
-       shell regardless of any '!' elements in the user specifi­
+       shell regardless of any '!' elements in the user specifi-
        cation.
 
        Running shell scripts via ssuuddoo can expose the same kernel
-       bugs that make setuid shell scripts unsafe on some operat­
+       bugs that make setuid shell scripts unsafe on some operat-
        ing systems (if your OS has a /dev/fd/ directory, setuid
        shell scripts are generally safe).
 
@@ -553,17 +568,17 @@ BBUUGGSS
        bug report at http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail­
-       ing list, see http://www.sudo.ws/mail­
+       Limited free support is available via the sudo-users mail-
+       ing list, see http://www.sudo.ws/mail-
        man/listinfo/sudo-users to subscribe or search the
        archives.
 
 DDIISSCCLLAAIIMMEERR
-       SSuuddoo is provided ``AS IS'' and any express or implied war­
-       ranties, including, but not limited to, the implied war­
+       ssuuddoo is provided ``AS IS'' and any express or implied war-
+       ranties, including, but not limited to, the implied war-
        ranties of merchantability and fitness for a particular
        purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com­
+       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
        plete details.
 
 
@@ -574,21 +589,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-1.7                       June 23, 2007                         9
+1.7                      August 15, 2007                        9
 
 
diff --git a/sudo.man.in b/sudo.man.in
index 3bdcdcc90..05516a920 100644
--- a/sudo.man.in
+++ b/sudo.man.in
@@ -150,22 +150,22 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDO @mansectsu@"
-.TH SUDO @mansectsu@ "July  9, 2007" "1.7" "MAINTENANCE COMMANDS"
+.TH SUDO @mansectsu@ "August 15, 2007" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 sudo, sudoedit \- execute a command as another user
 .SH "SYNOPSIS"
 .IX Header "SYNOPSIS"
-\&\fBsudo\fR \fB\-K\fR | \fB\-k\fR | \fB\-h\fR | \fB\-L\fR | \fB\-V\fR | \fB\-v\fR
+\&\fBsudo\fR \fB\-h\fR | \fB\-K\fR | \fB\-k\fR | \fB\-L\fR | \fB\-V\fR | \fB\-v\fR
 .PP
 \&\fBsudo\fR \fB\-l\fR [\fB\-U\fR\ \fIusername\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR] [\fIcommand\fR]
 .PP
 \&\fBsudo\fR [\fB\-bEHPS\fR] [\fB\-a\fR\ \fIauth_type\fR] [\fB\-C\fR\ \fIfd\fR]
 [\fB\-c\fR\ \fIclass\fR|\fI\-\fR] [\fB\-p\fR\ \fIprompt\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
-[\fB\s-1VAR\s0\fR=\fIvalue\fR] {\fB\-e\fR\ file\ [...]\ |\ \fB\-i\fR\ |\ \fB\-s\fR\ |\ \fIcommand\fR}
+[\fB\s-1VAR\s0\fR=\fIvalue\fR] {\fB\-i\fR\ |\ \fB\-s\fR\ |\ \fIcommand\fR}
 .PP
-\&\fBsudoedit\fR [\fB\-a\fR\ \fIauth_type\fR] [\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
-[\fB\-p\fR\ \fIprompt\fR] [\fB\-S\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
-file [...]
+\&\fBsudoedit\fR [\fB\-S\fR] [\fB\-a\fR\ \fIauth_type\fR] [\fB\-C\fR\ \fIfd\fR]
+[\fB\-c\fR\ \fIclass\fR|\fI\-\fR] [\fB\-p\fR\ \fIprompt\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
+file ...
 .SH "DESCRIPTION"
 .IX Header "DESCRIPTION"
 \&\fBsudo\fR allows a permitted user to execute a \fIcommand\fR as the
@@ -186,8 +186,8 @@ When invoked as \fBsudoedit\fR, the \fB\-e\fR option (described below),
 is implied.
 .PP
 \&\fBsudo\fR determines who is an authorized user by consulting the file
-\&\fI@sysconfdir@/sudoers\fR.  By giving \fBsudo\fR the \fB\-v\fR flag a user
-can update the time stamp without running a \fIcommand.\fR The password
+\&\fI@sysconfdir@/sudoers\fR.  By giving \fBsudo\fR the \fB\-v\fR flag, a user
+can update the time stamp without running a \fIcommand\fR. The password
 prompt itself will also time out if the user's password is not
 entered within \f(CW\*(C`@password_timeout@\*(C'\fR minutes (unless overridden via
 \&\fIsudoers\fR).
@@ -219,11 +219,10 @@ or via the \fIsudoers\fR file.
 .IX Item "-a"
 The \fB\-a\fR (\fIauthentication type\fR) option causes \fBsudo\fR to use the
 specified authentication type when validating the user, as allowed
-by /etc/login.conf.  The system administrator may specify a list
+by \fI/etc/login.conf\fR.  The system administrator may specify a list
 of sudo-specific authentication methods by adding an \*(L"auth\-sudo\*(R"
-entry in /etc/login.conf.  This option is only available on systems
-that support \s-1BSD\s0 authentication where \fBsudo\fR has been configured
-with the \-\-with\-bsdauth option.
+entry in \fI/etc/login.conf\fR.  This option is only available on systems
+that support \s-1BSD\s0 authentication.
 .IP "\-b" 4
 .IX Item "-b"
 The \fB\-b\fR (\fIbackground\fR) option tells \fBsudo\fR to run the given
@@ -237,25 +236,24 @@ standard input, standard output and standard error.  The \fB\-C\fR
 above the standard error (file descriptor three).  Values less than
 three are not permitted.  This option is only available if the
 administrator has enabled the \fIclosefrom_override\fR option in
-sudoers(@mansectform@).
+\&\fIsudoers\fR\|(@mansectform@).
 .IP "\-c" 4
 .IX Item "-c"
 The \fB\-c\fR (\fIclass\fR) option causes \fBsudo\fR to run the specified command
 with resources limited by the specified login class.  The \fIclass\fR
-argument can be either a class name as defined in /etc/login.conf,
+argument can be either a class name as defined in \fI/etc/login.conf\fR,
 or a single '\-' character.  Specifying a \fIclass\fR of \f(CW\*(C`\-\*(C'\fR indicates
 that the command should be run restricted by the default login
 capabilities for the user the command is run as.  If the \fIclass\fR
 argument specifies an existing user class, the command must be run
 as root, or the \fBsudo\fR command must be run from a shell that is already
-root.  This option is only available on systems with \s-1BSD\s0 login classes
-where \fBsudo\fR has been configured with the \-\-with\-logincap option.
+root.  This option is only available on systems with \s-1BSD\s0 login classes.
 .IP "\-E" 4
 .IX Item "-E"
-The \fB\-E\fR (\fIpreserve environment\fR) option will override the
-\&\fIenv_reset\fR option in sudoers(@mansectform@)).  It is only
+The \fB\-E\fR (\fIpreserve\fR \fIenvironment\fR) option will override the
+\&\fIenv_reset\fR option in \fIsudoers\fR\|(@mansectform@)).  It is only
 available when either the matching command has the \f(CW\*(C`SETENV\*(C'\fR tag
-or the \fIsetenv\fR option is set in sudoers(@mansectform@).
+or the \fIsetenv\fR option is set in \fIsudoers\fR\|(@mansectform@).
 .IP "\-e" 4
 .IX Item "-e"
 The \fB\-e\fR (\fIedit\fR) option indicates that, instead of running
@@ -264,15 +262,15 @@ of a command, the string \*(L"sudoedit\*(R" is used when consulting
 the \fIsudoers\fR file.  If the user is authorized by \fIsudoers\fR
 the following steps are taken:
 .RS 4
-.IP "1." 8
+.IP "1." 4
 Temporary copies are made of the files to be edited with the owner
 set to the invoking user.
-.IP "2." 8
+.IP "2." 4
 The editor specified by the \f(CW\*(C`VISUAL\*(C'\fR or \f(CW\*(C`EDITOR\*(C'\fR environment
 variables is run to edit the temporary files.  If neither \f(CW\*(C`VISUAL\*(C'\fR
 nor \f(CW\*(C`EDITOR\*(C'\fR are set, the program listed in the \fIeditor\fR \fIsudoers\fR
 variable is used.
-.IP "3." 8
+.IP "3." 4
 If they have been modified, the temporary files are copied back to
 their original location and the temporary versions are removed.
 .RE
@@ -289,15 +287,15 @@ temporary file.
 .IX Item "-H"
 The \fB\-H\fR (\fI\s-1HOME\s0\fR) option sets the \f(CW\*(C`HOME\*(C'\fR environment variable
 to the homedir of the target user (root by default) as specified
-in passwd(@mansectform@).  By default, \fBsudo\fR does not modify \f(CW\*(C`HOME\*(C'\fR
-(see \fIset_home\fR and \fIalways_set_home\fR in sudoers(@mansectform@)).
+in \fIpasswd\fR\|(@mansectform@).  By default, \fBsudo\fR does not modify \f(CW\*(C`HOME\*(C'\fR
+(see \fIset_home\fR and \fIalways_set_home\fR in \fIsudoers\fR\|(@mansectform@)).
 .IP "\-h" 4
 .IX Item "-h"
 The \fB\-h\fR (\fIhelp\fR) option causes \fBsudo\fR to print a usage message and exit.
 .IP "\-i" 4
 .IX Item "-i"
 The \fB\-i\fR (\fIsimulate initial login\fR) option runs the shell specified
-in the passwd(@mansectform@) entry of the user that the command is
+in the \fIpasswd\fR\|(@mansectform@) entry of the user that the command is
 being run as.  The command name argument given to the shell begins
 with a `\f(CW\*(C`\-\*(C'\fR' to tell the shell to run as a login shell.  \fBsudo\fR
 attempts to change to that user's home directory before running the
@@ -332,7 +330,7 @@ command line arguments.  If \fIcommand\fR is not allowed, \fBsudo\fR will
 exit with a return value of 1.
 .IP "\-P" 4
 .IX Item "-P"
-The \fB\-P\fR (\fIpreserve group vector\fR) option causes \fBsudo\fR to
+The \fB\-P\fR (\fIpreserve\fR \fIgroup vector\fR) option causes \fBsudo\fR to
 preserve the invoking user's group vector unaltered.  By default,
 \&\fBsudo\fR will initialize the group vector to the list of groups the
 target user is in.  The real and effective group IDs, however, are
@@ -343,27 +341,27 @@ The \fB\-p\fR (\fIprompt\fR) option allows you to override the default
 password prompt and use a custom one.  The following percent (`\f(CW\*(C`%\*(C'\fR')
 escapes are supported:
 .RS 4
-.ie n .IP "%u" 8
-.el .IP "\f(CW%u\fR" 8
-.IX Item "%u"
-expanded to the invoking user's login name
-.ie n .IP "%U" 8
-.el .IP "\f(CW%U\fR" 8
-.IX Item "%U"
-expanded to the login name of the user the command will
-be run as (defaults to root)
-.ie n .IP "%h" 8
-.el .IP "\f(CW%h\fR" 8
-.IX Item "%h"
-expanded to the local hostname without the domain name
-.ie n .IP "%H" 8
-.el .IP "\f(CW%H\fR" 8
+.ie n .IP "%H" 4
+.el .IP "\f(CW%H\fR" 4
 .IX Item "%H"
 expanded to the local hostname including the domain name
 (on if the machine's hostname is fully qualified or the \fIfqdn\fR
 \&\fIsudoers\fR option is set)
-.ie n .IP "\*(C`%%\*(C'" 8
-.el .IP "\f(CW\*(C`%%\*(C'\fR" 8
+.ie n .IP "%h" 4
+.el .IP "\f(CW%h\fR" 4
+.IX Item "%h"
+expanded to the local hostname without the domain name
+.ie n .IP "%U" 4
+.el .IP "\f(CW%U\fR" 4
+.IX Item "%U"
+expanded to the login name of the user the command will
+be run as (defaults to root)
+.ie n .IP "%u" 4
+.el .IP "\f(CW%u\fR" 4
+.IX Item "%u"
+expanded to the invoking user's login name
+.ie n .IP "\*(C`%%\*(C'" 4
+.el .IP "\f(CW\*(C`%%\*(C'\fR" 4
 .IX Item "%%"
 two consecutive \f(CW\*(C`%\*(C'\fR characters are collapsed into a single \f(CW\*(C`%\*(C'\fR character
 .RE
@@ -377,7 +375,7 @@ the standard input instead of the terminal device.
 .IX Item "-s"
 The \fB\-s\fR (\fIshell\fR) option runs the shell specified by the \fI\s-1SHELL\s0\fR
 environment variable if it is set or the shell as specified
-in passwd(@mansectform@).
+in \fIpasswd\fR\|(@mansectform@).
 .IP "\-U" 4
 .IX Item "-U"
 The \fB\-U\fR (\fIother user\fR) option is used in conjunction with the \fB\-l\fR
@@ -386,11 +384,13 @@ root or a user with \fBsudo\fR \f(CW\*(C`ALL\*(C'\fR on the current host may use
 option.
 .IP "\-u" 4
 .IX Item "-u"
-The \fB\-u\fR (\fIuser\fR) option causes \fBsudo\fR to run the specified command
-as a user other than \fIroot\fR.  To specify a \fIuid\fR instead of a
-\&\fIusername\fR, use \fI#uid\fR.  Note that if the \fItargetpw\fR Defaults
-option is set (see sudoers(@mansectform@)) it is not possible
-to run commands with a uid not listed in the password database.
+The \fB\-u\fR (\fIuser\fR) option causes \fBsudo\fR to run the specified
+command as a user other than \fIroot\fR.  To specify a \fIuid\fR instead
+of a \fIusername\fR, use \fI#uid\fR.  When running commands as a \fIuid\fR,
+many shells require that the '#' be escaped with a backslash ('\e').
+Note that if the \fItargetpw\fR Defaults option is set (see \fIsudoers\fR\|(@mansectform@))
+it is not possible to run commands with a uid not listed in the
+password database.
 .IP "\-V" 4
 .IX Item "-V"
 The \fB\-V\fR (\fIversion\fR) option causes \fBsudo\fR to print the version
@@ -415,7 +415,7 @@ command line are subject to the same restrictions as normal environment
 variables with one important exception.  If the \fIsetenv\fR option
 is set in \fIsudoers\fR or the command to be run has the \f(CW\*(C`SETENV\*(C'\fR tag
 set the user may set variables that would overwise be forbidden.
-See sudoers(@mansectform@) for more information.
+See \fIsudoers\fR\|(@mansectform@) for more information.
 .SH "RETURN VALUES"
 .IX Header "RETURN VALUES"
 Upon successful execution of a program, the return value from \fBsudo\fR
@@ -502,72 +502,72 @@ editors).  Because of this, care must be taken when giving users
 access to commands via \fBsudo\fR to verify that the command does not
 inadvertently give the user an effective root shell.  For more
 information, please see the \f(CW\*(C`PREVENTING SHELL ESCAPES\*(C'\fR section in
-sudoers(@mansectform@).
+\&\fIsudoers\fR\|(@mansectform@).
 .SH "ENVIRONMENT"
 .IX Header "ENVIRONMENT"
 \&\fBsudo\fR utilizes the following environment variables:
-.PP
-.Vb 2
-\& EDITOR                 Default editor to use in -e (sudoedit) mode if
-\&                        VISUAL is not set
-.Ve
-.PP
-.Vb 3
-\& HOME                   In -s or -H mode (or if sudo was configured with
-\&                        the --enable-shell-sets-home option), set to
-\&                        homedir of the target user
-.Ve
-.PP
-.Vb 2
-\& PATH                   Set to a sane value if sudo was configured with
-\&                        the --with-secure-path option
-.Ve
-.PP
-.Vb 1
-\& SHELL                  Used to determine shell to run with -s option
-.Ve
-.PP
-.Vb 1
-\& SUDO_PROMPT            Used as the default password prompt
-.Ve
-.PP
-.Vb 1
-\& SUDO_COMMAND           Set to the command run by sudo
-.Ve
-.PP
-.Vb 1
-\& SUDO_USER              Set to the login of the user who invoked sudo
-.Ve
-.PP
-.Vb 1
-\& SUDO_UID               Set to the uid of the user who invoked sudo
-.Ve
-.PP
-.Vb 1
-\& SUDO_GID               Set to the gid of the user who invoked sudo
-.Ve
-.PP
-.Vb 1
-\& SUDO_PS1               If set, PS1 will be set to its value
-.Ve
-.PP
-.Vb 2
-\& USER                   Set to the target user (root unless the -u option
-\&                        is specified)
-.Ve
-.PP
-.Vb 1
-\& VISUAL                 Default editor to use in -e (sudoedit) mode
-.Ve
+.ie n .IP "\*(C`EDITOR\*(C'" 16
+.el .IP "\f(CW\*(C`EDITOR\*(C'\fR" 16
+.IX Item "EDITOR"
+Default editor to use in \fB\-e\fR (sudoedit) mode if \f(CW\*(C`VISUAL\*(C'\fR is not set
+.ie n .IP "\*(C`HOME\*(C'" 16
+.el .IP "\f(CW\*(C`HOME\*(C'\fR" 16
+.IX Item "HOME"
+In \fB\-s\fR or \fB\-H\fR mode (or if sudo was configured with the
+\&\-\-enable\-shell\-sets\-home option), set to homedir of the target user
+.ie n .IP "\*(C`PATH\*(C'" 16
+.el .IP "\f(CW\*(C`PATH\*(C'\fR" 16
+.IX Item "PATH"
+Set to a sane value if the \fIsecure_path\fR sudoers option is set.
+.ie n .IP "\*(C`SHELL\*(C'" 16
+.el .IP "\f(CW\*(C`SHELL\*(C'\fR" 16
+.IX Item "SHELL"
+Used to determine shell to run with \f(CW\*(C`\-s\*(C'\fR option
+.ie n .IP "\*(C`SUDO_PROMPT\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_PROMPT\*(C'\fR" 16
+.IX Item "SUDO_PROMPT"
+Used as the default password prompt
+.ie n .IP "\*(C`SUDO_COMMAND\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_COMMAND\*(C'\fR" 16
+.IX Item "SUDO_COMMAND"
+Set to the command run by sudo
+.ie n .IP "\*(C`SUDO_USER\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_USER\*(C'\fR" 16
+.IX Item "SUDO_USER"
+Set to the login of the user who invoked sudo
+.ie n .IP "\*(C`SUDO_UID\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_UID\*(C'\fR" 16
+.IX Item "SUDO_UID"
+Set to the uid of the user who invoked sudo
+.ie n .IP "\*(C`SUDO_GID\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_GID\*(C'\fR" 16
+.IX Item "SUDO_GID"
+Set to the gid of the user who invoked sudo
+.ie n .IP "\*(C`SUDO_PS1\*(C'" 16
+.el .IP "\f(CW\*(C`SUDO_PS1\*(C'\fR" 16
+.IX Item "SUDO_PS1"
+If set, \f(CW\*(C`PS1\*(C'\fR will be set to its value
+.ie n .IP "\*(C`USER\*(C'" 16
+.el .IP "\f(CW\*(C`USER\*(C'\fR" 16
+.IX Item "USER"
+Set to the target user (root unless the \fB\-u\fR option is specified)
+.ie n .IP "\*(C`VISUAL\*(C'" 16
+.el .IP "\f(CW\*(C`VISUAL\*(C'\fR" 16
+.IX Item "VISUAL"
+Default editor to use in \fB\-e\fR (sudoedit) mode
 .SH "FILES"
 .IX Header "FILES"
-.Vb 2
-\& @sysconfdir@/sudoers           List of who can run what
-\& @timedir@          Directory containing timestamps
-.Ve
+.ie n .IP "\fI@sysconfdir@/sudoers\fR\*(C`		\*(C'List of who can run what" 4
+.el .IP "\fI@sysconfdir@/sudoers\fR\f(CW\*(C`		\*(C'\fRList of who can run what" 4
+.IX Item "@sysconfdir@/sudoers		List of who can run what"
+.PD 0
+.ie n .IP "\fI@timedir@\fR\*(C`		\*(C'Directory containing timestamps" 4
+.el .IP "\fI@timedir@\fR\f(CW\*(C`		\*(C'\fRDirectory containing timestamps" 4
+.IX Item "@timedir@		Directory containing timestamps"
+.PD
 .SH "EXAMPLES"
 .IX Header "EXAMPLES"
-Note: the following examples assume suitable sudoers(@mansectform@) entries.
+Note: the following examples assume suitable \fIsudoers\fR\|(@mansectform@) entries.
 .PP
 To get a file listing of an unreadable directory:
 .PP
@@ -603,8 +603,8 @@ to make the \f(CW\*(C`cd\*(C'\fR and file redirection work.
 .Ve
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-\&\fIgrep\fR\|(1), \fIsu\fR\|(1), \fIstat\fR\|(2), \fIlogin_cap\fR\|(3), sudoers(@mansectform@),
-passwd(@mansectform@), visudo(@mansectsu@)
+\&\fIgrep\fR\|(1), \fIsu\fR\|(1), \fIstat\fR\|(2), \fIlogin_cap\fR\|(3), \fIpasswd\fR\|(@mansectform@),
+\&\fIsudoers\fR\|(@mansectform@), \fIvisudo\fR\|(@mansectsu@)
 .SH "AUTHORS"
 .IX Header "AUTHORS"
 Many people have worked on \fBsudo\fR over the years; this
@@ -624,7 +624,7 @@ if that user is allowed to run arbitrary commands via \fBsudo\fR.
 Also, many programs (such as editors) allow the user to run commands
 via shell escapes, thus avoiding \fBsudo\fR's checks.  However, on
 most systems it is possible to prevent shell escapes with \fBsudo\fR's
-\&\fInoexec\fR functionality.  See the sudoers(@mansectform@) manual
+\&\fInoexec\fR functionality.  See the \fIsudoers\fR\|(@mansectform@) manual
 for details.
 .PP
 It is not meaningful to run the \f(CW\*(C`cd\*(C'\fR command directly via sudo, e.g.,
@@ -654,7 +654,7 @@ see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
 search the archives.
 .SH "DISCLAIMER"
 .IX Header "DISCLAIMER"
-\&\fBSudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
+\&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
 including, but not limited to, the implied warranties of merchantability
 and fitness for a particular purpose are disclaimed.  See the \s-1LICENSE\s0
 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
diff --git a/sudoers.cat b/sudoers.cat
index d00da61ef..f721da508 100644
--- a/sudoers.cat
+++ b/sudoers.cat
@@ -25,26 +25,26 @@ DDEESSCCRRIIPPTTIIOONN
        QQuuiicckk gguuiiddee ttoo EEBBNNFF
 
        EBNF is a concise and exact way of describing the grammar
-       of a language.  Each EBNF definition is made up of _p_r_o_d_u_c_­
+       of a language.  Each EBNF definition is made up of _p_r_o_d_u_c_-
        _t_i_o_n _r_u_l_e_s.  E.g.,
 
         symbol ::= definition | alternate1 | alternate2 ...
 
