From b1e92e4afd14a8b284932c62f5b1a348bfb037a0 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Date: Sat, 12 Jun 2010 09:32:03 -0400
Subject: [PATCH] Generate .cat files directly from .man.in instead of .man
 using default values in configure.in

--HG--
branch : 1.7
---
 Makefile.in  |  57 +++---
 configure    |  54 +++---
 configure.in |  35 ++--
 sudo.cat     | 100 +++++-----
 sudoers.cat  | 508 +++++++++++++++++++++++++--------------------------
 5 files changed, 385 insertions(+), 369 deletions(-)

diff --git a/Makefile.in b/Makefile.in
index 1ec099054..1589cf32f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -180,7 +180,7 @@ INSDEP = $(srcdir)/ins_2001.h $(srcdir)/ins_classic.h $(srcdir)/ins_csops.h \
 
 all: $(PROGS)
 
-.SUFFIXES: .o .c .h .l .y .man .cat .lo
+.SUFFIXES: .o .c .h .l .y .lo
 
 .c.o:
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $<
@@ -188,10 +188,6 @@ all: $(PROGS)
 .c.lo:
 	$(LIBTOOL) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $<
 
-.man.cat:
-	@rm -f $@
-	sed '1s/^/.if n .ll 78n/' $< | $(NROFF) -man > $@
-
 libsudo.a: $(LIB_OBJS) $(COMMON_OBJS)
 	$(AR) rv $@ $(LIB_OBJS) $(COMMON_OBJS)
 	$(RANLIB) $@
@@ -414,50 +410,53 @@ securid5.o: $(authdir)/securid5.c $(AUTHDEP)
 sia.o: $(authdir)/sia.c $(AUTHDEP)
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(DEFS) $(OPTIONS) $(authdir)/sia.c
 
+varsub: $(srcdir)/configure.in
+	printf 's#@%s@#1#\ns#@%s@#1#\ns#@%s@#1#\ns#@%s@#/etc#g\ns#@%s@#/usr/local#g\ns#@%s@#4#g\ns#@%s@#1m#g\n' SEMAN BAMAN LCMAN sysconfdir prefix mansectform mansectsu > $@; sed -n '/Begin initial values for man page substitution/,/End initial values for man page substitution/{;p;}' $(srcdir)/configure.in | sed -e '/^#/d' -e 's/^/s#@/' -e 's/=[\\"]*/@#/' -e 's/[\\"]*$$/#g/' >> $@
+
 sudo.man.in: $(srcdir)/sudo.pod
-	@rm -f $(srcdir)/$@
-	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudo.man.pl >> $@ )
+	mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' $(srcdir)/sudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" $(srcdir)/sudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p $(srcdir)/sudo.man.pl >> $@
 
-sudo.man: sudo.man.in
+sudo.man: $(srcdir)/sudo.man.in
 	$(SHELL) config.status --file=$@
 
-sudo.cat: sudo.man
+$(srcdir)/sudo.cat: varsub $(srcdir)/sudo.man.in
+	sed -f varsub $(srcdir)/sudo.man.in | $(NROFF) -man > $@
 
-visudo.man.in: $(srcdir)/visudo.pod
-	@rm -f $(srcdir)/$@
-	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' visudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" visudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ )
+$(srcdir)/visudo.man.in: $(srcdir)/visudo.pod
+	mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' $(srcdir)/visudo.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" $(srcdir)/visudo.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@
 
-visudo.man: visudo.man.in
+visudo.man: $(srcdir)/visudo.man.in
 	$(SHELL) config.status --file=$@
 
-visudo.cat: visudo.man
+$(srcdir)/visudo.cat: varsub $(srcdir)/visudo.man.in
+	sed -f varsub $(srcdir)/visudo.man.in | $(NROFF) -man > $@
 
-sudoers.man.in: $(srcdir)/sudoers.pod
-	@rm -f $(srcdir)/$@
-	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p sudoers.man.pl >> $@ )
+$(srcdir)/sudoers.man.in: $(srcdir)/sudoers.pod
+	mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' $(srcdir)/sudoers.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" $(srcdir)/sudoers.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" | perl -p $(srcdir)/sudoers.man.pl >> $@
 