        Each _p_r_o_d_u_c_t_i_o_n _r_u_l_e references others and thus makes up a
-       grammar for the language.  EBNF also contains the follow­
-       ing operators, which many readers will recognize from reg­
+       grammar for the language.  EBNF also contains the follow-
+       ing operators, which many readers will recognize from reg-
        ular expressions.  Do not, however, confuse them with
        "wildcard" characters, which have different meanings.
 
-       ?       Means that the preceding symbol (or group of sym­
-               bols) is optional.  That is, it may appear once or
-               not at all.
+       ?   Means that the preceding symbol (or group of symbols)
+           is optional.  That is, it may appear once or not at
+           all.
 
-       *       Means that the preceding symbol (or group of sym­
-               bols) may appear zero or more times.
+       *   Means that the preceding symbol (or group of symbols)
+           may appear zero or more times.
 
-       +       Means that the preceding symbol (or group of sym­
-               bols) may appear one or more times.
+       +   Means that the preceding symbol (or group of symbols)
+           may appear one or more times.
 
        Parentheses may be used to group symbols together.  For
        clarity, we will use single quotes ('') to designate what
@@ -61,7 +61,7 @@ DDEESSCCRRIIPPTTIIOONN
 
 
 
-1.7                       June 23, 2007                         1
+1.7                      August 15, 2007                        1
 
 
 
@@ -90,7 +90,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Alias_Type NAME = item1, item2, ...
 
        where _A_l_i_a_s___T_y_p_e is one of User_Alias, Runas_Alias,
-       Host_Alias, or Cmnd_Alias.  A NAME is a string of upper­
+       Host_Alias, or Cmnd_Alias.  A NAME is a string of upper-
        case letters, numbers, and underscore characters ('_').  A
        NAME mmuusstt start with an uppercase letter.  It is possible
        to put several alias definitions of the same type on a
@@ -127,7 +127,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7                       June 23, 2007                         2
+1.7                      August 15, 2007                        2
 
 
 
@@ -140,8 +140,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        also contain uids (prefixed with '#') and instead of
        User_Aliases it can contain Runas_Aliases.  Note that
        usernames and groups are matched as strings.  In other
-       words, two users (groups) with the same uid (gid) are con­
-       sidered to be distinct.  If you wish to match all user­
+       words, two users (groups) with the same uid (gid) are con-
+       sidered to be distinct.  If you wish to match all user-
        names with the same uid (e.g. root and toor), you can use
        a uid instead (#0 in the example given).
 
@@ -162,13 +162,13 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        each of the local host's network interfaces and, if the
        network number corresponds to one of the hosts's network
        interfaces, the corresponding netmask will be used.  The
-       netmask may be specified either in dotted quad notation
-       (e.g. 255.255.255.0) or CIDR notation (number of bits,
-       e.g. 24).  A hostname may include shell-style wildcards
-       (see the Wildcards section below), but unless the hostname
-       command on your machine returns the fully qualified host­
-       name, you'll need to use the _f_q_d_n option for wildcards to
-       be useful.
+       netmask may be specified either in standard IP address
+       notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
+       CIDR notation (number of bits, e.g. 24 or 64).  A hostname
+       may include shell-style wildcards (see the Wildcards sec-
+       tion below), but unless the hostname command on your
+       machine returns the fully qualified hostname, you'll need
+       to use the _f_q_d_n option for wildcards to be useful.
 
         Cmnd_List ::= Cmnd |
                       Cmnd ',' Cmnd_List
@@ -182,8 +182,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                  '!'* "sudoedit" |
                  '!'* Cmnd_Alias
 
-       A Cmnd_List is a list of one or more commandnames, direc­
-       tories, and other aliases.  A commandname is a fully qual­
+       A Cmnd_List is a list of one or more commandnames, direc-
+       tories, and other aliases.  A commandname is a fully qual-
        ified filename which may include shell-style wildcards
        (see the Wildcards section below).  A simple filename
        allows the user to run the command with any arguments
@@ -193,7 +193,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7                       June 23, 2007                         3
+1.7                      August 15, 2007                        3
 
 
 
@@ -212,7 +212,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        arguments in the Cmnd must match exactly those given by
        the user on the command line (or match the wildcards if
        there are any).  Note that the following characters must
-       be escaped with a '\' if they are used in command argu­
+       be escaped with a '\' if they are used in command argu-
        ments: ',', ':', '=', '\'.  The special command "sudoedit"
        is used to permit a user to run ssuuddoo with the --ee flag (or
        as ssuuddooeeddiitt).  It may take command line arguments just as
@@ -248,7 +248,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        Parameters may be ffllaaggss, iinntteeggeerr values, ssttrriinnggss, or
        lliissttss.  Flags are implicitly boolean and can be turned off
        via the '!'  operator.  Some integer, string and list
-       parameters may also be used in a boolean context to dis­
+       parameters may also be used in a boolean context to dis-
        able them.  Values may be enclosed in double quotes (")
        when they contain multiple words.  Special characters may
        be escaped with a backslash (\).
@@ -259,7 +259,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7                       June 23, 2007                         4
+1.7                      August 15, 2007                        4
 
 
 
@@ -270,260 +270,128 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        to remove an element that does not exist in a list.
 
-       FFllaaggss:
+       See "SUDOERS OPTIONS" for a list of supported Defaults
+       parameters.
 
-       long_otp_prompt
-                   When validating with a One Time Password
-                   scheme (SS//KKeeyy or OOPPIIEE), a two-line prompt is
-                   used to make it easier to cut and paste the
-                   challenge to a local window.  It's not as
-                   pretty as the default but some people find it
-                   more convenient.  This flag is _o_f_f by default.
-
-       ignore_dot  If set, ssuuddoo will ignore '.' or '' (current
-                   dir) in the PATH environment variable; the
-                   PATH itself is not modified.  This flag is _o_f_f
-                   by default.
-
-       mail_always Send mail to the _m_a_i_l_t_o user every time a
-                   users runs ssuuddoo.  This flag is _o_f_f by default.
-
-       mail_badpass
-                   Send mail to the _m_a_i_l_t_o user if the user run­
-                   ning ssuuddoo does not enter the correct password.
-                   This flag is _o_f_f by default.
-
-       mail_no_user
-                   If set, mail will be sent to the _m_a_i_l_t_o user
-                   if the invoking user is not in the _s_u_d_o_e_r_s
-                   file.  This flag is _o_n by default.
-
-       mail_no_host
-                   If set, mail will be sent to the _m_a_i_l_t_o user
-                   if the invoking user exists in the _s_u_d_o_e_r_s
-                   file, but is not allowed to run commands on
-                   the current host.  This flag is _o_f_f by
-                   default.
+       UUsseerr SSppeecciiffiiccaattiioonn
 
-       mail_no_perms
-                   If set, mail will be sent to the _m_a_i_l_t_o user
-                   if the invoking user is allowed to use ssuuddoo
-                   but the command they are trying is not listed
-                   in their _s_u_d_o_e_r_s file entry or is explicitly
-                   denied.  This flag is _o_f_f by default.
+        User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
+                      (':' Host_List '=' Cmnd_Spec_List)*
 
-       tty_tickets If set, users must authenticate on a per-tty
-                   basis.  Normally, ssuuddoo uses a directory in the
-                   ticket dir with the same name as the user run­
-                   ning it.  With this flag enabled, ssuuddoo will
-                   use a file named for the tty the user is
-                   logged in on in that directory.  This flag is
-                   _o_f_f by default.
+        Cmnd_Spec_List ::= Cmnd_Spec |
+                           Cmnd_Spec ',' Cmnd_Spec_List
 
-       authenticate
-                   If set, users must authenticate themselves via
+        Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
 
+        Runas_Spec ::= '(' Runas_List ')'
 
+        Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
+                      'SETENV:' | 'NOSETENV:' )
 
-1.7                       June 23, 2007                         5
+       A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may
+       run (and as what user) on specified hosts.  By default,
+       commands are run as rroooott, but this can be changed on a
+       per-command basis.
 
+       Let's break that down into its constituent parts:
 
+       RRuunnaass__SSppeecc
 
+       A Runas_Spec is simply a Runas_List (as defined above)
+       enclosed in a set of parentheses.  If you do not specify a
+       Runas_Spec in the user specification, a default Runas_Spec
+       of rroooott will be used.  A Runas_Spec sets the default for
+       commands that follow it.  What this means is that for the
+       entry:
 
+        dgb    boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m
+       -- but only as ooppeerraattoorr.  E.g.,
 
+        $ sudo -u operator /bin/ls.
 
-                   a password (or other means of authentication)
-                   before they may run commands.  This default
-                   may be overridden via the PASSWD and NOPASSWD
-                   tags.  This flag is _o_n by default.
-
-       root_sudo   If set, root is allowed to run ssuuddoo too.  Dis­
-                   abling this prevents users from "chaining"
-                   ssuuddoo commands to get a root shell by doing
-                   something like "sudo sudo /bin/sh".  Note,
-                   however, that turning off _r_o_o_t___s_u_d_o will also
-                   prevent root and from running ssuuddooeeddiitt.  Dis­
-                   abling _r_o_o_t___s_u_d_o provides no real additional
-                   security; it exists purely for historical rea­
-                   sons.  This flag is _o_n by default.
-
-       log_host    If set, the hostname will be logged in the
-                   (non-syslog) ssuuddoo log file.  This flag is _o_f_f
-                   by default.
-
-       log_year    If set, the four-digit year will be logged in
-                   the (non-syslog) ssuuddoo log file.  This flag is
-                   _o_f_f by default.
-
-       shell_noargs
-                   If set and ssuuddoo is invoked with no arguments
-                   it acts as if the --ss flag had been given.
-                   That is, it runs a shell as root (the shell is
-                   determined by the SHELL environment variable
-                   if it is set, falling back on the shell listed
-                   in the invoking user's /etc/passwd entry if
-                   not).  This flag is _o_f_f by default.
-
-       set_home    If set and ssuuddoo is invoked with the --ss flag
-                   the HOME environment variable will be set to
-                   the home directory of the target user (which
-                   is root unless the --uu option is used).  This
-                   effectively makes the --ss flag imply --HH.  This
-                   flag is _o_f_f by default.
-
-       always_set_home
-                   If set, ssuuddoo will set the HOME environment
-                   variable to the home directory of the target
-                   user (which is root unless the --uu option is
-                   used).  This effectively means that the --HH
-                   flag is always implied.  This flag is _o_f_f by
-                   default.
+       It is also possible to override a Runas_Spec later on in
+       an entry.  If we modify the entry like so:
 
-       path_info   Normally, ssuuddoo will tell the user when a com­
-                   mand could not be found in their PATH environ­
-                   ment variable.  Some sites may wish to disable
-                   this as it could be used to gather information
-                   on the location of executables that the normal
-                   user does not have access to.  The disadvan­
-                   tage is that if the executable is simply not
+        dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
 
+       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr,
+       but  _/_b_i_n_/_k_i_l_l and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
 
 
-1.7                       June 23, 2007                         6
 
 
 
 
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+1.7                      August 15, 2007                        5
 
 
-                   in the user's PATH, ssuuddoo will tell the user
-                   that they are not allowed to run it, which can
-                   be confusing.  This flag is _o_f_f by default.
-
-       preserve_groups
-                   By default ssuuddoo will initialize the group vec­
-                   tor to the list of groups the target user is
-                   in.  When _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's
-                   existing group vector is left unaltered.  The
-                   real and effective group IDs, however, are
-                   still set to match the target user.  This flag
-                   is _o_f_f by default.
-
-       fqdn        Set this flag if you want to put fully quali­
-                   fied hostnames in the _s_u_d_o_e_r_s file.  I.e.,
-                   instead of myhost you would use myhost.mydo­
-                   main.edu.  You may still use the short form if
-                   you wish (and even mix the two).  Beware that
-                   turning on _f_q_d_n requires ssuuddoo to make DNS
-                   lookups which may make ssuuddoo unusable if DNS
-                   stops working (for example if the machine is
-                   not plugged into the network).  Also note that
-                   you must use the host's official name as DNS
-                   knows it.  That is, you may not use a host
-                   alias (CNAME entry) due to performance issues
-                   and the fact that there is no way to get all
-                   aliases from DNS.  If your machine's hostname
-                   (as returned by the hostname command) is
-                   already fully qualified you shouldn't need to
-                   set _f_q_d_n.  This flag is _o_f_f by default.
-
-       insults     If set, ssuuddoo will insult users when they enter
-                   an incorrect password.  This flag is _o_f_f by
-                   default.
 
-       requiretty  If set, ssuuddoo will only run when the user is
-                   logged in to a real tty.  This will disallow
-                   things like "rsh somehost sudo ls" since
-                   _r_s_h(1) does not allocate a tty.  Because it is
-                   not possible to turn off echo when there is no
-                   tty present, some sites may wish to set this
-                   flag to prevent a user from entering a visible
-                   password.  This flag is _o_f_f by default.
 
-       env_editor  If set, vviissuuddoo will use the value of the EDI­
-                   TOR or VISUAL environment variables before
-                   falling back on the default editor list.  Note
-                   that this may create a security hole as it
-                   allows the user to run any arbitrary command
-                   as root without logging.  A safer alternative
-                   is to place a colon-separated list of editors
-                   in the editor variable.  vviissuuddoo will then only
-                   use the EDITOR or VISUAL if they match a value
-                   specified in editor.  This flag is off by
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-1.7                       June 23, 2007                         7
+       TTaagg__SSppeecc
 
+       A command may have zero or more tags associated with it.
+       There are eight possible tag values, NOPASSWD, PASSWD,
+       NOEXEC, EXEC, SETENV and NOSETENV.  Once a tag is set on a
+       Cmnd, subsequent Cmnds in the Cmnd_Spec_List, inherit the
+       tag unless it is overridden by the opposite tag (i.e.:
+       PASSWD overrides NOPASSWD and NOEXEC overrides EXEC).
 
+       _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
 
+       By default, ssuuddoo requires that a user authenticate him or
+       herself before running a command.  This behavior can be
+       modified via the NOPASSWD tag.  Like a Runas_Spec, the
+       NOPASSWD tag sets a default for the commands that follow
+       it in the Cmnd_Spec_List.  Conversely, the PASSWD tag can
+       be used to reverse things.  For example:
 
+        ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and
+       _/_u_s_r_/_b_i_n_/_l_p_r_m as root on the machine rushmore as rroooott
+       without authenticating himself.  If we only want rraayy to be
+       able to run _/_b_i_n_/_k_i_l_l without a password the entry would
+       be:
 
+        ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
 
-                   default.
+       Note, however, that the PASSWD tag has no effect on users
+       who are in the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
 
-       rootpw      If set, ssuuddoo will prompt for the root password
-                   instead of the password of the invoking user.
-                   This flag is _o_f_f by default.
+       By default, if the NOPASSWD tag is applied to any of the
+       entries for a user on the current host, he or she will be
+       able to run sudo -l without a password.  Additionally, a
+       user may only run sudo -v without a password if the
+       NOPASSWD tag is present for all a user's entries that per-
+       tain to the current host.  This behavior may be overridden
+       via the verifypw and listpw options.
 
-       runaspw     If set, ssuuddoo will prompt for the password of
-                   the user defined by the _r_u_n_a_s___d_e_f_a_u_l_t option
-                   (defaults to root) instead of the password of
-                   the invoking user.  This flag is _o_f_f by
-                   default.
+       _N_O_E_X_E_C _a_n_d _E_X_E_C
 
-       targetpw    If set, ssuuddoo will prompt for the password of
-                   the user specified by the --uu flag (defaults to
-                   root) instead of the password of the invoking
-                   user.  Note that this precludes the use of a
-                   uid not listed in the passwd database as an
-                   argument to the --uu flag.  This flag is _o_f_f by
-                   default.
+       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the
+       underlying operating system supports it, the NOEXEC tag
+       can be used to prevent a dynamically-linked executable
+       from running further commands itself.
 
-       set_logname Normally, ssuuddoo will set the LOGNAME, USER and
-                   USERNAME environment variables to the name of
-                   the target user (usually root unless the --uu
-                   flag is given).  However, since some programs
-                   (including the RCS revision control system)
-                   use LOGNAME to determine the real identity of
-                   the user, it may be desirable to change this
-                   behavior.  This can be done by negating the
-                   set_logname option.  Note that if the
-                   _e_n_v___r_e_s_e_t option has not been disabled,
-                   entries in the _e_n_v___k_e_e_p list will override the
-                   value of _s_e_t___l_o_g_n_a_m_e.
+       In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e
+       and _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
 
-       stay_setuid Normally, when ssuuddoo executes a command the
-                   real and effective UIDs are set to the target
-                   user (root by default).  This option changes
-                   that behavior such that the real UID is left
-                   as the invoking user's UID.  In other words,
-                   this makes ssuuddoo act as a setuid wrapper.  This
-                   can be useful on systems that disable some
-                   potentially dangerous functionality when a
-                   program is run setuid.  This option is only
-                   effective on systems with either the
-                   _s_e_t_r_e_u_i_d_(_) or _s_e_t_r_e_s_u_i_d_(_) function.
+        aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 
-       env_reset   If set, ssuuddoo will reset the environment to
-                   only contain the LOGNAME, SHELL, USER, USER­
-                   NAME and the SUDO_* variables.  Any variables
-                   in the caller's environment that match the
-                   env_keep and env_check lists are then added.
-                   The default contents of the env_keep and
-                   env_check lists are displayed when ssuuddoo is run
-                   by root with the _-_V option.  If the
-                   _s_e_c_u_r_e___p_a_t_h option is set, its -value will be
+       See the "PREVENTING SHELL ESCAPES" section below for more
+       details on how NOEXEC works and whether or not it will
+       work on your system.
 