-sudoers.man: sudoers.man.in
+sudoers.man: $(srcdir)/sudoers.man.in
 	$(SHELL) config.status --file=$@
 
-sudoers.cat: sudoers.man
+$(srcdir)/sudoers.cat: varsub $(srcdir)/sudoers.man.in
+	sed -f varsub $(srcdir)/sudoers.man.in | $(NROFF) -man > $@
 
-sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.pod
-	@rm -f $(srcdir)/$@
-	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoers.ldap.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoers.ldap.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ )
+$(srcdir)/sudoers.ldap.man.in: $(srcdir)/sudoers.ldap.pod
+	mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' $(srcdir)/sudoers.ldap.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectform --release=$(VERSION) --center="MAINTENANCE COMMANDS" $(srcdir)/sudoers.ldap.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@
 
-sudoers.ldap.man: sudoers.ldap.man.in
+sudoers.ldap.man: $(srcdir)/sudoers.ldap.man.in
 	$(SHELL) config.status --file=$@
 
-sudoers.ldap.cat: sudoers.ldap.man
+$(srcdir)/sudoers.ldap.cat: varsub $(srcdir)/sudoers.ldap.man.in
+	sed -f varsub $(srcdir)/sudoers.ldap.man.in | $(NROFF) -man > $@
 
-sudoreplay.man.in: $(srcdir)/sudoreplay.pod
-	@rm -f $(srcdir)/$@
-	( cd $(srcdir); mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' sudoreplay.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" sudoreplay.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@ )
+$(srcdir)/sudoreplay.man.in: $(srcdir)/sudoreplay.pod
+	mansectsu=`echo @MANSECTSU@|tr A-Z a-z`; mansectform=`echo @MANSECTFORM@|tr A-Z a-z`; sed -n -e '/^=pod/q' -e 's/^/.\\" /p' $(srcdir)/sudoreplay.pod > $@; pod2man --quotes=none --date="`date '+%B %e, %Y'`" --section=$$mansectsu --release=$(VERSION) --center="MAINTENANCE COMMANDS" $(srcdir)/sudoreplay.pod | sed -e "s/(5)/($$mansectform)/" -e "s/(8)/($$mansectsu)/" -e 's|\\fI\\f\((CW*\)*I@\([^@]*\)\\fI@|\\fI@\2@|g' >> $@
 
-sudoreplay.man: sudoreplay.man.in
+sudoreplay.man: $(srcdir)/sudoreplay.man.in
 	$(SHELL) config.status --file=$@
 
-sudoers.cat: sudoers.man
+$(srcdir)/sudoreplay.cat: varsub $(srcdir)/sudoreplay.man.in
+	sed -f varsub $(srcdir)/sudoreplay.man.in | $(NROFF) -man > $@
 
 @DEV@HISTORY: history.pod
 @DEV@	pod2text -l -i0 $> > $@
diff --git a/configure b/configure
index 7b230c0fc..9fb1a6592 100755
--- a/configure
+++ b/configure
@@ -2766,6 +2766,10 @@ $as_echo "$as_me: Configuring Sudo version $PACKAGE_VERSION" >&6;}
 
 
 
+#
+# Begin initial values for man page substitution
+#
+timedir=/var/run/sudo
 timeout=5
 password_timeout=5
 sudo_umask=0022
@@ -2781,8 +2785,8 @@ mail_no_user=on
 mail_no_host=off
 mail_no_perms=off
 mailto=root
-mailsub='*** SECURITY information for %h ***'
-badpass_message='Sorry, try again.'
+mailsub="*** SECURITY information for %h ***"
+badpass_message="Sorry, try again."
 fqdn=off
 runas_default=root
 env_editor=off
@@ -2791,7 +2795,15 @@ tty_tickets=off
 insults=off
 root_sudo=on
 path_info=on
+ldap_conf=/etc/ldap.conf
+ldap_secret=/etc/ldap.secret
+netsvc_conf=/etc/netsvc.conf
+noexec_file=/usr/local/libexec/sudo_noexec.so
+nsswitch_conf=/etc/nsswitch.conf
 secure_path="not set"
+#
+# End initial values for man page substitution
+#
 INSTALL_NOEXEC=
 devdir='$(srcdir)'
 PROGS="sudo visudo"
@@ -4089,11 +4101,11 @@ if test "${with_ldap_conf_file+set}" = set; then :
   withval=$with_ldap_conf_file;
 fi
 