 
 
-1.7                       June 23, 2007                         8
+1.7                      August 15, 2007                        6
 
 
 
@@ -532,262 +400,262 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                   used for the PATH environment variable.  This
-                   flag is _o_n by default.
-
-       use_loginclass
-                   If set, ssuuddoo will apply the defaults specified
-                   for the target user's login class if one
-                   exists.  Only available if ssuuddoo is configured
-                   with the --with-logincap option.  This flag is
-                   _o_f_f by default.
-
-       noexec      If set, all commands run via ssuuddoo will behave
-                   as if the NOEXEC tag has been set, unless
-                   overridden by a EXEC tag.  See the description
-                   of _N_O_E_X_E_C _a_n_d _E_X_E_C below as well as the "PRE­
-                   VENTING SHELL ESCAPES" section at the end of
-                   this manual.  This flag is _o_f_f by default.
-
-       monitor     If set, all commands run via ssuuddoo will behave
-                   as if the MONITOR tag has been set, unless
-                   overridden by a NOMONITOR tag.  See the
-                   description of _M_O_N_I_T_O_R _a_n_d _N_O_M_O_N_I_T_O_R below as
-                   well as the "PREVENTING SHELL ESCAPES" section
-                   at the end of this manual.  Be aware that
-                   tracing is only supported on certain operating
-                   systems.  On systems where it is not supported
-                   this flag will have no effect.  This flag is
-                   _o_f_f by default.
+       _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
 
-       ignore_local_sudoers
-                   If set via LDAP, parsing of @sysconfdir@/sudo­
-                   ers will be skipped.  This is intended for
-                   Enterprises that wish to prevent the usage of
-                   local sudoers files so that only LDAP is used.
-                   This thwarts the efforts of rogue operators
-                   who would attempt to add roles to
-                   @sysconfdir@/sudoers.  When this option is
-                   present, @sysconfdir@/sudoers does not even
-                   need to exist.  Since this option tells ssuuddoo
-                   how to behave when no specific LDAP entries
-                   have been matched, this sudoOption is only
-                   meaningful for the cn=defaults section.  This
-                   flag is _o_f_f by default.
+       These tags override the value of the _s_e_t_e_n_v option on a
+       per-command basis.  Note that if SETENV has been set for a
+       command, any environment variables set on the command line
+       way are not subject to the restrictions imposed by
+       _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only trusted
+       users should be allowed to set variables in this manner.
 
-       closefrom_override
-                   If set, the user may use ssuuddoo's --CC option
-                   which overrides the default starting point at
-                   which ssuuddoo begins closing open file descrip­
-                   tors.  This flag is _o_f_f by default.
+       WWiillddccaarrddss
 
-       IInntteeggeerrss:
+       ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob char-
+       acters) to be used in pathnames as well as command line
+       arguments in the _s_u_d_o_e_r_s file.  Wildcard matching is done
+       via the PPOOSSIIXX _f_n_m_a_t_c_h(3) routine.  Note that these are _n_o_t
+       regular expressions.
 
-       passwd_tries
-                   The number of tries a user gets to enter
-                   his/her password before ssuuddoo logs the failure
+       *       Matches any set of zero or more characters.
 
+       ?       Matches any single character.
 
+       [...]   Matches any character in the specified range.
 
-1.7                       June 23, 2007                         9
+       [!...]  Matches any character nnoott in the specified range.
 
+       \x      For any character "x", evaluates to "x".  This is
+               used to escape special characters such as: "*",
+               "?", "[", and "}".
 
+       Note that a forward slash ('/') will nnoott be matched by
+       wildcards used in the pathname.  When matching the command
+       line arguments, however, a slash ddooeess get matched by wild-
+       cards.  This is to make a path like:
 
+           /usr/bin/*
 
+       match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
 
+       The following exceptions apply to the above rules:
 
-                   and exits.  The default is 3.
+       ""      If the empty string "" is the only command line
+               argument in the _s_u_d_o_e_r_s entry it means that com-
+               mand is not allowed to be run with aannyy arguments.
 
-       IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
+       IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
 
-       loglinelen  Number of characters per line for the file
-                   log.  This value is used to decide when to
-                   wrap lines for nicer log files.  This has no
-                   effect on the syslog log file, only the file
-                   log.  The default is 80 (use 0 or negate the
-                   option to disable word wrap).
+       It is possible to include other _s_u_d_o_e_r_s files from within
+       the _s_u_d_o_e_r_s file currently being parsed using the #include
+       directive, similar to the one used by the C preprocessor.
+       This is useful, for example, for keeping a site-wide _s_u_d_o_-
+       _e_r_s file in addition to a per-machine local one.  For the
+       sake of this example the site-wide _s_u_d_o_e_r_s will be
 
-       timestamp_timeout
-                   Number of minutes that can elapse before ssuuddoo
-                   will ask for a passwd again.  The default is
-                   5.  Set this to 0 to always prompt for a pass­
-                   word.  If set to a value less than 0 the
-                   user's timestamp will never expire.  This can
-                   be used to allow users to create or delete
-                   their own timestamps via sudo -v and sudo -k
-                   respectively.
-
-       passwd_timeout
-                   Number of minutes before the ssuuddoo password
-                   prompt times out.  The default is 5, set this
-                   to 0 for no password timeout.
-
-       umask       Umask to use when running the command.  Negate
-                   this option or set it to 0777 to preserve the
-                   user's umask.  The default is 0022.
-
-       closefrom   Before it executes a command, ssuuddoo will close
-                   all open file descriptors other than standard
-                   input, standard output and standard error (ie:
-                   file descriptors 0-2).  The _c_l_o_s_e_f_r_o_m option
-                   can be used to specify a different file
-                   descriptor at which to start closing.  The
-                   default is 3.
-
-       setenv      Allow the user to set additional environment
-                   variables from the command line.  Note that
-                   variables set this way are not subject to the
-                   restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e,
-                   or _e_n_v___r_e_s_e_t.  As such, only trusted users
-                   should be allowed to set variables in this
-                   manner.
 
-       SSttrriinnggss:
 
-       mailsub     Subject of the mail sent to the _m_a_i_l_t_o user.
-                   The escape %h will expand to the hostname of
-                   the machine.  Default is *** SECURITY informa­
-                   tion for %h ***.
+1.7                      August 15, 2007                        7
 
 
 
 
 
-1.7                       June 23, 2007                        10
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will be _/_e_t_c_/_s_u_d_o_-
+       _e_r_s_._l_o_c_a_l.  To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from _/_e_t_c_/_s_u_d_o_-
+       _e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
 
+        #include /etc/sudoers.local
 
+       When ssuuddoo reaches this line it will suspend processing of
+       the current file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_-
+       _e_r_s_._l_o_c_a_l.  Upon reaching the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l,
+       the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be processed.  Files that
+       are included may themselves include other files.  A hard
+       limit of 128 nested include files is enforced to prevent
+       include file loops.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
 
+       The pound sign ('#') is used to indicate a comment (unless
+       it is part of a #include directive or unless it occurs in
+       the context of a user name and is followed by one or more
+       digits, in which case it is treated as a uid).  Both the
+       comment character and any text after it, up to the end of
+       the line, are ignored.
 
-       badpass_message
-                   Message that is displayed if a user enters an
-                   incorrect password.  The default is Sorry, try
-                   again. unless insults are enabled.
+       The reserved word AALLLL is a built-in _a_l_i_a_s that always
+       causes a match to succeed.  It can be used wherever one
+       might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
+       or Host_Alias.  You should not try to define your own
+       _a_l_i_a_s called AALLLL as the built-in alias will be used in
+       preference to your own.  Please note that using AALLLL can be
+       dangerous since in a command context, it allows the user
+       to run aannyy command on the system.
 
-       timestampdir
-                   The directory in which ssuuddoo stores its times­
-                   tamp files.  The default is _/_v_a_r_/_r_u_n_/_s_u_d_o.
+       An exclamation point ('!') can be used as a logical _n_o_t
+       operator both in an _a_l_i_a_s and in front of a Cmnd.  This
+       allows one to exclude certain values.  Note, however, that
+       using a ! in conjunction with the built-in ALL alias to
+       allow a user to run "all but a few" commands rarely works
+       as intended (see SECURITY NOTES below).
 
-       timestampowner
-                   The owner of the timestamp directory and the
-                   timestamps stored therein.  The default is
-                   root.
+       Long lines can be continued with a backslash ('\') as the
+       last character on the line.
 
-       passprompt  The default prompt to use when asking for a
-                   password; can be overridden via the --pp option
-                   or the SUDO_PROMPT environment variable.  The
-                   following percent (`%') escapes are supported:
+       Whitespace between elements in a list as well as special
+       syntactic characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':',
+       '(', ')') is optional.
 
-                   %u      expanded to the invoking user's login
-                           name
+       The following characters must be escaped with a backslash
+       ('\') when used as part of a word (e.g. a username or
+       hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
 
-                   %U      expanded to the login name of the user
-                           the command will be run as (defaults
-                           to root)
+SSUUDDOOEERRSS OOPPTTIIOONNSS
+       ssuuddoo's behavior can be modified by Default_Entry lines, as
+       explained earlier.  A list of all supported Defaults
+       parameters, grouped by type, are listed below.
 
-                   %h      expanded to the local hostname without
-                           the domain name
 
-                   %H      expanded to the local hostname includ­
-                           ing the domain name (on if the
-                           machine's hostname is fully qualified
-                           or the _f_q_d_n option is set)
 
-                   %%      two consecutive % characters are col­
-                           lapsed into a single % character
+1.7                      August 15, 2007                        8
 
-                   The default value is Password:.
 
-       runas_default
-                   The default user to run commands as if the --uu
-                   flag is not specified on the command line.
-                   This defaults to root.  Note that if
-                   _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur before any
-                   Runas_Alias specifications.
 
-       syslog_goodpri
-                   Syslog priority to use when user authenticates
-                   successfully.  Defaults to notice.
 
-       syslog_badpri
-                   Syslog priority to use when user authenticates
-                   unsuccessfully.  Defaults to alert.
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       FFllaaggss:
 
-1.7                       June 23, 2007                        11
+       always_set_home If set, ssuuddoo will set the HOME environment
+                       variable to the home directory of the tar-
+                       get user (which is root unless the --uu
+                       option is used).  This effectively means
+                       that the --HH flag is always implied.  This
+                       flag is _o_f_f by default.
 
+       authenticate    If set, users must authenticate themselves
+                       via a password (or other means of authen-
+                       tication) before they may run commands.
+                       This default may be overridden via the
+                       PASSWD and NOPASSWD tags.  This flag is _o_n
+                       by default.
 
+       closefrom_override
+                       If set, the user may use ssuuddoo's --CC option
+                       which overrides the default starting point
+                       at which ssuuddoo begins closing open file
+                       descriptors.  This flag is _o_f_f by default.
 
+       env_editor      If set, vviissuuddoo will use the value of the
+                       EDITOR or VISUAL environment variables
+                       before falling back on the default editor
+                       list.  Note that this may create a secu-
+                       rity hole as it allows the user to run any
+                       arbitrary command as root without logging.
+                       A safer alternative is to place a colon-
+                       separated list of editors in the editor
+                       variable.  vviissuuddoo will then only use the
+                       EDITOR or VISUAL if they match a value
+                       specified in editor.  This flag is _o_f_f by
+                       default.
 
+       env_reset       If set, ssuuddoo will reset the environment to
+                       only contain the LOGNAME, SHELL, USER,
+                       USERNAME and the SUDO_* variables.  Any
+                       variables in the caller's environment that
+                       match the env_keep and env_check lists are
+                       then added.  The default contents of the
+                       env_keep and env_check lists are displayed
+                       when ssuuddoo is run by root with the _-_V
+                       option.  If the _s_e_c_u_r_e___p_a_t_h option is set,
+                       its value will be used for the PATH envi-
+                       ronment variable.  This flag is _o_n by
+                       default.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       fqdn            Set this flag if you want to put fully
+                       qualified hostnames in the _s_u_d_o_e_r_s file.
+                       I.e., instead of myhost you would use
+                       myhost.mydomain.edu.  You may still use
+                       the short form if you wish (and even mix
+                       the two).  Beware that turning on _f_q_d_n
 
 
-       editor      A colon (':') separated list of editors
-                   allowed to be used with vviissuuddoo.  vviissuuddoo will
-                   choose the editor that matches the user's EDI­
-                   TOR environment variable if possible, or the
-                   first editor in the list that exists and is
-                   executable.  The default is the path to vi on
-                   your system.
 
-       noexec_file Path to a shared library containing dummy ver­
-                   sions of the _e_x_e_c_v_(_), _e_x_e_c_v_e_(_) and _f_e_x_e_c_v_e_(_)
-                   library functions that just return an error.
-                   This is used to implement the _n_o_e_x_e_c function­
-                   ality on systems that support LD_PRELOAD or
-                   its equivalent.  Defaults to
-                   _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c.
+1.7                      August 15, 2007                        9
 
-       SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-       lecture     This option controls when a short lecture will
-                   be printed along with the password prompt.  It
-                   has the following possible values:
 
-                   never   Never lecture the user.
 
-                   once    Only lecture the user the first time
-                           they run ssuuddoo.
 
-                   always  Always lecture the user.
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-                   If no value is specified, a value of _o_n_c_e is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _o_n_c_e.
 
-       lecture_file
-                   Path to a file containing an alternate ssuuddoo
-                   lecture that will be used in place of the
-                   standard lecture if the named file exists.
+                       requires ssuuddoo to make DNS lookups which
+                       may make ssuuddoo unusable if DNS stops work-
+                       ing (for example if the machine is not
+                       plugged into the network).  Also note that
+                       you must use the host's official name as
+                       DNS knows it.  That is, you may not use a
+                       host alias (CNAME entry) due to perfor-
+                       mance issues and the fact that there is no
+                       way to get all aliases from DNS.  If your
+                       machine's hostname (as returned by the
+                       hostname command) is already fully quali-
+                       fied you shouldn't need to set _f_q_d_n.  This
+                       flag is _o_f_f by default.
+
+       ignore_dot      If set, ssuuddoo will ignore '.' or '' (cur-
+                       rent dir) in the PATH environment vari-
+                       able; the PATH itself is not modified.
+                       This flag is _o_f_f by default.
 
-       logfile     Path to the ssuuddoo log file (not the syslog log
-                   file).  Setting a path turns on logging to a
-                   file; negating this option turns it off.
+       ignore_local_sudoers
+                       If set via LDAP, parsing of
+                       @sysconfdir@/sudoers will be skipped.
+                       This is intended for Enterprises that wish
+                       to prevent the usage of local sudoers
+                       files so that only LDAP is used.  This
+                       thwarts the efforts of rogue operators who
+                       would attempt to add roles to
+                       @sysconfdir@/sudoers.  When this option is
+                       present, @sysconfdir@/sudoers does not
+                       even need to exist.  Since this option
+                       tells ssuuddoo how to behave when no specific
+                       LDAP entries have been matched, this
+                       sudoOption is only meaningful for the
+                       cn=defaults section.  This flag is _o_f_f by
+                       default.
 
-       syslog      Syslog facility if syslog is being used for
-                   logging (negate to disable syslog logging).
-                   Defaults to local2.
+       insults         If set, ssuuddoo will insult users when they
+                       enter an incorrect password.  This flag is
+                       _o_f_f by default.
 
-       mailerpath  Path to mail program used to send warning
-                   mail.  Defaults to the path to sendmail found
-                   at configure time.
+       log_host        If set, the hostname will be logged in the
+                       (non-syslog) ssuuddoo log file.  This flag is
+                       _o_f_f by default.
 
-       mailerflags Flags to use when invoking mailer. Defaults to
-                   --tt.
+       log_year        If set, the four-digit year will be logged
+                       in the (non-syslog) ssuuddoo log file.  This
+                       flag is _o_f_f by default.
 
+       long_otp_prompt When validating with a One Time Password
+                       (OPT) scheme such as SS//KKeeyy or OOPPIIEE, a two-
+                       line prompt is used to make it easier to
+                       cut and paste the challenge to a local
+                       window.  It's not as pretty as the default
+                       but some people find it more convenient.
 
 
 
-1.7                       June 23, 2007                        12
+1.7                      August 15, 2007                       10
 
 
 
@@ -796,64 +664,64 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       mailto      Address to send warning and error mail to.
-                   The address should be enclosed in double
-                   quotes (") to protect against ssuuddoo interpret­
-                   ing the @ sign.  Defaults to root.
+                       This flag is _o_f_f by default.
 
-       exempt_group
-                   Users in this group are exempt from password
-                   and PATH requirements.  This is not set by
-                   default.
+       mail_always     Send mail to the _m_a_i_l_t_o user every time a
+                       users runs ssuuddoo.  This flag is _o_f_f by
+                       default.
 
-       secure_path Path used for every command run from ssuuddoo.  If
-                   you don't trust the people running ssuuddoo to
-                   have a sane PATH environment variable you may
-                   want to use this.  Another use is if you want
-                   to have the "root path" be separate from the
-                   "user path."  Users in the group specified by
-                   the _e_x_e_m_p_t___g_r_o_u_p option are not affected by
-                   _s_e_c_u_r_e___p_a_t_h.  This is not set by default.
+       mail_badpass    Send mail to the _m_a_i_l_t_o user if the user
+                       running ssuuddoo does not enter the correct
+                       password.  This flag is _o_f_f by default.
 
-       verifypw    This option controls when a password will be
-                   required when a user runs ssuuddoo with the --vv
-                   flag.  It has the following possible values:
+       mail_no_host    If set, mail will be sent to the _m_a_i_l_t_o
+                       user if the invoking user exists in the
+                       _s_u_d_o_e_r_s file, but is not allowed to run
+                       commands on the current host.  This flag
+                       is _o_f_f by default.
 
-                   all     All the user's _s_u_d_o_e_r_s entries for the
-                           current host must have the NOPASSWD
-                           flag set to avoid entering a password.
+       mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o
+                       user if the invoking user is allowed to
+                       use ssuuddoo but the command they are trying
+                       is not listed in their _s_u_d_o_e_r_s file entry
+                       or is explicitly denied.  This flag is _o_f_f
+                       by default.
 
-                   any     At least one of the user's _s_u_d_o_e_r_s
-                           entries for the current host must have
-                           the NOPASSWD flag set to avoid enter­
-                           ing a password.
+       mail_no_user    If set, mail will be sent to the _m_a_i_l_t_o
+                       user if the invoking user is not in the
+                       _s_u_d_o_e_r_s file.  This flag is _o_n by default.
 
-                   never   The user need never enter a password
-                           to use the --vv flag.
+       noexec          If set, all commands run via ssuuddoo will
+                       behave as if the NOEXEC tag has been set,
+                       unless overridden by a EXEC tag.  See the
+                       description of _N_O_E_X_E_C _a_n_d _E_X_E_C below as
+                       well as the "PREVENTING SHELL ESCAPES"
+                       section at the end of this manual.  This
+                       flag is _o_f_f by default.
 
-                   always  The user must always enter a password
-                           to use the --vv flag.
+       path_info       Normally, ssuuddoo will tell the user when a
+                       command could not be found in their PATH
+                       environment variable.  Some sites may wish
+                       to disable this as it could be used to
+                       gather information on the location of exe-
+                       cutables that the normal user does not
+                       have access to.  The disadvantage is that
+                       if the executable is simply not in the
+                       user's PATH, ssuuddoo will tell the user that
+                       they are not allowed to run it, which can
+                       be confusing.  This flag is _o_n by default.
 
-                   If no value is specified, a value of _a_l_l is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _a_l_l.
+       preserve_groups By default ssuuddoo will initialize the group
+                       vector to the list of groups the target
+                       user is in.  When _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set,
+                       the user's existing group vector is left
+                       unaltered.  The real and effective group
+                       IDs, however, are still set to match the
+                       target user.  This flag is _o_f_f by default.
 
-       listpw      This option controls when a password will be
-                   required when a user runs ssuuddoo with the --ll
-                   flag.  It has the following possible values:
-
-                   all     All the user's _s_u_d_o_e_r_s entries for the
-                           current host must have the NOPASSWD
-                           flag set to avoid entering a password.
-
-                   any     At least one of the user's _s_u_d_o_e_r_s
-                           entries for the current host must have
-                           the NOPASSWD flag set to avoid
 
 
-
-1.7                       June 23, 2007                        13
+1.7                      August 15, 2007                       11
 
 
 
@@ -862,361 +730,485 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                           entering a password.
+       requiretty      If set, ssuuddoo will only run when the user
+                       is logged in to a real tty.  This will
+                       disallow things like "rsh somehost sudo
+                       ls" since _r_s_h(1) does not allocate a tty.
+                       Because it is not possible to turn off
+                       echo when there is no tty present, some
+                       sites may wish to set this flag to prevent
+                       a user from entering a visible password.
+                       This flag is _o_f_f by default.
+
+       root_sudo       If set, root is allowed to run ssuuddoo too.
+                       Disabling this prevents users from "chain-
+                       ing" ssuuddoo commands to get a root shell by
+                       doing something like "sudo sudo /bin/sh".
+                       Note, however, that turning off _r_o_o_t___s_u_d_o
+                       will also prevent root and from running
+                       ssuuddooeeddiitt.  Disabling _r_o_o_t___s_u_d_o provides no
+                       real additional security; it exists purely
+                       for historical reasons.  This flag is _o_n
+                       by default.
+
+       rootpw          If set, ssuuddoo will prompt for the root
+                       password instead of the password of the
+                       invoking user.  This flag is _o_f_f by
+                       default.
+
+       runaspw         If set, ssuuddoo will prompt for the password
+                       of the user defined by the _r_u_n_a_s___d_e_f_a_u_l_t
+                       option (defaults to root) instead of the
+                       password of the invoking user.  This flag
+                       is _o_f_f by default.
+
+       set_home        If set and ssuuddoo is invoked with the --ss
+                       flag the HOME environment variable will be
+                       set to the home directory of the target
+                       user (which is root unless the --uu option
+                       is used).  This effectively makes the --ss
+                       flag imply --HH.  This flag is _o_f_f by
+                       default.
+
+       set_logname     Normally, ssuuddoo will set the LOGNAME, USER
+                       and USERNAME environment variables to the
+                       name of the target user (usually root
+                       unless the --uu flag is given).  However,
+                       since some programs (including the RCS
+                       revision control system) use LOGNAME to
+                       determine the real identity of the user,
+                       it may be desirable to change this behav-
+                       ior.  This can be done by negating the
+                       set_logname option.  Note that if the
+                       _e_n_v___r_e_s_e_t option has not been disabled,
+                       entries in the _e_n_v___k_e_e_p list will override
+                       the value of _s_e_t___l_o_g_n_a_m_e.  This flag is
+                       _o_f_f by default.
+
+
+
+1.7                      August 15, 2007                       12
 
-                   never   The user need never enter a password
-                           to use the --ll flag.
 
-                   always  The user must always enter a password
-                           to use the --ll flag.
 
-                   If no value is specified, a value of _a_n_y is
-                   implied.  Negating the option results in a
-                   value of _n_e_v_e_r being used.  The default value
-                   is _a_n_y.
 
-       LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-       env_check   Environment variables to be removed from the
-                   user's environment if the variable's value
-                   contains % or / characters.  This can be used
-                   to guard against printf-style format vulnera­
-                   bilities in poorly-written programs.  The
-                   argument may be a double-quoted, space-sepa­
-                   rated list or a single value without dou­
-                   ble-quotes.  The list can be replaced, added
-                   to, deleted from, or disabled by using the =,
-                   +=, -=, and ! operators respectively.  Regard­
-                   less of whether the env_reset option is
-                   enabled or disabled, variables specified by
-                   env_check will be preserved in the environment
-                   if they pass the aforementioned check.  The
-                   default list of environment variables to check
-                   is displayed when ssuuddoo is run by root with the
-                   _-_V option.
-
-       env_delete  Environment variables to be removed from the
-                   user's environment.  The argument may be a
-                   double-quoted, space-separated list or a sin­
-                   gle value without double-quotes.  The list can
-                   be replaced, added to, deleted from, or dis­
-                   abled by using the =, +=, -=, and ! operators
-                   respectively.  The default list of environment
-                   variables to remove is displayed when ssuuddoo is
-                   run by root with the _-_V option.  Note that
-                   many operating systems will remove potentially
-                   dangerous variables from the environment of
-                   any setuid process (such as ssuuddoo).
-
-       env_keep    Environment variables to be preserved in the
-                   user's environment when the _e_n_v___r_e_s_e_t option
-                   is in effect.  This allows fine-grained con­
-                   trol over the environment ssuuddoo-spawned pro­
-                   cesses will receive.  The argument may be a
-                   double-quoted, space-separated list or a sin­
-                   gle value without double-quotes.  The list can
-                   be replaced, added to, deleted from, or
-
-
-
-1.7                       June 23, 2007                        14
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       setenv          Allow the user to disable the _e_n_v___r_e_s_e_t
+                       option from the command line.  Addition-
+                       ally, environment variables set via the
+                       command line are not subject to the
+                       restrictions imposed by _e_n_v___c_h_e_c_k,
+                       _e_n_v___d_e_l_e_t_e, or _e_n_v___k_e_e_p.  As such, only
+                       trusted users should be allowed to set
+                       variables in this manner.  This flag is
+                       _o_f_f by default.
+
+       shell_noargs    If set and ssuuddoo is invoked with no argu-
+                       ments it acts as if the --ss flag had been
+                       given.  That is, it runs a shell as root
+                       (the shell is determined by the SHELL
+                       environment variable if it is set, falling
+                       back on the shell listed in the invoking
+                       user's /etc/passwd entry if not).  This
+                       flag is _o_f_f by default.
+
+       stay_setuid     Normally, when ssuuddoo executes a command the
+                       real and effective UIDs are set to the
+                       target user (root by default).  This
+                       option changes that behavior such that the
+                       real UID is left as the invoking user's
+                       UID.  In other words, this makes ssuuddoo act
+                       as a setuid wrapper.  This can be useful
+                       on systems that disable some potentially
+                       dangerous functionality when a program is
+                       run setuid.  This option is only effective
+                       on systems with either the _s_e_t_r_e_u_i_d_(_) or
+                       _s_e_t_r_e_s_u_i_d_(_) function.  This flag is _o_f_f by
+                       default.
+
+       targetpw        If set, ssuuddoo will prompt for the password
+                       of the user specified by the --uu flag
+                       (defaults to root) instead of the password
+                       of the invoking user.  Note that this pre-
+                       cludes the use of a uid not listed in the
+                       passwd database as an argument to the --uu
+                       flag.  This flag is _o_f_f by default.
+
+       tty_tickets     If set, users must authenticate on a per-
+                       tty basis.  Normally, ssuuddoo uses a direc-
+                       tory in the ticket dir with the same name
+                       as the user running it.  With this flag
+                       enabled, ssuuddoo will use a file named for
+                       the tty the user is logged in on in that
+                       directory.  This flag is _o_f_f by default.
+
+       use_loginclass  If set, ssuuddoo will apply the defaults spec-
+                       ified for the target user's login class if
+                       one exists.  Only available if ssuuddoo is
+                       configured with the --with-logincap
+                       option.  This flag is _o_f_f by default.
+
+
+
+1.7                      August 15, 2007                       13
 
 
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                   disabled by using the =, +=, -=, and ! opera­
-                   tors respectively.  The default list of vari­
-                   ables to keep is displayed when ssuuddoo is run by
-                   root with the _-_V option.
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-       When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following
-       values for the syslog facility (the value of the ssyysslloogg
-       Parameter): aauutthhpprriivv (if your OS supports it), aauutthh, ddaaee­­
-       mmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33, llooccaall44, llooccaall55,
-       llooccaall66, and llooccaall77.  The following syslog priorities are
-       supported: aalleerrtt, ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee,
-       and wwaarrnniinngg.
 
-       UUsseerr SSppeecciiffiiccaattiioonn
+       IInntteeggeerrss:
 
-        User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
-                      (':' Host_List '=' Cmnd_Spec_List)*
+       closefrom       Before it executes a command, ssuuddoo will
+                       close all open file descriptors other than
+                       standard input, standard output and stan-
+                       dard error (ie: file descriptors 0-2).
+                       The _c_l_o_s_e_f_r_o_m option can be used to spec-
+                       ify a different file descriptor at which
+                       to start closing.  The default is 3.
 
-        Cmnd_Spec_List ::= Cmnd_Spec |
-                           Cmnd_Spec ',' Cmnd_Spec_List
+       passwd_tries    The number of tries a user gets to enter
+                       his/her password before ssuuddoo logs the
+                       failure and exits.  The default is 3.
 
-        Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
+       IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-        Runas_Spec ::= '(' Runas_List ')'
+       loglinelen      Number of characters per line for the file
+                       log.  This value is used to decide when to
+                       wrap lines for nicer log files.  This has
+                       no effect on the syslog log file, only the
+                       file log.  The default is 80 (use 0 or
+                       negate the option to disable word wrap).
 
-        Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
-                      'SETENV:' | 'NOSETENV:' | 'MONITOR:' | 'NOMONITOR:')
+       passwd_timeout  Number of minutes before the ssuuddoo password
+                       prompt times out.  The default is 5; set
+                       this to 0 for no password timeout.
 
-       A uusseerr ssppeecciiffiiccaattiioonn determines which commands a user may
-       run (and as what user) on specified hosts.  By default,
-       commands are run as rroooott, but this can be changed on a
-       per-command basis.
+       timestamp_timeout
+                       Number of minutes that can elapse before
+                       ssuuddoo will ask for a passwd again.  The
+                       default is 5.  Set this to 0 to always
+                       prompt for a password.  If set to a value
+                       less than 0 the user's timestamp will
+                       never expire.  This can be used to allow
+                       users to create or delete their own times-
+                       tamps via sudo -v and sudo -k respec-
+                       tively.
+
+       umask           Umask to use when running the command.
+                       Negate this option or set it to 0777 to
+                       preserve the user's umask.  The default is
+                       0022.
 
-       Let's break that down into its constituent parts:
+       SSttrriinnggss:
 
-       RRuunnaass__SSppeecc
+       badpass_message Message that is displayed if a user enters
+                       an incorrect password.  The default is
+                       Sorry, try again. unless insults are
+                       enabled.
 
-       A Runas_Spec is simply a Runas_List (as defined above)
-       enclosed in a set of parentheses.  If you do not specify a
-       Runas_Spec in the user specification, a default Runas_Spec
-       of rroooott will be used.  A Runas_Spec sets the default for
-       commands that follow it.  What this means is that for the
-       entry:
+       editor          A colon (':') separated list of editors
+                       allowed to be used with vviissuuddoo.  vviissuuddoo
+                       will choose the editor that matches the
+                       user's EDITOR environment variable if
 
-        dgb    boulder = (operator) /bin/ls, /bin/kill, /usr/bin/lprm
 
-       The user ddggbb may run _/_b_i_n_/_l_s, _/_b_i_n_/_k_i_l_l, and _/_u_s_r_/_b_i_n_/_l_p_r_m
-       -- but only as ooppeerraattoorr.  E.g.,
 
-        $ sudo -u operator /bin/ls.
+1.7                      August 15, 2007                       14
 
-       It is also possible to override a Runas_Spec later on in
-       an entry.  If we modify the entry like so:
 
 
 
 
-1.7                       June 23, 2007                        15
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       possible, or the first editor in the list
+                       that exists and is executable.  The
+                       default is the path to vi on your system.
 
+       mailsub         Subject of the mail sent to the _m_a_i_l_t_o
+                       user. The escape %h will expand to the
+                       hostname of the machine.  Default is ***
+                       SECURITY information for %h ***.
 
+       noexec_file     Path to a shared library containing dummy
+                       versions of the _e_x_e_c_v_(_), _e_x_e_c_v_e_(_) and _f_e_x_-
+                       _e_c_v_e_(_) library functions that just return
+                       an error.  This is used to implement the
+                       _n_o_e_x_e_c functionality on systems that sup-
+                       port LD_PRELOAD or its equivalent.
+                       Defaults to
+                       _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       passprompt      The default prompt to use when asking for
+                       a password; can be overridden via the --pp
+                       option or the SUDO_PROMPT environment
+                       variable.  The following percent (`%')
+                       escapes are supported:
 
+                       %H  expanded to the local hostname includ-
+                           ing the domain name (on if the
+                           machine's hostname is fully qualified
+                           or the _f_q_d_n option is set)
 
-        dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
+                       %h  expanded to the local hostname without
+                           the domain name
 
-       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr,
-       but  _/_b_i_n_/_k_i_l_l and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
+                       %U  expanded to the login name of the user
+                           the command will be run as (defaults
+                           to root)
 
-       TTaagg__SSppeecc
+                       %u  expanded to the invoking user's login
+                           name
 
-       A command may have zero or more tags associated with it.
-       There are eight possible tag values, NOPASSWD, PASSWD,
-       NOEXEC, EXEC, SETENV, NOSETENV, MONITOR and NOMONITOR.
-       Once a tag is set on a Cmnd, subsequent Cmnds in the
-       Cmnd_Spec_List, inherit the tag unless it is overridden by
-       the opposite tag (i.e.: PASSWD overrides NOPASSWD and
-       NOEXEC overrides EXEC).
+                       %%  two consecutive % characters are col-
+                           lapsed into a single % character
 
-       _N_O_P_A_S_S_W_D _a_n_d _P_A_S_S_W_D
+                       The default value is Password:.
 
-       By default, ssuuddoo requires that a user authenticate him or
-       herself before running a command.  This behavior can be
-       modified via the NOPASSWD tag.  Like a Runas_Spec, the
-       NOPASSWD tag sets a default for the commands that follow
-       it in the Cmnd_Spec_List.  Conversely, the PASSWD tag can
-       be used to reverse things.  For example:
+       runas_default   The default user to run commands as if the
+                       --uu flag is not specified on the command
+                       line.  This defaults to root.  Note that
+                       if _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur
+                       before any Runas_Alias specifications.
 
-        ray    rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm
+       syslog_badpri   Syslog priority to use when user authenti-
+                       cates unsuccessfully.  Defaults to alert.
 
-       would allow the user rraayy to run _/_b_i_n_/_k_i_l_l, _/_b_i_n_/_l_s, and
-       _/_u_s_r_/_b_i_n_/_l_p_r_m as root on the machine rushmore as rroooott
-       without authenticating himself.  If we only want rraayy to be
-       able to run _/_b_i_n_/_k_i_l_l without a password the entry would
-       be:
+       syslog_goodpri  Syslog priority to use when user
 
-        ray    rushmore = NOPASSWD: /bin/kill, PASSWD: /bin/ls, /usr/bin/lprm
 
-       Note, however, that the PASSWD tag has no effect on users
-       who are in the group specified by the _e_x_e_m_p_t___g_r_o_u_p option.
 
-       By default, if the NOPASSWD tag is applied to any of the
-       entries for a user on the current host, he or she will be
-       able to run sudo -l without a password.  Additionally, a
-       user may only run sudo -v without a password if the
-       NOPASSWD tag is present for all a user's entries that per­
-       tain to the current host.  This behavior may be overridden
-       via the verifypw and listpw options.
+1.7                      August 15, 2007                       15
 
-       _N_O_E_X_E_C _a_n_d _E_X_E_C
 
-       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the
-       underlying operating system supports it, the NOEXEC tag
-       can be used to prevent a dynamically-linked executable
-       from running further commands itself.
 
-       In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e
-       and _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-1.7                       June 23, 2007                        16
 
+                       authenticates successfully.  Defaults to
+                       notice.
 
+       timestampdir    The directory in which ssuuddoo stores its
+                       timestamp files.  The default is
+                       _/_v_a_r_/_r_u_n_/_s_u_d_o.
 
+       timestampowner  The owner of the timestamp directory and
+                       the timestamps stored therein.  The
+                       default is root.
 
+       SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       exempt_group
+                   Users in this group are exempt from password
+                   and PATH requirements.  This is not set by
+                   default.
 
+       lecture     This option controls when a short lecture will
+                   be printed along with the password prompt.  It
+                   has the following possible values:
 
-        aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
+                   always  Always lecture the user.
 
-       See the "PREVENTING SHELL ESCAPES" section below for more
-       details on how NOEXEC works and whether or not it will
-       work on your system.
+                   never   Never lecture the user.
 
-       _S_E_T_E_N_V _a_n_d _N_O_S_E_T_E_N_V
+                   once    Only lecture the user the first time
+                           they run ssuuddoo.
 
-       These tags override the value of the _s_e_t_e_n_v option on a
-       per-command basis.  Note that environment variables set on
-       the command line way are not subject to the restrictions
-       imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or _e_n_v___r_e_s_e_t.  As such,
-       only trusted users should be allowed to set variables in
-       this manner.
+                   If no value is specified, a value of _o_n_c_e is
+                   implied.  Negating the option results in a
+                   value of _n_e_v_e_r being used.  The default value
+                   is _o_n_c_e.
 
-       _M_O_N_I_T_O_R _a_n_d _N_O_M_O_N_I_T_O_R
+       lecture_file
+                   Path to a file containing an alternate ssuuddoo
+                   lecture that will be used in place of the
+                   standard lecture if the named file exists.  By
+                   default, ssuuddoo uses a built-in lecture.
 
-       If ssuuddoo has been configured with the --with-systrace
-       option, the MONITOR tag can be used to cause programs
-       spawned by a command to be checked against _s_u_d_o_e_r_s and
-       logged just like they would be if run through ssuuddoo
-       directly.  This is useful in conjunction with commands
-       that allow shell escapes such as editors, shells and pagi­
-       nators.
+       listpw      This option controls when a password will be
+                   required when a user runs ssuuddoo with the --ll
+                   flag.  It has the following possible values:
 
-       In the following example, user cchhuucckk may run any command
-       on the machine research in monitor mode.
+                   all     All the user's _s_u_d_o_e_r_s entries for the
+                           current host must have the NOPASSWD
+                           flag set to avoid entering a password.
 
-        chuck  research = MONITOR: ALL
+                   always  The user must always enter a password
+                           to use the --ll flag.
 
-       See the "PREVENTING SHELL ESCAPES" section below for more
-       details on how MONITOR works and whether or not it will
-       work on your system.
+                   any     At least one of the user's _s_u_d_o_e_r_s
+                           entries for the current host must have
+                           the NOPASSWD flag set to avoid
 
-       WWiillddccaarrddss
 
-       ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob char­
-       acters) to be used in pathnames as well as command line
-       arguments in the _s_u_d_o_e_r_s file.  Wildcard matching is done
-       via the PPOOSSIIXX _f_n_m_a_t_c_h(3) routine.  Note that these are _n_o_t
-       regular expressions.
 
-       *       Matches any set of zero or more characters.
+1.7                      August 15, 2007                       16
 
-       ?       Matches any single character.
 
-       [...]   Matches any character in the specified range.
 
-       [!...]  Matches any character nnoott in the specified range.
 
-       \x      For any character "x", evaluates to "x".  This is
-               used to escape special characters such as: "*",
-               "?", "[", and "}".
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                           entering a password.
 
-1.7                       June 23, 2007                        17
+                   never   The user need never enter a password
+                           to use the --ll flag.
 
+                   If no value is specified, a value of _a_n_y is
+                   implied.  Negating the option results in a
+                   value of _n_e_v_e_r being used.  The default value
+                   is _a_n_y.
 
+       logfile     Path to the ssuuddoo log file (not the syslog log
+                   file).  Setting a path turns on logging to a
+                   file; negating this option turns it off.  By
+                   default, ssuuddoo logs via syslog.
 
+       mailerflags Flags to use when invoking mailer. Defaults to
+                   --tt.
 
+       mailerpath  Path to mail program used to send warning
+                   mail.  Defaults to the path to sendmail found
+                   at configure time.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       mailto      Address to send warning and error mail to.
+                   The address should be enclosed in double
+                   quotes (") to protect against ssuuddoo interpret-
+                   ing the @ sign.  Defaults to root.
 
+       secure_path Path used for every command run from ssuuddoo.  If
+                   you don't trust the people running ssuuddoo to
+                   have a sane PATH environment variable you may
+                   want to use this.  Another use is if you want
+                   to have the "root path" be separate from the
+                   "user path."  Users in the group specified by
+                   the _e_x_e_m_p_t___g_r_o_u_p option are not affected by
+                   _s_e_c_u_r_e___p_a_t_h.  This is not set by default.
 
-       Note that a forward slash ('/') will nnoott be matched by
-       wildcards used in the pathname.  When matching the command
-       line arguments, however, a slash ddooeess get matched by wild­
-       cards.  This is to make a path like:
+       syslog      Syslog facility if syslog is being used for
+                   logging (negate to disable syslog logging).
+                   Defaults to local2.
 
-           /usr/bin/*
+       verifypw    This option controls when a password will be
+                   required when a user runs ssuuddoo with the --vv
+                   flag.  It has the following possible values:
 
-       match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
+                   all     All the user's _s_u_d_o_e_r_s entries for the
+                           current host must have the NOPASSWD
+                           flag set to avoid entering a password.
 
-       EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
+                   always  The user must always enter a password
+                           to use the --vv flag.
 
-       The following exceptions apply to the above rules:
+                   any     At least one of the user's _s_u_d_o_e_r_s
+                           entries for the current host must have
+                           the NOPASSWD flag set to avoid
 
-       ""      If the empty string "" is the only command line
-               argument in the _s_u_d_o_e_r_s entry it means that com­
-               mand is not allowed to be run with aannyy arguments.
 
-       IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
 
-       It is possible to include other _s_u_d_o_e_r_s files from within
-       the _s_u_d_o_e_r_s file currently being parsed using the #include
-       directive, similar to the one used by the C preprocessor.
-       This is useful, for example, for keeping a site-wide _s_u_d_o_­
-       _e_r_s file in addition to a per-machine local one.  For the
-       sake of this example the site-wide _s_u_d_o_e_r_s will be
-       _/_e_t_c_/_s_u_d_o_e_r_s and the per-machine one will be _/_e_t_c_/_s_u_d_o_­
-       _e_r_s_._l_o_c_a_l.  To include _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l from _/_e_t_c_/_s_u_d_o_­
-       _e_r_s we would use the following line in _/_e_t_c_/_s_u_d_o_e_r_s:
+1.7                      August 15, 2007                       17
 
-        #include /etc/sudoers.local
 
-       When ssuuddoo reaches this line it will suspend processing of
-       the current file (_/_e_t_c_/_s_u_d_o_e_r_s) and switch to _/_e_t_c_/_s_u_d_o_­
-       _e_r_s_._l_o_c_a_l.  Upon reaching the end of _/_e_t_c_/_s_u_d_o_e_r_s_._l_o_c_a_l,
-       the rest of _/_e_t_c_/_s_u_d_o_e_r_s will be processed.  Files that
-       are included may themselves include other files.  A hard
-       limit of 128 nested include files is enforced to prevent
-       include file loops.
 
-       OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
 
-       The pound sign ('#') is used to indicate a comment (unless
-       it is part of a #include directive or unless it occurs in
-       the context of a user name and is followed by one or more
-       digits, in which case it is treated as a uid).  Both the
-       comment character and any text after it, up to the end of
-       the line, are ignored.
 
-       The reserved word AALLLL is a built-in _a_l_i_a_s that always
-       causes a match to succeed.  It can be used wherever one
-       might otherwise use a Cmnd_Alias, User_Alias, Runas_Alias,
-       or Host_Alias.  You should not try to define your own
-       _a_l_i_a_s called AALLLL as the built-in alias will be used in
-       preference to your own.  Please note that using AALLLL can be
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                           entering a password.
 
-1.7                       June 23, 2007                        18
+                   never   The user need never enter a password
+                           to use the --vv flag.
 
+                   If no value is specified, a value of _a_l_l is
+                   implied.  Negating the option results in a
+                   value of _n_e_v_e_r being used.  The default value
+                   is _a_l_l.
 
+       LLiissttss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
+       env_check       Environment variables to be removed from
+                       the user's environment if the variable's
+                       value contains % or / characters.  This
+                       can be used to guard against printf-style
+                       format vulnerabilities in poorly-written
+                       programs.  The argument may be a dou-
+                       ble-quoted, space-separated list or a sin-
+                       gle value without double-quotes.  The list
+                       can be replaced, added to, deleted from,
+                       or disabled by using the =, +=, -=, and !
+                       operators respectively.  Regardless of
+                       whether the env_reset option is enabled or
+                       disabled, variables specified by env_check
+                       will be preserved in the environment if
+                       they pass the aforementioned check.  The
+                       default list of environment variables to
+                       check is displayed when ssuuddoo is run by
+                       root with the _-_V option.
+
+       env_delete      Environment variables to be removed from
+                       the user's environment.  The argument may
+                       be a double-quoted, space-separated list
+                       or a single value without double-quotes.
+                       The list can be replaced, added to,
+                       deleted from, or disabled by using the =,
+                       +=, -=, and ! operators respectively.  The
+                       default list of environment variables to
+                       remove is displayed when ssuuddoo is run by
+                       root with the _-_V option.  Note that many
+                       operating systems will remove potentially
+                       dangerous variables from the environment
+                       of any setuid process (such as ssuuddoo).
+
+       env_keep        Environment variables to be preserved in
+                       the user's environment when the _e_n_v___r_e_s_e_t
+                       option is in effect.  This allows fine-
+                       grained control over the environment
+                       ssuuddoo-spawned processes will receive.  The
+                       argument may be a double-quoted, space-
+                       separated list or a single value without
+                       double-quotes.  The list can be replaced,
+                       added to, deleted from, or disabled by
+
+
+
+1.7                      August 15, 2007                       18
 
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       dangerous since in a command context, it allows the user
-       to run aannyy command on the system.
 
-       An exclamation point ('!') can be used as a logical _n_o_t
-       operator both in an _a_l_i_a_s and in front of a Cmnd.  This
-       allows one to exclude certain values.  Note, however, that
-       using a ! in conjunction with the built-in ALL alias to
-       allow a user to run "all but a few" commands rarely works
-       as intended (see SECURITY NOTES below).
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
-       Long lines can be continued with a backslash ('\') as the
-       last character on the line.
 
-       Whitespace between elements in a list as well as special
-       syntactic characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':',
-       '(', ')') is optional.
+                       using the =, +=, -=, and ! operators
+                       respectively.  The default list of vari-
+                       ables to keep is displayed when ssuuddoo is
+                       run by root with the _-_V option.
 
-       The following characters must be escaped with a backslash
-       ('\') when used as part of a word (e.g. a username or
-       hostname): '@', '!', '=', ':', ',', '(', ')', '\'.
+       When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following
+       values for the syslog facility (the value of the ssyysslloogg
+       Parameter): aauutthhpprriivv (if your OS supports it), aauutthh, ddaaee--
+       mmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33, llooccaall44, llooccaall55,
+       llooccaall66, and llooccaall77.  The following syslog priorities are
+       supported: aalleerrtt, ccrriitt, ddeebbuugg, eemmeerrgg, eerrrr, iinnffoo, nnoottiiccee,
+       and wwaarrnniinngg.
 
 FFIILLEESS
-        /etc/sudoers           List of who can run what
-        /etc/group             Local groups file
-        /etc/netgroup          List of network groups
+       _/_e_t_c_/_s_u_d_o_e_r_s         List of who can run what
+       _/_e_t_c_/_g_r_o_u_p           Local groups file
+       _/_e_t_c_/_n_e_t_g_r_o_u_p        List of network groups
 
 EEXXAAMMPPLLEESS
        Below are example _s_u_d_o_e_r_s entries.  Admittedly, some of
@@ -1241,23 +1233,6 @@ EEXXAAMMPPLLEESS
         Host_Alias     SERVERS = master, mail, www, ns
         Host_Alias     CDROM = orion, perseus, hercules
 
-
-
-
-
-
-
-
-
-1.7                       June 23, 2007                        19
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
         # Cmnd alias specification
         Cmnd_Alias     DUMPS = /usr/bin/mt, /usr/sbin/dump, /usr/sbin/rdump,\
                                /usr/sbin/restore, /usr/sbin/rrestore
@@ -1272,6 +1247,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Cmnd_Alias     SU = /usr/bin/su
         Cmnd_Alias     PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
 
+
+
+1.7                      August 15, 2007                       19
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        Here we override some of the compiled in default values.
        We want ssuuddoo to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility
        in all cases.  We don't want to subject the full time
@@ -1283,7 +1269,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        sure we log the year in each log line since the log
        entries will be kept around for several years.  Lastly, we
        disable shell escapes for the commands in the PAGERS
-       Cmnd_Alias (/usr/bin/more, /usr/bin/pg and /usr/bin/less).
+       Cmnd_Alias (_/_u_s_r_/_b_i_n_/_m_o_r_e, _/_u_s_r_/_b_i_n_/_p_g and _/_u_s_r_/_b_i_n_/_l_e_s_s).
 
         # Override built-in defaults
         Defaults               syslog=auth
@@ -1293,7 +1279,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Defaults@SERVERS       log_year, logfile=/var/log/sudo.log
         Defaults!PAGERS        noexec
 
-       The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually deter­
+       The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually deter-
        mines who may run what.
 
         root           ALL = (ALL) ALL
@@ -1310,20 +1296,9 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         PARTTIMERS     ALL = ALL
 
        Part time sysadmins (bboossttlleeyy, jjwwffooxx, and ccrraawwll) may run
-       any command on any host but they must authenticate them­
+       any command on any host but they must authenticate them-
        selves first (since the entry lacks the NOPASSWD tag).
 
-
-
-1.7                       June 23, 2007                        20
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
         jack           CSNETS = ALL
 
        The user jjaacckk may run any command on the machines in the
@@ -1338,10 +1313,21 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        The user lliissaa may run any command on any host in the
        _C_U_N_E_T_S alias (the class B network 128.138.0.0).
 
+
+
+1.7                      August 15, 2007                       20
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
         operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
                        sudoedit /etc/printcap, /usr/oper/bin/
 
-       The ooppeerraattoorr user may run commands limited to simple main­
+       The ooppeerraattoorr user may run commands limited to simple main-
        tenance.  Here, those are commands related to backups,
        killing processes, the printing system, shutting down the
        system, and any commands in the directory _/_u_s_r_/_o_p_e_r_/_b_i_n_/.
@@ -1366,7 +1352,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         jim            +biglab = ALL
 
        The user jjiimm may run any command on machines in the _b_i_g_l_a_b
-       netgroup.  SSuuddoo knows that "biglab" is a netgroup due to
+       netgroup.  ssuuddoo knows that "biglab" is a netgroup due to
        the '+' prefix.
 
         +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
@@ -1378,18 +1364,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         fred           ALL = (DB) NOPASSWD: ALL
 
        The user ffrreedd can run commands as any user in the _D_B
-
-
-
-1.7                       June 23, 2007                        21
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        Runas_Alias (oorraaccllee or ssyybbaassee) without giving a password.
 
         john           ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*
@@ -1405,8 +1379,19 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
         jill           SERVERS = /usr/bin/, !SU, !SHELLS
 
+
+
+1.7                      August 15, 2007                       21
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run
-       any commands in the directory /usr/bin/ except for those
+       any commands in the directory _/_u_s_r_/_b_i_n_/ except for those
        commands belonging to the _S_U and _S_H_E_L_L_S Cmnd_Aliases.
 
         steve          CSNETS = (operator) /usr/local/op_commands/
@@ -1436,28 +1421,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 SSEECCUURRIITTYY NNOOTTEESS
        It is generally not effective to "subtract" commands from
-       ALL using the '!' operator.  A user can trivially circum­
+       ALL using the '!' operator.  A user can trivially circum-
        vent this by copying the desired command to a different
        name and then executing that.  For example:
 
            bill        ALL = ALL, !SU, !SHELLS
 
        Doesn't really prevent bbiillll from running the commands
-       listed in _S_U or _S_H_E_L_L_S since he can simply copy those
-
-
-
-1.7                       June 23, 2007                        22
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
-       commands to a different name, or use a shell escape from
-       an editor or other program.  Therefore, these kind of
+       listed in _S_U or _S_H_E_L_L_S since he can simply copy those com-
+       mands to a different name, or use a shell escape from an
+       editor or other program.  Therefore, these kind of
        restrictions should be considered advisory at best (and
        reinforced by policy).
 
@@ -1470,26 +1443,37 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
        permit shell escapes include shells (obviously), editors,
        paginators, mail and terminal programs.
 
-       There are three basic approaches to this problem:
+       There are two basic approaches to this problem:
+
+
+
+1.7                      August 15, 2007                       22
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
 
        restrict  Avoid giving users access to commands that allow
-                 the user to run arbitrary commands.  Many edi­
+                 the user to run arbitrary commands.  Many edi-
                  tors have a restricted mode where shell escapes
-                 are disabled, though ssuuddooeeddiitt is a better solu­
+                 are disabled, though ssuuddooeeddiitt is a better solu-
                  tion to running editors via ssuuddoo.  Due to the
                  large number of programs that offer shell
-                 escapes, restricting users to the set of pro­
+                 escapes, restricting users to the set of pro-
                  grams that do not if often unworkable.
 
        noexec    Many systems that support shared libraries have
-                 the ability to override default library func­
-                 tions by pointing an environment variable (usu­
+                 the ability to override default library func-
+                 tions by pointing an environment variable (usu-
                  ally LD_PRELOAD) to an alternate shared library.
                  On such systems, ssuuddoo's _n_o_e_x_e_c functionality can
                  be used to prevent a program run by ssuuddoo from
                  executing any other programs.  Note, however,
                  that this applies only to native dynamically-
-                 linked executables.  Statically-linked executa­
+                 linked executables.  Statically-linked executa-
                  bles and foreign executables running under
                  binary emulation are not affected.
 
@@ -1507,79 +1491,29 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
                  of functions in the standard library with its
                  own that simply return an error.  Unfortunately,
                  there is no foolproof way to know whether or not
-                 _n_o_e_x_e_c will work at compile-time.  _N_o_e_x_e_c should
+                 _n_o_e_x_e_c will work at compile-time.  _n_o_e_x_e_c should
                  work on SunOS, Solaris, *BSD, Linux, IRIX, Tru64
                  UNIX, MacOS X, and HP-UX 11.x.  It is known nnoott
-
-
-
-1.7                       June 23, 2007                        23
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
-                 to work on AIX and UnixWare.  _N_o_e_x_e_c is expected
+                 to work on AIX and UnixWare.  _n_o_e_x_e_c is expected
                  to work on most operating systems that support
                  the LD_PRELOAD environment variable.  Check your
                  operating system's manual pages for the dynamic
                  linker (usually ld.so, ld.so.1, dyld, dld.sl,
-                 rld, or loader) to see if LD_PRELOAD is sup­
+                 rld, or loader) to see if LD_PRELOAD is sup-
                  ported.
 
                  To enable _n_o_e_x_e_c for a command, use the NOEXEC
-                 tag as documented in the User Specification sec­
+                 tag as documented in the User Specification sec-
                  tion above.  Here is that example again:
 
                   aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 
                  This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and
-                 _/_u_s_r_/_b_i_n_/_v_i with _n_o_e_x_e_c enabled.  This will pre­
-                 vent those two commands from executing other
-                 commands (such as a shell).  If you are unsure
-                 whether or not your system is capable of sup­
-                 porting _n_o_e_x_e_c you can always just try it out
-                 and see if it works.
-
-       monitor   On operating systems that support the ssyyssttrraaccee
-                 pseudo-device, the --with-systrace configure
-                 option can be used to compile support for proc­
-                 cess monitoring in ssuuddoo.  In monitor mode ssuuddoo
-                 can transparently intercept a new command, allow
-                 or deny it based on _s_u_d_o_e_r_s, and log the result.
-                 This does require that ssuuddoo become a daemon that
-                 persists until the command and all its descen­
-                 dents have exited.
-
-                 To enable monitor mode on a per-command basis,
-                 use the MONITOR tag as documented in the User
-                 Specification section above.  Here is that exam­
-                 ple again:
-
-                  chuck  research = MONITOR: ALL
-
-                 This allows user cchhuucckk to run any command on the
-                 machine research in monitor mode.  Any commands
-                 run via shell escapes will be logged by ssuuddoo.
-
-                 At the time of this writing the ssyyssttrraaccee pseudo-
-                 device comes standard with OpenBSD and NetBSD
-                 and is available as patches to FreeBSD, MacOS X
-                 and Linux.  See <http://www.systrace.org/> for
-                 more information.
+                 _/_u_s_r_/_b_i_n_/_v_i with _n_o_e_x_e_c enabled.  This will
 
-       Note that restricting shell escapes is not a panacea.
-       Programs running as root are still capable of many poten­
-       tially hazardous operations (such as changing or overwrit­
-       ing files) that could lead to unintended privilege escala­
-       tion.  In the specific case of an editor, a safer approach
 
 
-
-1.7                       June 23, 2007                        24
+1.7                      August 15, 2007                       23
 
 
 
@@ -1588,16 +1522,27 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                 prevent those two commands from executing other
+                 commands (such as a shell).  If you are unsure
+                 whether or not your system is capable of sup-
+                 porting _n_o_e_x_e_c you can always just try it out
+                 and see if it works.
+
+       Note that restricting shell escapes is not a panacea.
+       Programs running as root are still capable of many poten-
+       tially hazardous operations (such as changing or overwrit-
+       ing files) that could lead to unintended privilege escala-
+       tion.  In the specific case of an editor, a safer approach
        is to give the user permission to run ssuuddooeeddiitt.
 
 SSEEEE AALLSSOO
-       _r_s_h(1), _s_u(1), _f_n_m_a_t_c_h(3), sudo(1m), visudo(1m)
+       _r_s_h(1), _s_u(1), _f_n_m_a_t_c_h(3), _s_u_d_o(1m), _v_i_s_u_d_o(8)
 
 CCAAVVEEAATTSS
        The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo
-       command which locks the file and does grammatical check­
+       command which locks the file and does grammatical check-
        ing. It is imperative that _s_u_d_o_e_r_s be free of syntax
-       errors since ssuuddoo will not run with a syntactically incor­
+       errors since ssuuddoo will not run with a syntactically incor-
        rect _s_u_d_o_e_r_s file.
 
        When using netgroups of machines (as opposed to users), if
@@ -1611,17 +1556,17 @@ BBUUGGSS
        bug report at http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail­
-       ing list, see http://www.sudo.ws/mail­
+       Limited free support is available via the sudo-users mail-
+       ing list, see http://www.sudo.ws/mail-
        man/listinfo/sudo-users to subscribe or search the
        archives.
 
 DDIISSCCLLAAIIMMEERR
-       SSuuddoo is provided ``AS IS'' and any express or implied war­
-       ranties, including, but not limited to, the implied war­
+       ssuuddoo is provided ``AS IS'' and any express or implied war-
+       ranties, including, but not limited to, the implied war-
        ranties of merchantability and fitness for a particular
        purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com­
+       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
        plete details.
 
 
@@ -1634,17 +1579,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-1.7                       June 23, 2007                        25
+1.7                      August 15, 2007                       24
 
 
diff --git a/sudoers.man.in b/sudoers.man.in
index c415fb4fe..bffe07e31 100644
--- a/sudoers.man.in
+++ b/sudoers.man.in
@@ -1,4 +1,5 @@
-.\" Copyright (c) 1994-1996,1998-2005 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 1994-1996, 1998-2005, 2007
+.\" 	Todd C. Miller <Todd.Miller@courtesan.com>
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -149,7 +150,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOERS @mansectform@"
-.TH SUDOERS @mansectform@ "July  9, 2007" "1.7" "MAINTENANCE COMMANDS"
+.TH SUDOERS @mansectform@ "August 15, 2007" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 sudoers \- list of which users may execute what
 .SH "DESCRIPTION"
@@ -179,18 +180,18 @@ grammar for the language.  \s-1EBNF\s0 also contains the following
 operators, which many readers will recognize from regular
 expressions.  Do not, however, confuse them with \*(L"wildcard\*(R"
 characters, which have different meanings.
-.ie n .IP "\*(C`?\*(C'" 8
-.el .IP "\f(CW\*(C`?\*(C'\fR" 8
+.ie n .IP "\*(C`?\*(C'" 4
+.el .IP "\f(CW\*(C`?\*(C'\fR" 4
 .IX Item "?"
 Means that the preceding symbol (or group of symbols) is optional.
 That is, it may appear once or not at all.
-.ie n .IP "\*(C`*\*(C'" 8
-.el .IP "\f(CW\*(C`*\*(C'\fR" 8
+.ie n .IP "\*(C`*\*(C'" 4
+.el .IP "\f(CW\*(C`*\*(C'\fR" 4
 .IX Item "*"
 Means that the preceding symbol (or group of symbols) may appear
 zero or more times.
-.ie n .IP "\*(C`+\*(C'" 8
-.el .IP "\f(CW\*(C`+\*(C'\fR" 8
+.ie n .IP "\*(C`+\*(C'" 4
+.el .IP "\f(CW\*(C`+\*(C'\fR" 4
 .IX Item "+"
 Means that the preceding symbol (or group of symbols) may appear
 one or more times.
@@ -307,8 +308,9 @@ If you do not specify a netmask along with the network number,
 \&\fBsudo\fR will query each of the local host's network interfaces and,
 if the network number corresponds to one of the hosts's network
 interfaces, the corresponding netmask will be used.  The netmask
-may be specified either in dotted quad notation (e.g.\ 255.255.255.0)
-or \s-1CIDR\s0 notation (number of bits, e.g.\ 24).  A hostname may
+may be specified either in standard \s-1IP\s0 address notation
+(e.g.\ 255.255.255.0 or ffff:ffff:ffff:ffff::),
+or \s-1CIDR\s0 notation (number of bits, e.g.\ 24 or 64).  A hostname may
 include shell-style wildcards (see the Wildcards section below),
 but unless the \f(CW\*(C`hostname\*(C'\fR command on your machine returns the fully
 qualified hostname, you'll need to use the \fIfqdn\fR option for
@@ -420,7 +422,7 @@ See \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" for a list of supported Defaults par
 .PP
 .Vb 2
 \& Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
-\&               'SETENV:' | 'NOSETENV:' | 'MONITOR:' | 'NOMONITOR:')
+\&               'SETENV:' | 'NOSETENV:' )
 .Ve
 .PP
 A \fBuser specification\fR determines which commands a user may run
@@ -460,7 +462,7 @@ but  \fI/bin/kill\fR and \fI/usr/bin/lprm\fR as \fBroot\fR.
 .IX Subsection "Tag_Spec"
 A command may have zero or more tags associated with it.  There are
 eight possible tag values, \f(CW\*(C`NOPASSWD\*(C'\fR, \f(CW\*(C`PASSWD\*(C'\fR, \f(CW\*(C`NOEXEC\*(C'\fR, \f(CW\*(C`EXEC\*(C'\fR,
-\&\f(CW\*(C`SETENV\*(C'\fR, \f(CW\*(C`NOSETENV\*(C'\fR, \f(CW\*(C`MONITOR\*(C'\fR and \f(CW\*(C`NOMONITOR\*(C'\fR.
+\&\f(CW\*(C`SETENV\*(C'\fR and \f(CW\*(C`NOSETENV\*(C'\fR.
 Once a tag is set on a \f(CW\*(C`Cmnd\*(C'\fR, subsequent \f(CW\*(C`Cmnd\*(C'\fRs in the
 \&\f(CW\*(C`Cmnd_Spec_List\*(C'\fR, inherit the tag unless it is overridden by the
 opposite tag (i.e.: \f(CW\*(C`PASSWD\*(C'\fR overrides \f(CW\*(C`NOPASSWD\*(C'\fR and \f(CW\*(C`NOEXEC\*(C'\fR
@@ -525,26 +527,6 @@ environment variables set on the command line way are not subject
 to the restrictions imposed by \fIenv_check\fR, \fIenv_delete\fR, or
 \&\fIenv_keep\fR.  As such, only trusted users should be allowed to set
 variables in this manner.
-.PP
-\fI\s-1MONITOR\s0 and \s-1NOMONITOR\s0\fR
-.IX Subsection "MONITOR and NOMONITOR"
-.PP
-If \fBsudo\fR has been configured with the \f(CW\*(C`\-\-with\-systrace\*(C'\fR option,
-the \f(CW\*(C`MONITOR\*(C'\fR tag can be used to cause programs spawned by a command
-to be checked against \fIsudoers\fR and logged just like they would
-be if run through \fBsudo\fR directly.  This is useful in conjunction
-with commands that allow shell escapes such as editors, shells and
-paginators.
-.PP
-In the following example, user \fBchuck\fR may run any command on the
-machine research in monitor mode.
-.PP
-.Vb 1
-\& chuck  research = MONITOR: ALL
-.Ve
-.PP
-See the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0 \s-1ESCAPES\s0\*(R" section below for more details
-on how \f(CW\*(C`MONITOR\*(C'\fR works and whether or not it will work on your system.
 .Sh "Wildcards"
 .IX Subsection "Wildcards"
 \&\fBsudo\fR allows shell-style \fIwildcards\fR (aka meta or glob characters)
@@ -647,97 +629,126 @@ used as part of a word (e.g.\ a username or hostname):
 \&'@', '!', '=', ':', ',', '(', ')', '\e'.
 .SH "SUDOERS OPTIONS"
 .IX Header "SUDOERS OPTIONS"
-Sudo's behavior can be modified by \f(CW\*(C`Default_Entry\*(C'\fR lines, as
+\&\fBsudo\fR's behavior can be modified by \f(CW\*(C`Default_Entry\*(C'\fR lines, as
 explained earlier.  A list of all supported Defaults parameters,
 grouped by type, are listed below.
 .PP
 \&\fBFlags\fR:
-.IP "long_otp_prompt" 12
-.IX Item "long_otp_prompt"
-When validating with a One Time Password scheme (\fBS/Key\fR or \fB\s-1OPIE\s0\fR),
-a two-line prompt is used to make it easier to cut and paste the
-challenge to a local window.  It's not as pretty as the default but
-some people find it more convenient.  This flag is \fI@long_otp_prompt@\fR
-by default.
-.IP "ignore_dot" 12
+.IP "always_set_home" 16
+.IX Item "always_set_home"
+If set, \fBsudo\fR will set the \f(CW\*(C`HOME\*(C'\fR environment variable to the home
+directory of the target user (which is root unless the \fB\-u\fR option is used).
+This effectively means that the \fB\-H\fR flag is always implied.
+This flag is \fIoff\fR by default.
+.IP "authenticate" 16
+.IX Item "authenticate"
+If set, users must authenticate themselves via a password (or other
+means of authentication) before they may run commands.  This default
+may be overridden via the \f(CW\*(C`PASSWD\*(C'\fR and \f(CW\*(C`NOPASSWD\*(C'\fR tags.
+This flag is \fIon\fR by default.
+.IP "closefrom_override" 16
+.IX Item "closefrom_override"
+If set, the user may use \fBsudo\fR's \fB\-C\fR option which
+overrides the default starting point at which \fBsudo\fR begins
+closing open file descriptors.  This flag is \fIoff\fR by default.
+.IP "env_editor" 16
+.IX Item "env_editor"
+If set, \fBvisudo\fR will use the value of the \s-1EDITOR\s0 or \s-1VISUAL\s0
+environment variables before falling back on the default editor list.
+Note that this may create a security hole as it allows the user to
+run any arbitrary command as root without logging.  A safer alternative
+is to place a colon-separated list of editors in the \f(CW\*(C`editor\*(C'\fR
+variable.  \fBvisudo\fR will then only use the \s-1EDITOR\s0 or \s-1VISUAL\s0 if
+they match a value specified in \f(CW\*(C`editor\*(C'\fR.  This flag is \fI@env_editor@\fR by
+default.
+.IP "env_reset" 16
+.IX Item "env_reset"
+If set, \fBsudo\fR will reset the environment to only contain the
+\&\s-1LOGNAME\s0, \s-1SHELL\s0, \s-1USER\s0, \s-1USERNAME\s0 and the \f(CW\*(C`SUDO_*\*(C'\fR variables.  Any
+variables in the caller's environment that match the \f(CW\*(C`env_keep\*(C'\fR
+and \f(CW\*(C`env_check\*(C'\fR lists are then added.  The default contents of the
+\&\f(CW\*(C`env_keep\*(C'\fR and \f(CW\*(C`env_check\*(C'\fR lists are displayed when \fBsudo\fR is
+run by root with the \fI\-V\fR option.  If the \fIsecure_path\fR option
+is set, its value will be used for the \f(CW\*(C`PATH\*(C'\fR environment variable.
+This flag is \fIon\fR by default.
+.IP "fqdn" 16
+.IX Item "fqdn"
+Set this flag if you want to put fully qualified hostnames in the
+\&\fIsudoers\fR file.  I.e., instead of myhost you would use myhost.mydomain.edu.
+You may still use the short form if you wish (and even mix the two).
+Beware that turning on \fIfqdn\fR requires \fBsudo\fR to make \s-1DNS\s0 lookups
+which may make \fBsudo\fR unusable if \s-1DNS\s0 stops working (for example
+if the machine is not plugged into the network).  Also note that
+you must use the host's official name as \s-1DNS\s0 knows it.  That is,
+you may not use a host alias (\f(CW\*(C`CNAME\*(C'\fR entry) due to performance
+issues and the fact that there is no way to get all aliases from
+\&\s-1DNS\s0.  If your machine's hostname (as returned by the \f(CW\*(C`hostname\*(C'\fR
+command) is already fully qualified you shouldn't need to set
+\&\fIfqdn\fR.  This flag is \fI@fqdn@\fR by default.
+.IP "ignore_dot" 16
 .IX Item "ignore_dot"
 If set, \fBsudo\fR will ignore '.' or '' (current dir) in the \f(CW\*(C`PATH\*(C'\fR
 environment variable; the \f(CW\*(C`PATH\*(C'\fR itself is not modified.  This
 flag is \fI@ignore_dot@\fR by default.
-.IP "mail_always" 12
+.IP "ignore_local_sudoers" 16
+.IX Item "ignore_local_sudoers"
+If set via \s-1LDAP\s0, parsing of \f(CW@sysconfdir\fR@/sudoers will be skipped.
+This is intended for Enterprises that wish to prevent the usage of local
+sudoers files so that only \s-1LDAP\s0 is used.  This thwarts the efforts of
+rogue operators who would attempt to add roles to \f(CW@sysconfdir\fR@/sudoers.
+When this option is present, \f(CW@sysconfdir\fR@/sudoers does not even need to exist. 
+Since this option tells \fBsudo\fR how to behave when no specific \s-1LDAP\s0 entries
+have been matched, this sudoOption is only meaningful for the cn=defaults
+section.  This flag is \fIoff\fR by default.
+.IP "insults" 16
+.IX Item "insults"
+If set, \fBsudo\fR will insult users when they enter an incorrect
+password.  This flag is \fI@insults@\fR by default.
+.IP "log_host" 16
+.IX Item "log_host"
+If set, the hostname will be logged in the (non\-syslog) \fBsudo\fR log file.
+This flag is \fIoff\fR by default.
+.IP "log_year" 16
+.IX Item "log_year"
+If set, the four-digit year will be logged in the (non\-syslog) \fBsudo\fR log file.
+This flag is \fIoff\fR by default.
+.IP "long_otp_prompt" 16
+.IX Item "long_otp_prompt"
+When validating with a One Time Password (\s-1OPT\s0) scheme such as
+\&\fBS/Key\fR or \fB\s-1OPIE\s0\fR, a two-line prompt is used to make it easier
+to cut and paste the challenge to a local window.  It's not as
+pretty as the default but some people find it more convenient.  This
+flag is \fI@long_otp_prompt@\fR by default.
+.IP "mail_always" 16
 .IX Item "mail_always"
 Send mail to the \fImailto\fR user every time a users runs \fBsudo\fR.
 This flag is \fIoff\fR by default.
-.IP "mail_badpass" 12
+.IP "mail_badpass" 16
 .IX Item "mail_badpass"
 Send mail to the \fImailto\fR user if the user running \fBsudo\fR does not
 enter the correct password.  This flag is \fIoff\fR by default.
-.IP "mail_no_user" 12
-.IX Item "mail_no_user"
-If set, mail will be sent to the \fImailto\fR user if the invoking
-user is not in the \fIsudoers\fR file.  This flag is \fI@mail_no_user@\fR
-by default.
-.IP "mail_no_host" 12
+.IP "mail_no_host" 16
 .IX Item "mail_no_host"
 If set, mail will be sent to the \fImailto\fR user if the invoking
 user exists in the \fIsudoers\fR file, but is not allowed to run
 commands on the current host.  This flag is \fI@mail_no_host@\fR by default.
-.IP "mail_no_perms" 12
+.IP "mail_no_perms" 16
 .IX Item "mail_no_perms"
 If set, mail will be sent to the \fImailto\fR user if the invoking
 user is allowed to use \fBsudo\fR but the command they are trying is not
 listed in their \fIsudoers\fR file entry or is explicitly denied.
 This flag is \fI@mail_no_perms@\fR by default.
-.IP "tty_tickets" 12
-.IX Item "tty_tickets"
-If set, users must authenticate on a per-tty basis.  Normally,
-\&\fBsudo\fR uses a directory in the ticket dir with the same name as
-the user running it.  With this flag enabled, \fBsudo\fR will use a
-file named for the tty the user is logged in on in that directory.
-This flag is \fI@tty_tickets@\fR by default.
-.IP "authenticate" 12
-.IX Item "authenticate"
-If set, users must authenticate themselves via a password (or other
-means of authentication) before they may run commands.  This default
-may be overridden via the \f(CW\*(C`PASSWD\*(C'\fR and \f(CW\*(C`NOPASSWD\*(C'\fR tags.
-This flag is \fIon\fR by default.
-.IP "root_sudo" 12
-.IX Item "root_sudo"
-If set, root is allowed to run \fBsudo\fR too.  Disabling this prevents users
-from \*(L"chaining\*(R" \fBsudo\fR commands to get a root shell by doing something
-like \f(CW"sudo sudo /bin/sh"\fR.  Note, however, that turning off \fIroot_sudo\fR
-will also prevent root and from running \fBsudoedit\fR.
-Disabling \fIroot_sudo\fR provides no real additional security; it
-exists purely for historical reasons.
-This flag is \fI@root_sudo@\fR by default.
-.IP "log_host" 12
-.IX Item "log_host"
-If set, the hostname will be logged in the (non\-syslog) \fBsudo\fR log file.
-This flag is \fIoff\fR by default.
-.IP "log_year" 12
-.IX Item "log_year"
-If set, the four-digit year will be logged in the (non\-syslog) \fBsudo\fR log file.
-This flag is \fIoff\fR by default.
-.IP "shell_noargs" 12
-.IX Item "shell_noargs"
-If set and \fBsudo\fR is invoked with no arguments it acts as if the
-\&\fB\-s\fR flag had been given.  That is, it runs a shell as root (the
-shell is determined by the \f(CW\*(C`SHELL\*(C'\fR environment variable if it is
-set, falling back on the shell listed in the invoking user's
-/etc/passwd entry if not).  This flag is \fIoff\fR by default.
-.IP "set_home" 12
-.IX Item "set_home"
-If set and \fBsudo\fR is invoked with the \fB\-s\fR flag the \f(CW\*(C`HOME\*(C'\fR
-environment variable will be set to the home directory of the target
-user (which is root unless the \fB\-u\fR option is used).  This effectively
-makes the \fB\-s\fR flag imply \fB\-H\fR.  This flag is \fIoff\fR by default.
-.IP "always_set_home" 12
-.IX Item "always_set_home"
-If set, \fBsudo\fR will set the \f(CW\*(C`HOME\*(C'\fR environment variable to the home
-directory of the target user (which is root unless the \fB\-u\fR option is used).
-This effectively means that the \fB\-H\fR flag is always implied.
-This flag is \fIoff\fR by default.
-.IP "path_info" 12
+.IP "mail_no_user" 16
+.IX Item "mail_no_user"
+If set, mail will be sent to the \fImailto\fR user if the invoking
+user is not in the \fIsudoers\fR file.  This flag is \fI@mail_no_user@\fR
+by default.
+.IP "noexec" 16
+.IX Item "noexec"
+If set, all commands run via \fBsudo\fR will behave as if the \f(CW\*(C`NOEXEC\*(C'\fR
+tag has been set, unless overridden by a \f(CW\*(C`EXEC\*(C'\fR tag.  See the
+description of \fI\s-1NOEXEC\s0 and \s-1EXEC\s0\fR below as well as the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0 \s-1ESCAPES\s0\*(R" section at the end of this manual.  This flag is \fIoff\fR by default.
+.IP "path_info" 16
 .IX Item "path_info"
 Normally, \fBsudo\fR will tell the user when a command could not be
 found in their \f(CW\*(C`PATH\*(C'\fR environment variable.  Some sites may wish
@@ -745,34 +756,16 @@ to disable this as it could be used to gather information on the
 location of executables that the normal user does not have access
 to.  The disadvantage is that if the executable is simply not in
 the user's \f(CW\*(C`PATH\*(C'\fR, \fBsudo\fR will tell the user that they are not
-allowed to run it, which can be confusing.  This flag is \fIoff\fR by
-default.
-.IP "preserve_groups" 12
+allowed to run it, which can be confusing.  This flag is \fI@path_info@\fR
+by default.
+.IP "preserve_groups" 16
 .IX Item "preserve_groups"
 By default \fBsudo\fR will initialize the group vector to the list of
 groups the target user is in.  When \fIpreserve_groups\fR is set, the
 user's existing group vector is left unaltered.  The real and
 effective group IDs, however, are still set to match the target
 user.  This flag is \fIoff\fR by default.
-.IP "fqdn" 12
-.IX Item "fqdn"
-Set this flag if you want to put fully qualified hostnames in the
-\&\fIsudoers\fR file.  I.e., instead of myhost you would use myhost.mydomain.edu.
-You may still use the short form if you wish (and even mix the two).
-Beware that turning on \fIfqdn\fR requires \fBsudo\fR to make \s-1DNS\s0 lookups
-which may make \fBsudo\fR unusable if \s-1DNS\s0 stops working (for example
-if the machine is not plugged into the network).  Also note that
-you must use the host's official name as \s-1DNS\s0 knows it.  That is,
-you may not use a host alias (\f(CW\*(C`CNAME\*(C'\fR entry) due to performance
-issues and the fact that there is no way to get all aliases from
-\&\s-1DNS\s0.  If your machine's hostname (as returned by the \f(CW\*(C`hostname\*(C'\fR
-command) is already fully qualified you shouldn't need to set
-\&\fIfqdn\fR.  This flag is \fI@fqdn@\fR by default.
-.IP "insults" 12
-.IX Item "insults"
-If set, \fBsudo\fR will insult users when they enter an incorrect
-password.  This flag is \fI@insults@\fR by default.
-.IP "requiretty" 12
+.IP "requiretty" 16
 .IX Item "requiretty"
 If set, \fBsudo\fR will only run when the user is logged in to a real
 tty.  This will disallow things like \f(CW"rsh somehost sudo ls"\fR since
@@ -780,33 +773,31 @@ tty.  This will disallow things like \f(CW"rsh somehost sudo ls"\fR since
 off echo when there is no tty present, some sites may wish to set
 this flag to prevent a user from entering a visible password.  This
 flag is \fIoff\fR by default.
-.IP "env_editor" 12
-.IX Item "env_editor"
-If set, \fBvisudo\fR will use the value of the \s-1EDITOR\s0 or \s-1VISUAL\s0
-environment variables before falling back on the default editor list.
-Note that this may create a security hole as it allows the user to
-run any arbitrary command as root without logging.  A safer alternative
-is to place a colon-separated list of editors in the \f(CW\*(C`editor\*(C'\fR
-variable.  \fBvisudo\fR will then only use the \s-1EDITOR\s0 or \s-1VISUAL\s0 if
-they match a value specified in \f(CW\*(C`editor\*(C'\fR.  This flag is \f(CW\*(C`@env_editor@\*(C'\fR by
-default.
-.IP "rootpw" 12
+.IP "root_sudo" 16
+.IX Item "root_sudo"
+If set, root is allowed to run \fBsudo\fR too.  Disabling this prevents users
+from \*(L"chaining\*(R" \fBsudo\fR commands to get a root shell by doing something
+like \f(CW"sudo sudo /bin/sh"\fR.  Note, however, that turning off \fIroot_sudo\fR
+will also prevent root and from running \fBsudoedit\fR.
+Disabling \fIroot_sudo\fR provides no real additional security; it
+exists purely for historical reasons.
+This flag is \fI@root_sudo@\fR by default.
+.IP "rootpw" 16
 .IX Item "rootpw"
 If set, \fBsudo\fR will prompt for the root password instead of the password
 of the invoking user.  This flag is \fIoff\fR by default.
-.IP "runaspw" 12
+.IP "runaspw" 16
 .IX Item "runaspw"
 If set, \fBsudo\fR will prompt for the password of the user defined by the
 \&\fIrunas_default\fR option (defaults to \f(CW\*(C`@runas_default@\*(C'\fR) instead of the
 password of the invoking user.  This flag is \fIoff\fR by default.
-.IP "targetpw" 12
-.IX Item "targetpw"
-If set, \fBsudo\fR will prompt for the password of the user specified by
-the \fB\-u\fR flag (defaults to \f(CW\*(C`root\*(C'\fR) instead of the password of the
-invoking user.  Note that this precludes the use of a uid not listed
-in the passwd database as an argument to the \fB\-u\fR flag.
-This flag is \fIoff\fR by default.
-.IP "set_logname" 12
+.IP "set_home" 16
+.IX Item "set_home"
+If set and \fBsudo\fR is invoked with the \fB\-s\fR flag the \f(CW\*(C`HOME\*(C'\fR
+environment variable will be set to the home directory of the target
+user (which is root unless the \fB\-u\fR option is used).  This effectively
+makes the \fB\-s\fR flag imply \fB\-H\fR.  This flag is \fIoff\fR by default.
+.IP "set_logname" 16
 .IX Item "set_logname"
 Normally, \fBsudo\fR will set the \f(CW\*(C`LOGNAME\*(C'\fR, \f(CW\*(C`USER\*(C'\fR and \f(CW\*(C`USERNAME\*(C'\fR
 environment variables to the name of the target user (usually root
@@ -816,8 +807,23 @@ determine the real identity of the user, it may be desirable to
 change this behavior.  This can be done by negating the set_logname
 option.  Note that if the \fIenv_reset\fR option has not been disabled,
 entries in the \fIenv_keep\fR list will override the value of
-\&\fIset_logname\fR.
-.IP "stay_setuid" 12
+\&\fIset_logname\fR.  This flag is \fIoff\fR by default.
+.IP "setenv" 16
+.IX Item "setenv"
+Allow the user to disable the \fIenv_reset\fR option from the command
+line.  Additionally, environment variables set via the command line
+are not subject to the restrictions imposed by \fIenv_check\fR,
+\&\fIenv_delete\fR, or \fIenv_keep\fR.  As such, only trusted users should
+be allowed to set variables in this manner.  This flag is \fIoff\fR
+by default.
+.IP "shell_noargs" 16
+.IX Item "shell_noargs"
+If set and \fBsudo\fR is invoked with no arguments it acts as if the
+\&\fB\-s\fR flag had been given.  That is, it runs a shell as root (the
+shell is determined by the \f(CW\*(C`SHELL\*(C'\fR environment variable if it is
+set, falling back on the shell listed in the invoking user's
+/etc/passwd entry if not).  This flag is \fIoff\fR by default.
+.IP "stay_setuid" 16
 .IX Item "stay_setuid"
 Normally, when \fBsudo\fR executes a command the real and effective
 UIDs are set to the target user (root by default).  This option
@@ -826,65 +832,52 @@ user's \s-1UID\s0.  In other words, this makes \fBsudo\fR act as a setuid
 wrapper.  This can be useful on systems that disable some potentially
 dangerous functionality when a program is run setuid.  This option
 is only effective on systems with either the \fIsetreuid()\fR or \fIsetresuid()\fR
-function.
-.IP "env_reset" 12
-.IX Item "env_reset"
-If set, \fBsudo\fR will reset the environment to only contain the
-\&\s-1LOGNAME\s0, \s-1SHELL\s0, \s-1USER\s0, \s-1USERNAME\s0 and the \f(CW\*(C`SUDO_*\*(C'\fR variables.  Any
-variables in the caller's environment that match the \f(CW\*(C`env_keep\*(C'\fR
-and \f(CW\*(C`env_check\*(C'\fR lists are then added.  The default contents of the
-\&\f(CW\*(C`env_keep\*(C'\fR and \f(CW\*(C`env_check\*(C'\fR lists are displayed when \fBsudo\fR is
-run by root with the \fI\-V\fR option.  If the \fIsecure_path\fR option
-is set, its \-value will be used for the \f(CW\*(C`PATH\*(C'\fR environment variable.
-This flag is \fIon\fR by default.
-.IP "use_loginclass" 12
+function.  This flag is \fIoff\fR by default.
+.IP "targetpw" 16
+.IX Item "targetpw"
+If set, \fBsudo\fR will prompt for the password of the user specified by
+the \fB\-u\fR flag (defaults to \f(CW\*(C`root\*(C'\fR) instead of the password of the
+invoking user.  Note that this precludes the use of a uid not listed
+in the passwd database as an argument to the \fB\-u\fR flag.
+This flag is \fIoff\fR by default.
+.IP "tty_tickets" 16
+.IX Item "tty_tickets"
+If set, users must authenticate on a per-tty basis.  Normally,
+\&\fBsudo\fR uses a directory in the ticket dir with the same name as
+the user running it.  With this flag enabled, \fBsudo\fR will use a
+file named for the tty the user is logged in on in that directory.
+This flag is \fI@tty_tickets@\fR by default.
+.IP "use_loginclass" 16
 .IX Item "use_loginclass"
 If set, \fBsudo\fR will apply the defaults specified for the target user's
 login class if one exists.  Only available if \fBsudo\fR is configured with
 the \-\-with\-logincap option.  This flag is \fIoff\fR by default.
-.IP "noexec" 12
-.IX Item "noexec"
-If set, all commands run via \fBsudo\fR will behave as if the \f(CW\*(C`NOEXEC\*(C'\fR
-tag has been set, unless overridden by a \f(CW\*(C`EXEC\*(C'\fR tag.  See the
-description of \fI\s-1NOEXEC\s0 and \s-1EXEC\s0\fR below as well as the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0 \s-1ESCAPES\s0\*(R" section at the end of this manual.  This flag is \fIoff\fR by default.
-.IP "monitor" 12
-.IX Item "monitor"
-If set, all commands run via \fBsudo\fR will behave as if the \f(CW\*(C`MONITOR\*(C'\fR
-tag has been set, unless overridden by a \f(CW\*(C`NOMONITOR\*(C'\fR tag.  See the
-description of \fI\s-1MONITOR\s0 and \s-1NOMONITOR\s0\fR below as well as the \*(L"\s-1PREVENTING\s0 \s-1SHELL\s0 \s-1ESCAPES\s0\*(R" section at the end of this manual.  Be aware that
-tracing is only supported on certain operating systems.  On systems
-where it is not supported this flag will have no effect.
-This flag is \fIoff\fR by default.
-.IP "ignore_local_sudoers" 12
-.IX Item "ignore_local_sudoers"
-If set via \s-1LDAP\s0, parsing of \f(CW@sysconfdir\fR@/sudoers will be skipped.
-This is intended for Enterprises that wish to prevent the usage of local
-sudoers files so that only \s-1LDAP\s0 is used.  This thwarts the efforts of
-rogue operators who would attempt to add roles to \f(CW@sysconfdir\fR@/sudoers.
-When this option is present, \f(CW@sysconfdir\fR@/sudoers does not even need to exist. 
-Since this option tells \fBsudo\fR how to behave when no specific \s-1LDAP\s0 entries
-have been matched, this sudoOption is only meaningful for the cn=defaults
-section.  This flag is \fIoff\fR by default.
-.IP "closefrom_override" 12
-.IX Item "closefrom_override"
-If set, the user may use \fBsudo\fR's \fB\-C\fR option which
-overrides the default starting point at which \fBsudo\fR begins
-closing open file descriptors.  This flag is \fIoff\fR by default.
 .PP
 \&\fBIntegers\fR:
-.IP "passwd_tries" 12
+.IP "closefrom" 16
+.IX Item "closefrom"
+Before it executes a command, \fBsudo\fR will close all open file
+descriptors other than standard input, standard output and standard
+error (ie: file descriptors 0\-2).  The \fIclosefrom\fR option can be used
+to specify a different file descriptor at which to start closing.
+The default is \f(CW3\fR.
+.IP "passwd_tries" 16
 .IX Item "passwd_tries"
 The number of tries a user gets to enter his/her password before
 \&\fBsudo\fR logs the failure and exits.  The default is \f(CW\*(C`@passwd_tries@\*(C'\fR.
 .PP
 \&\fBIntegers that can be used in a boolean context\fR:
-.IP "loglinelen" 12
+.IP "loglinelen" 16
 .IX Item "loglinelen"
 Number of characters per line for the file log.  This value is used
 to decide when to wrap lines for nicer log files.  This has no
 effect on the syslog log file, only the file log.  The default is
 \&\f(CW\*(C`@loglen@\*(C'\fR (use 0 or negate the option to disable word wrap).
-.IP "timestamp_timeout" 12
+.IP "passwd_timeout" 16
+.IX Item "passwd_timeout"
+Number of minutes before the \fBsudo\fR password prompt times out.
+The default is \f(CW\*(C`@password_timeout@\*(C'\fR; set this to \f(CW0\fR for no password timeout.
+.IP "timestamp_timeout" 16
 .IX Item "timestamp_timeout"
 Number of minutes that can elapse before \fBsudo\fR will ask for a
 passwd again.  The default is \f(CW\*(C`@timeout@\*(C'\fR.  Set this to \f(CW0\fR to always
@@ -892,124 +885,110 @@ prompt for a password.
 If set to a value less than \f(CW0\fR the user's timestamp will never
 expire.  This can be used to allow users to create or delete their
 own timestamps via \f(CW\*(C`sudo \-v\*(C'\fR and \f(CW\*(C`sudo \-k\*(C'\fR respectively.
-.IP "passwd_timeout" 12
-.IX Item "passwd_timeout"
-Number of minutes before the \fBsudo\fR password prompt times out.
-The default is \f(CW\*(C`@password_timeout@\*(C'\fR, set this to \f(CW0\fR for no password timeout.
-.IP "umask" 12
+.IP "umask" 16
 .IX Item "umask"
 Umask to use when running the command.  Negate this option or set
 it to 0777 to preserve the user's umask.  The default is \f(CW\*(C`@sudo_umask@\*(C'\fR.
-.IP "closefrom" 12
-.IX Item "closefrom"
-Before it executes a command, \fBsudo\fR will close all open file
-descriptors other than standard input, standard output and standard
-error (ie: file descriptors 0\-2).  The \fIclosefrom\fR option can be used
-to specify a different file descriptor at which to start closing.
-The default is 3.
-.IP "setenv" 12
-.IX Item "setenv"
-Allow the user to disable the \fIenv_reset\fR option from the command
-line.  Additionally, environment variables set via the command line
-are not subject to the restrictions imposed by \fIenv_check\fR,
-\&\fIenv_delete\fR, or \fIenv_keep\fR.  As such, only trusted users should
-be allowed to set variables in this manner.
 .PP
 \&\fBStrings\fR:
-.IP "mailsub" 12
+.IP "badpass_message" 16
+.IX Item "badpass_message"
+Message that is displayed if a user enters an incorrect password.
+The default is \f(CW\*(C`@badpass_message@\*(C'\fR unless insults are enabled.
+.IP "editor" 16
+.IX Item "editor"
+A colon (':') separated list of editors allowed to be used with
+\&\fBvisudo\fR.  \fBvisudo\fR will choose the editor that matches the user's
+\&\s-1EDITOR\s0 environment variable if possible, or the first editor in the
+list that exists and is executable.  The default is the path to vi
+on your system.
+.IP "mailsub" 16
 .IX Item "mailsub"
 Subject of the mail sent to the \fImailto\fR user. The escape \f(CW%h\fR
 will expand to the hostname of the machine.
 Default is \f(CW\*(C`@mailsub@\*(C'\fR.
-.IP "badpass_message" 12
-.IX Item "badpass_message"
-Message that is displayed if a user enters an incorrect password.
-The default is \f(CW\*(C`@badpass_message@\*(C'\fR unless insults are enabled.
-.IP "timestampdir" 12
-.IX Item "timestampdir"
-The directory in which \fBsudo\fR stores its timestamp files.
-The default is \fI@timedir@\fR.
-.IP "timestampowner" 12
-.IX Item "timestampowner"
-The owner of the timestamp directory and the timestamps stored therein.
-The default is \f(CW\*(C`root\*(C'\fR.
-.IP "passprompt" 12
+.IP "noexec_file" 16
+.IX Item "noexec_file"
+Path to a shared library containing dummy versions of the \fIexecv()\fR,
+\&\fIexecve()\fR and \fIfexecve()\fR library functions that just return an error.
+This is used to implement the \fInoexec\fR functionality on systems that
+support \f(CW\*(C`LD_PRELOAD\*(C'\fR or its equivalent.  Defaults to \fI@noexec_file@\fR.
+.IP "passprompt" 16
 .IX Item "passprompt"
 The default prompt to use when asking for a password; can be overridden
 via the \fB\-p\fR option or the \f(CW\*(C`SUDO_PROMPT\*(C'\fR environment variable.
 The following percent (`\f(CW\*(C`%\*(C'\fR') escapes are supported:
-.RS 12
-.ie n .IP "%u" 8
-.el .IP "\f(CW%u\fR" 8
-.IX Item "%u"
-expanded to the invoking user's login name
-.ie n .IP "%U" 8
-.el .IP "\f(CW%U\fR" 8
-.IX Item "%U"
-expanded to the login name of the user the command will
-be run as (defaults to root)
-.ie n .IP "%h" 8
-.el .IP "\f(CW%h\fR" 8
-.IX Item "%h"
-expanded to the local hostname without the domain name
-.ie n .IP "%H" 8
-.el .IP "\f(CW%H\fR" 8
+.RS 16
+.ie n .IP "%H" 4
+.el .IP "\f(CW%H\fR" 4
 .IX Item "%H"
 expanded to the local hostname including the domain name
 (on if the machine's hostname is fully qualified or the \fIfqdn\fR
 option is set)
-.ie n .IP "\*(C`%%\*(C'" 8
-.el .IP "\f(CW\*(C`%%\*(C'\fR" 8
+.ie n .IP "%h" 4
+.el .IP "\f(CW%h\fR" 4
+.IX Item "%h"
+expanded to the local hostname without the domain name
+.ie n .IP "%U" 4
+.el .IP "\f(CW%U\fR" 4
+.IX Item "%U"
+expanded to the login name of the user the command will
+be run as (defaults to root)
+.ie n .IP "%u" 4
+.el .IP "\f(CW%u\fR" 4
+.IX Item "%u"
+expanded to the invoking user's login name
+.ie n .IP "\*(C`%%\*(C'" 4
+.el .IP "\f(CW\*(C`%%\*(C'\fR" 4
 .IX Item "%%"
 two consecutive \f(CW\*(C`%\*(C'\fR characters are collapsed into a single \f(CW\*(C`%\*(C'\fR character
 .RE
-.RS 12
+.RS 16
 .Sp
 The default value is \f(CW\*(C`@passprompt@\*(C'\fR.
 .RE
-.IP "runas_default" 12
+.IP "runas_default" 16
 .IX Item "runas_default"
 The default user to run commands as if the \fB\-u\fR flag is not specified
 on the command line.  This defaults to \f(CW\*(C`@runas_default@\*(C'\fR.
 Note that if \fIrunas_default\fR is set it \fBmust\fR occur before
 any \f(CW\*(C`Runas_Alias\*(C'\fR specifications.
-.IP "syslog_goodpri" 12
-.IX Item "syslog_goodpri"
-Syslog priority to use when user authenticates successfully.
-Defaults to \f(CW\*(C`@goodpri@\*(C'\fR.
-.IP "syslog_badpri" 12
+.IP "syslog_badpri" 16
 .IX Item "syslog_badpri"
 Syslog priority to use when user authenticates unsuccessfully.
 Defaults to \f(CW\*(C`@badpri@\*(C'\fR.
-.IP "editor" 12
-.IX Item "editor"
-A colon (':') separated list of editors allowed to be used with
-\&\fBvisudo\fR.  \fBvisudo\fR will choose the editor that matches the user's
-\&\s-1EDITOR\s0 environment variable if possible, or the first editor in the
-list that exists and is executable.  The default is the path to vi
-on your system.
-.IP "noexec_file" 12
-.IX Item "noexec_file"
-Path to a shared library containing dummy versions of the \fIexecv()\fR,
-\&\fIexecve()\fR and \fIfexecve()\fR library functions that just return an error.
-This is used to implement the \fInoexec\fR functionality on systems that
-support \f(CW\*(C`LD_PRELOAD\*(C'\fR or its equivalent.  Defaults to \fI@noexec_file@\fR.
+.IP "syslog_goodpri" 16
+.IX Item "syslog_goodpri"
+Syslog priority to use when user authenticates successfully.
+Defaults to \f(CW\*(C`@goodpri@\*(C'\fR.
+.IP "timestampdir" 16
+.IX Item "timestampdir"
+The directory in which \fBsudo\fR stores its timestamp files.
+The default is \fI@timedir@\fR.
+.IP "timestampowner" 16
+.IX Item "timestampowner"
+The owner of the timestamp directory and the timestamps stored therein.
+The default is \f(CW\*(C`root\*(C'\fR.
 .PP
 \&\fBStrings that can be used in a boolean context\fR:
+.IP "exempt_group" 12
+.IX Item "exempt_group"
+Users in this group are exempt from password and \s-1PATH\s0 requirements.
+This is not set by default.
 .IP "lecture" 12
 .IX Item "lecture"
 This option controls when a short lecture will be printed along with
 the password prompt.  It has the following possible values:
 .RS 12
+.IP "always" 8
+.IX Item "always"
+Always lecture the user.
 .IP "never" 8
 .IX Item "never"
 Never lecture the user.
 .IP "once" 8
 .IX Item "once"
 Only lecture the user the first time they run \fBsudo\fR.
-.IP "always" 8
-.IX Item "always"
-Always lecture the user.
 .RE
 .RS 12
 .Sp
@@ -1021,30 +1000,50 @@ The default value is \fI@lecture@\fR.
 .IX Item "lecture_file"
 Path to a file containing an alternate \fBsudo\fR lecture that will
 be used in place of the standard lecture if the named file exists.
+By default, \fBsudo\fR uses a built-in lecture.
+.IP "listpw" 12
+.IX Item "listpw"
+This option controls when a password will be required when a
+user runs \fBsudo\fR with the \fB\-l\fR flag.  It has the following possible values:
+.RS 12
+.IP "all" 8
+.IX Item "all"
+All the user's \fIsudoers\fR entries for the current host must have
+the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
+.IP "always" 8
+.IX Item "always"
+The user must always enter a password to use the \fB\-l\fR flag.
+.IP "any" 8
+.IX Item "any"
+At least one of the user's \fIsudoers\fR entries for the current host
+must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
+.IP "never" 8
+.IX Item "never"
+The user need never enter a password to use the \fB\-l\fR flag.
+.RE
+.RS 12
+.Sp
+If no value is specified, a value of \fIany\fR is implied.
+Negating the option results in a value of \fInever\fR being used.
+The default value is \fIany\fR.
+.RE
 .IP "logfile" 12
 .IX Item "logfile"
 Path to the \fBsudo\fR log file (not the syslog log file).  Setting a path
 turns on logging to a file; negating this option turns it off.
-.IP "syslog" 12
-.IX Item "syslog"
-Syslog facility if syslog is being used for logging (negate to
-disable syslog logging).  Defaults to \f(CW\*(C`@logfac@\*(C'\fR.
+By default, \fBsudo\fR logs via syslog.
+.IP "mailerflags" 12
+.IX Item "mailerflags"
+Flags to use when invoking mailer. Defaults to \fB\-t\fR.
 .IP "mailerpath" 12
 .IX Item "mailerpath"
 Path to mail program used to send warning mail.
 Defaults to the path to sendmail found at configure time.
-.IP "mailerflags" 12
-.IX Item "mailerflags"
-Flags to use when invoking mailer. Defaults to \fB\-t\fR.
 .IP "mailto" 12
 .IX Item "mailto"
 Address to send warning and error mail to.  The address should
 be enclosed in double quotes (\f(CW\*(C`"\*(C'\fR) to protect against \fBsudo\fR
 interpreting the \f(CW\*(C`@\*(C'\fR sign.  Defaults to \f(CW\*(C`@mailto@\*(C'\fR.
-.IP "exempt_group" 12
-.IX Item "exempt_group"
-Users in this group are exempt from password and \s-1PATH\s0 requirements.
-This is not set by default.
 .IP "secure_path" 12
 .IX Item "secure_path"
 Path used for every command run from \fBsudo\fR.  If you don't trust the
@@ -1053,6 +1052,10 @@ want to use this.  Another use is if you want to have the \*(L"root path\*(R"
 be separate from the \*(L"user path.\*(R"  Users in the group specified by the
 \&\fIexempt_group\fR option are not affected by \fIsecure_path\fR.
 This is not set by default.
+.IP "syslog" 12
+.IX Item "syslog"
+Syslog facility if syslog is being used for logging (negate to
+disable syslog logging).  Defaults to \f(CW\*(C`@logfac@\*(C'\fR.
 .IP "verifypw" 12
 .IX Item "verifypw"
 This option controls when a password will be required when a user runs
@@ -1062,52 +1065,26 @@ This option controls when a password will be required when a user runs
 .IX Item "all"
 All the user's \fIsudoers\fR entries for the current host must have
 the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
-.IP "any" 8
-.IX Item "any"
-At least one of the user's \fIsudoers\fR entries for the current host
-must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
-.IP "never" 8
-.IX Item "never"
-The user need never enter a password to use the \fB\-v\fR flag.
 .IP "always" 8
 .IX Item "always"
 The user must always enter a password to use the \fB\-v\fR flag.
-.RE
-.RS 12
-.Sp
-If no value is specified, a value of \fIall\fR is implied.
-Negating the option results in a value of \fInever\fR being used.
-The default value is \fIall\fR.
-.RE
-.IP "listpw" 12
-.IX Item "listpw"
-This option controls when a password will be required when a
-user runs \fBsudo\fR with the \fB\-l\fR flag.  It has the following possible values:
-.RS 12
-.IP "all" 8
-.IX Item "all"
-All the user's \fIsudoers\fR entries for the current host must have
-the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
 .IP "any" 8
 .IX Item "any"
 At least one of the user's \fIsudoers\fR entries for the current host
 must have the \f(CW\*(C`NOPASSWD\*(C'\fR flag set to avoid entering a password.
 .IP "never" 8
 .IX Item "never"
-The user need never enter a password to use the \fB\-l\fR flag.
-.IP "always" 8
-.IX Item "always"
-The user must always enter a password to use the \fB\-l\fR flag.
+The user need never enter a password to use the \fB\-v\fR flag.
 .RE
 .RS 12
 .Sp
-If no value is specified, a value of \fIany\fR is implied.
+If no value is specified, a value of \fIall\fR is implied.
 Negating the option results in a value of \fInever\fR being used.
-The default value is \fIany\fR.
+The default value is \fIall\fR.
 .RE
 .PP
 \&\fBLists that can be used in a boolean context\fR:
-.IP "env_check" 12
+.IP "env_check" 16
 .IX Item "env_check"
 Environment variables to be removed from the user's environment if
 the variable's value contains \f(CW\*(C`%\*(C'\fR or \f(CW\*(C`/\*(C'\fR characters.  This can
@@ -1121,7 +1098,7 @@ specified by \f(CW\*(C`env_check\*(C'\fR will be preserved in the environment if
 they pass the aforementioned check.  The default list of environment
 variables to check is displayed when \fBsudo\fR is run by root with
 the \fI\-V\fR option.
-.IP "env_delete" 12
+.IP "env_delete" 16
 .IX Item "env_delete"
 Environment variables to be removed from the user's environment.
 The argument may be a double\-quoted, space-separated list or a
@@ -1132,7 +1109,7 @@ variables to remove is displayed when \fBsudo\fR is run by root with the
 \&\fI\-V\fR option.  Note that many operating systems will remove potentially
 dangerous variables from the environment of any setuid process (such
 as \fBsudo\fR).
-.IP "env_keep" 12
+.IP "env_keep" 16
 .IX Item "env_keep"
 Environment variables to be preserved in the user's environment
 when the \fIenv_reset\fR option is in effect.  This allows fine-grained
@@ -1152,11 +1129,17 @@ supported: \fBalert\fR, \fBcrit\fR, \fBdebug\fR, \fBemerg\fR, \fBerr\fR, \fBinfo
 \&\fBnotice\fR, and \fBwarning\fR.
 .SH "FILES"
 .IX Header "FILES"
-.Vb 3
-\& @sysconfdir@/sudoers           List of who can run what
-\& /etc/group             Local groups file
-\& /etc/netgroup          List of network groups
-.Ve
+.ie n .IP "\fI@sysconfdir@/sudoers\fR\*(C`		\*(C' List of who can run what" 4
+.el .IP "\fI@sysconfdir@/sudoers\fR\f(CW\*(C`		\*(C'\fR List of who can run what" 4
+.IX Item "@sysconfdir@/sudoers		 List of who can run what"
+.PD 0
+.ie n .IP "\fI/etc/group\fR\*(C`		\*(C' Local groups file" 4
+.el .IP "\fI/etc/group\fR\f(CW\*(C`		\*(C'\fR Local groups file" 4
+.IX Item "/etc/group		 Local groups file"
+.ie n .IP "\fI/etc/netgroup\fR\*(C`		\*(C' List of network groups" 4
+.el .IP "\fI/etc/netgroup\fR\f(CW\*(C`		\*(C'\fR List of network groups" 4
+.IX Item "/etc/netgroup		 List of network groups"
+.PD
 .SH "EXAMPLES"
 .IX Header "EXAMPLES"
 Below are example \fIsudoers\fR entries.  Admittedly, some of
@@ -1213,7 +1196,7 @@ machines in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR, we keep an ad
 local log file and make sure we log the year in each log line since
 the log entries will be kept around for several years.  Lastly, we
 disable shell escapes for the commands in the \s-1PAGERS\s0 \f(CW\*(C`Cmnd_Alias\*(C'\fR
-(/usr/bin/more, /usr/bin/pg and /usr/bin/less).
+(\fI/usr/bin/more\fR, \fI/usr/bin/pg\fR and \fI/usr/bin/less\fR).
 .PP
 .Vb 7
 \& # Override built-in defaults
@@ -1305,7 +1288,7 @@ as any user listed in the \fI\s-1OP\s0\fR \f(CW\*(C`Runas_Alias\*(C'\fR (\fBroot
 .Ve
 .PP
 The user \fBjim\fR may run any command on machines in the \fIbiglab\fR netgroup.
-\&\fBSudo\fR knows that \*(L"biglab\*(R" is a netgroup due to the '+' prefix.
+\&\fBsudo\fR knows that \*(L"biglab\*(R" is a netgroup due to the '+' prefix.
 .PP
 .Vb 1
 \& +secretaries   ALL = PRINTING, /usr/bin/adduser, /usr/bin/rmuser
@@ -1341,7 +1324,7 @@ in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR (master, mail, www and
 .Ve
 .PP
 For any machine in the \fI\s-1SERVERS\s0\fR \f(CW\*(C`Host_Alias\*(C'\fR, \fBjill\fR may run
-any commands in the directory /usr/bin/ except for those commands
+any commands in the directory \fI/usr/bin/\fR except for those commands
 belonging to the \fI\s-1SU\s0\fR and \fI\s-1SHELLS\s0\fR \f(CW\*(C`Cmnd_Aliases\*(C'\fR.
 .PP
 .Vb 1
@@ -1400,7 +1383,7 @@ which lets a user bypass \fBsudo\fR's access control and logging.
 Common programs that permit shell escapes include shells (obviously),
 editors, paginators, mail and terminal programs.
 .PP
-There are three basic approaches to this problem:
+There are two basic approaches to this problem:
 .IP "restrict" 10
 .IX Item "restrict"
 Avoid giving users access to commands that allow the user to run
@@ -1436,9 +1419,9 @@ If the resulting output contains a line that begins with:
 then \fBsudo\fR may be able to replace the exec family of functions
 in the standard library with its own that simply return an error.
 Unfortunately, there is no foolproof way to know whether or not
-\&\fInoexec\fR will work at compile\-time.  \fINoexec\fR should work on
+\&\fInoexec\fR will work at compile\-time.  \fInoexec\fR should work on
 SunOS, Solaris, *BSD, Linux, \s-1IRIX\s0, Tru64 \s-1UNIX\s0, MacOS X, and HP-UX
-11.x.  It is known \fBnot\fR to work on \s-1AIX\s0 and UnixWare.  \fINoexec\fR
+11.x.  It is known \fBnot\fR to work on \s-1AIX\s0 and UnixWare.  \fInoexec\fR
 is expected to work on most operating systems that support the
 \&\f(CW\*(C`LD_PRELOAD\*(C'\fR environment variable.  Check your operating system's
 manual pages for the dynamic linker (usually ld.so, ld.so.1, dyld,
@@ -1456,32 +1439,6 @@ with \fInoexec\fR enabled.  This will prevent those two commands from
 executing other commands (such as a shell).  If you are unsure
 whether or not your system is capable of supporting \fInoexec\fR you
 can always just try it out and see if it works.
-.IP "monitor" 10
-.IX Item "monitor"
-On operating systems that support the \fBsystrace\fR pseudo\-device,
-the \f(CW\*(C`\-\-with\-systrace\*(C'\fR configure option can be used to compile
-support for proccess monitoring in \fBsudo\fR.  In monitor mode
-\&\fBsudo\fR can transparently intercept a new command, allow or deny
-it based on \fIsudoers\fR, and log the result.  This does require that
-\&\fBsudo\fR become a daemon that persists until the command and all its
-descendents have exited.
-.Sp
-To enable monitor mode on a per-command basis, use the \f(CW\*(C`MONITOR\*(C'\fR
-tag as documented in the User Specification section above.  Here
-is that example again:
-.Sp
-.Vb 1
-\& chuck  research = MONITOR: ALL
-.Ve
-.Sp
-This allows user \fBchuck\fR to run any command on the machine research
-in monitor mode.  Any commands run via shell escapes will be logged
-by \fBsudo\fR.
-.Sp
-At the time of this writing the \fBsystrace\fR pseudo-device comes
-standard with OpenBSD and NetBSD and is available as patches to
-FreeBSD, MacOS X and Linux.  See <http://www.systrace.org/> for
-more information.
 .PP
 Note that restricting shell escapes is not a panacea.  Programs
 running as root are still capable of many potentially hazardous
@@ -1491,7 +1448,7 @@ editor, a safer approach is to give the user permission to run
 \&\fBsudoedit\fR.
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-\&\fIrsh\fR\|(1), \fIsu\fR\|(1), \fIfnmatch\fR\|(3), sudo(@mansectsu@), visudo(@mansectsu@)
+\&\fIrsh\fR\|(1), \fIsu\fR\|(1), \fIfnmatch\fR\|(3), \fIsudo\fR\|(@mansectsu@), \fIvisudo\fR\|(8)
 .SH "CAVEATS"
 .IX Header "CAVEATS"
 The \fIsudoers\fR file should \fBalways\fR be edited by the \fBvisudo\fR
@@ -1515,7 +1472,7 @@ see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
 search the archives.
 .SH "DISCLAIMER"
 .IX Header "DISCLAIMER"
-\&\fBSudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
+\&\fBsudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
 including, but not limited to, the implied warranties of merchantability
 and fitness for a particular purpose are disclaimed.  See the \s-1LICENSE\s0
 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
diff --git a/visudo.cat b/visudo.cat
index 89c76c5f3..62ae4fab5 100644
--- a/visudo.cat
+++ b/visudo.cat
@@ -8,11 +8,11 @@ NNAAMMEE
        visudo - edit the sudoers file
 
 SSYYNNOOPPSSIISS
-       vviissuuddoo [ --cc ] [ --ff _s_u_d_o_e_r_s ] [ --qq ] [ --ss ] [ --VV ]
+       vviissuuddoo [--cc] [--qq] [--ss] [--VV] [--ff _s_u_d_o_e_r_s]
 
 DDEESSCCRRIIPPTTIIOONN
        vviissuuddoo edits the _s_u_d_o_e_r_s file in a safe fashion, analogous
-       to vipw(1m).  vviissuuddoo locks the _s_u_d_o_e_r_s file against multi­
+       to _v_i_p_w(1m).  vviissuuddoo locks the _s_u_d_o_e_r_s file against multi-
        ple simultaneous edits, provides basic sanity checks, and
        checks for parse errors.  If the _s_u_d_o_e_r_s file is currently
        being edited you will receive a message to try again
@@ -25,7 +25,7 @@ DDEESSCCRRIIPPTTIIOONN
        script.  Normally, vviissuuddoo does not honor the VISUAL or
        EDITOR environment variables unless they contain an editor
        in the aforementioned editors list.  However, if vviissuuddoo is
-       configured with the _-_-_w_i_t_h_-_e_n_v_e_d_i_t_o_r flag or the _e_n_v___e_d_i_­
+       configured with the _-_-_w_i_t_h_-_e_n_v_e_d_i_t_o_r flag or the _e_n_v___e_d_i_-
        _t_o_r Default variable is set in _s_u_d_o_e_r_s, vviissuuddoo will use
        any the editor defines by VISUAL or EDITOR.  Note that
        this can be a security hole since it allows the user to
@@ -61,7 +61,7 @@ OOPPTTIIOONNSS
 
 
 
-1.7                       June 23, 2007                         1
+1.7                      August 15, 2007                        1
 
 
 
@@ -80,8 +80,8 @@ VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
            when combined with the --cc flag.
 
        -s  Enable ssttrriicctt checking of the _s_u_d_o_e_r_s file.  If an
-           alias is used before it is defined, vviissuuddoo will con­
-           sider this a parse error.  Note that it is not possi­
+           alias is used before it is defined, vviissuuddoo will con-
+           sider this a parse error.  Note that it is not possi-
            ble to differentiate between an alias and a hostname
            or username that consists solely of uppercase letters,
            digits, and the underscore ('_') character.
@@ -93,12 +93,13 @@ EENNVVIIRROONNMMEENNTT
        The following environment variables are used only if
        vviissuuddoo was configured with the _-_-_w_i_t_h_-_e_n_v_-_e_d_i_t_o_r option:
 
-        VISUAL                 Invoked by visudo as the editor to use
-        EDITOR                 Used by visudo if VISUAL is not set
+       VISUAL          Invoked by visudo as the editor to use
+
+       EDITOR          Used by visudo if VISUAL is not set
 
 FFIILLEESS
-        /etc/sudoers           List of who can run what
-        /etc/sudoers.tmp       Lock file for visudo
+       _/_e_t_c_/_s_u_d_o_e_r_s             List of who can run what
+       _/_e_t_c_/_s_u_d_o_e_r_s_._t_m_p         Lock file for visudo
 
 DDIIAAGGNNOOSSTTIICCSS
        sudoers file busy, try again later.
@@ -114,7 +115,7 @@ DDIIAAGGNNOOSSTTIICCSS
        defined
            Either you are trying to use an undeclare
            {User,Runas,Host,Cmnd}_Alias or you have a user or
-           hostname listed that consists solely of uppercase let­
+           hostname listed that consists solely of uppercase let-
            ters, digits, and the underscore ('_') character.  In
            the latter case, you can ignore the warnings (ssuuddoo
            will not complain).  In --ss (strict) mode these are
@@ -123,11 +124,10 @@ DDIIAAGGNNOOSSTTIICCSS
        Warning: unused {User,Runas,Host,Cmnd}_Alias
            The specified {User,Runas,Host,Cmnd}_Alias was defined
            but never used.  You may wish to comment out or remove
-           the unused alias.  In --ss (strict) mode this is an
 
 
 
-1.7                       June 23, 2007                         2
+1.7                      August 15, 2007                        2
 
 
 
@@ -136,13 +136,14 @@ DDIIAAGGNNOOSSTTIICCSS
 VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
 
 
+           the unused alias.  In --ss (strict) mode this is an
            error, not a warning.
 
 SSEEEE AALLSSOO
-       _v_i(1), sudoers(4), sudo(1m), vipw(1m)
+       _v_i(1), _s_u_d_o_e_r_s(4), _s_u_d_o(1m), _v_i_p_w(8)
 
 AAUUTTHHOORR
-       Many people have worked on _s_u_d_o over the years; this ver­
+       Many people have worked on _s_u_d_o over the years; this ver-
        sion of vviissuuddoo was written by:
 
         Todd Miller
@@ -159,17 +160,17 @@ BBUUGGSS
        a bug report at http://www.sudo.ws/sudo/bugs/
 
 SSUUPPPPOORRTT
-       Limited free support is available via the sudo-users mail­
-       ing list, see http://www.sudo.ws/mail­
+       Limited free support is available via the sudo-users mail-
+       ing list, see http://www.sudo.ws/mail-
        man/listinfo/sudo-users to subscribe or search the
        archives.
 
 DDIISSCCLLAAIIMMEERR
-       VViissuuddoo is provided ``AS IS'' and any express or implied
+       vviissuuddoo is provided ``AS IS'' and any express or implied
        warranties, including, but not limited to, the implied
        warranties of merchantability and fitness for a particular
        purpose are disclaimed.  See the LICENSE file distributed
-       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com­
+       with ssuuddoo or http://www.sudo.ws/sudo/license.html for com-
        plete details.
 
 
@@ -192,7 +193,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-1.7                       June 23, 2007                         3
+1.7                      August 15, 2007                        3
 
 
diff --git a/visudo.man.in b/visudo.man.in
index de434b528..28d88988a 100644
--- a/visudo.man.in
+++ b/visudo.man.in
@@ -1,4 +1,4 @@
-.\" Copyright (c) 1996,1998-2004 Todd C. Miller <Todd.Miller@courtesan.com>
+.\" Copyright (c) 1996,1998-2005, 2007 Todd C. Miller <Todd.Miller@courtesan.com>
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -149,16 +149,16 @@
 .\" ========================================================================
 .\"
 .IX Title "VISUDO @mansectsu@"
-.TH VISUDO @mansectsu@ "June 23, 2007" "1.7" "MAINTENANCE COMMANDS"
+.TH VISUDO @mansectsu@ "August 15, 2007" "1.7" "MAINTENANCE COMMANDS"
 .SH "NAME"
 visudo \- edit the sudoers file
 .SH "SYNOPSIS"
 .IX Header "SYNOPSIS"
-\&\fBvisudo\fR [ \fB\-c\fR ] [ \fB\-f\fR \fIsudoers\fR ] [ \fB\-q\fR ] [ \fB\-s\fR ] [ \fB\-V\fR ]
+\&\fBvisudo\fR [\fB\-c\fR] [\fB\-q\fR] [\fB\-s\fR] [\fB\-V\fR] [\fB\-f\fR \fIsudoers\fR]
 .SH "DESCRIPTION"
 .IX Header "DESCRIPTION"
 \&\fBvisudo\fR edits the \fIsudoers\fR file in a safe fashion, analogous to
-vipw(@mansectsu@).  \fBvisudo\fR locks the \fIsudoers\fR file against multiple
+\&\fIvipw\fR\|(@mansectsu@).  \fBvisudo\fR locks the \fIsudoers\fR file against multiple
 simultaneous edits, provides basic sanity checks, and checks
 for parse errors.  If the \fIsudoers\fR file is currently being
 edited you will receive a message to try again later.
@@ -225,17 +225,24 @@ and exit.
 .IX Header "ENVIRONMENT"
 The following environment variables are used only if \fBvisudo\fR
 was configured with the \fI\-\-with\-env\-editor\fR option:
-.PP
-.Vb 2
-\& VISUAL                 Invoked by visudo as the editor to use
-\& EDITOR                 Used by visudo if VISUAL is not set
-.Ve
+.ie n .IP "\*(C`VISUAL\*(C'" 16
+.el .IP "\f(CW\*(C`VISUAL\*(C'\fR" 16
+.IX Item "VISUAL"
+Invoked by visudo as the editor to use
+.ie n .IP "\*(C`EDITOR\*(C'" 16
+.el .IP "\f(CW\*(C`EDITOR\*(C'\fR" 16
+.IX Item "EDITOR"
+Used by visudo if \s-1VISUAL\s0 is not set
 .SH "FILES"
 .IX Header "FILES"
-.Vb 2
-\& @sysconfdir@/sudoers           List of who can run what
-\& @sysconfdir@/sudoers.tmp       Lock file for visudo
-.Ve
+.ie n .IP "\fI@sysconfdir@/sudoers\fR\*(C`    		\*(C'List of who can run what" 4
+.el .IP "\fI@sysconfdir@/sudoers\fR\f(CW\*(C`    		\*(C'\fRList of who can run what" 4
+.IX Item "@sysconfdir@/sudoers    		List of who can run what"
+.PD 0
+.ie n .IP "\fI@sysconfdir@/sudoers.tmp\fR\*(C`		\*(C'Lock file for visudo" 4
+.el .IP "\fI@sysconfdir@/sudoers.tmp\fR\f(CW\*(C`		\*(C'\fRLock file for visudo" 4
+.IX Item "@sysconfdir@/sudoers.tmp		Lock file for visudo"
+.PD
 .SH "DIAGNOSTICS"
 .IX Header "DIAGNOSTICS"
 .IP "sudoers file busy, try again later." 4
@@ -261,7 +268,7 @@ used.  You may wish to comment out or remove the unused alias.  In
 \&\fB\-s\fR (strict) mode this is an error, not a warning.
 .SH "SEE ALSO"
 .IX Header "SEE ALSO"
-\&\fIvi\fR\|(1), sudoers(@mansectform@), sudo(@mansectsu@), vipw(@mansectsu@)
+\&\fIvi\fR\|(1), \fIsudoers\fR\|(@mansectform@), \fIsudo\fR\|(@mansectsu@), \fIvipw\fR\|(8)
 .SH "AUTHOR"
 .IX Header "AUTHOR"
 Many people have worked on \fIsudo\fR over the years; this version of
@@ -288,7 +295,7 @@ see http://www.sudo.ws/mailman/listinfo/sudo\-users to subscribe or
 search the archives.
 .SH "DISCLAIMER"
 .IX Header "DISCLAIMER"
-\&\fBVisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
+\&\fBvisudo\fR is provided ``\s-1AS\s0 \s-1IS\s0'' and any express or implied warranties,
 including, but not limited to, the implied warranties of merchantability
 and fitness for a particular purpose are disclaimed.  See the \s-1LICENSE\s0
 file distributed with \fBsudo\fR or http://www.sudo.ws/sudo/license.html
-- 
2.40.0