+test -n "$with_ldap_conf_file" && ldap_conf="$with_ldap_conf_file"
 cat >>confdefs.h <<EOF
-#define _PATH_LDAP_CONF "${with_ldap_conf_file-/etc/ldap.conf}"
+#define _PATH_LDAP_CONF "$ldap_conf"
 EOF
 
-ldap_conf=${with_ldap_conf_file-'/etc/ldap.conf'}
 
 
 # Check whether --with-ldap-secret-file was given.
@@ -4101,11 +4113,11 @@ if test "${with_ldap_secret_file+set}" = set; then :
   withval=$with_ldap_secret_file;
 fi
 
+test -n "$with_ldap_secret_file" && ldap_secret="$with_ldap_secret_file"
 cat >>confdefs.h <<EOF
-#define _PATH_LDAP_SECRET "${with_ldap_secret_file-/etc/ldap.secret}"
+#define _PATH_LDAP_SECRET "$ldap_secret"
 EOF
 
-ldap_secret=${with_ldap_secret_file-'/etc/ldap.secret'}
 
 
 # Check whether --with-pc-insults was given.
@@ -6527,13 +6539,13 @@ if test "${lt_cv_nm_interface+set}" = set; then :
 else
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:6530: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:6542: $ac_compile\"" >&5)
   (eval "$ac_compile" 2>conftest.err)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6533: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:6545: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
   (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:6536: output\"" >&5)
+  (eval echo "\"\$as_me:6548: output\"" >&5)
   cat conftest.out >&5
   if $GREP 'External.*some_variable' conftest.out > /dev/null; then
     lt_cv_nm_interface="MS dumpbin"
@@ -7738,7 +7750,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 7741 "configure"' > conftest.$ac_ext
+  echo '#line 7753 "configure"' > conftest.$ac_ext
   if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9131,11 +9143,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9134: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9146: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9138: \$? = $ac_status" >&5
+   echo "$as_me:9150: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9470,11 +9482,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9473: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9485: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9477: \$? = $ac_status" >&5
+   echo "$as_me:9489: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -9575,11 +9587,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9578: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9590: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9582: \$? = $ac_status" >&5
+   echo "$as_me:9594: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -9630,11 +9642,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9633: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9645: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:9637: \$? = $ac_status" >&5
+   echo "$as_me:9649: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -11997,7 +12009,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12000 "configure"
+#line 12012 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12093,7 +12105,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 12096 "configure"
+#line 12108 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -15896,8 +15908,6 @@ fi
 done
 
 
-netsvc_conf='/etc/netsvc.conf'
-nsswitch_conf='/etc/nsswitch.conf'
 if test ${with_netsvc-"no"} != "no"; then
     cat >>confdefs.h <<EOF
 #define _PATH_NETSVC_CONF "${with_netsvc-/etc/netsvc.conf}"
diff --git a/configure.in b/configure.in
index bdc7189d5..d57cff0c6 100644
--- a/configure.in
+++ b/configure.in
@@ -57,7 +57,7 @@ AC_SUBST([CONFIGURE_ARGS])
 dnl
 dnl Variables that get substituted in docs (not overridden by environment)
 dnl
-AC_SUBST([timedir])dnl initial value from SUDO_TIMEDIR
+AC_SUBST([timedir])dnl real initial value from SUDO_TIMEDIR
 AC_SUBST([timeout])
 AC_SUBST([password_timeout])
 AC_SUBST([sudo_umask])
@@ -88,9 +88,10 @@ AC_SUBST([ldap_secret])
 AC_SUBST([nsswitch_conf])
 AC_SUBST([netsvc_conf])
 AC_SUBST([secure_path])
-dnl
-dnl Initial values for above
-dnl
+#
+# Begin initial values for man page substitution
+#
+timedir=/var/run/sudo
 timeout=5
 password_timeout=5
 sudo_umask=0022
@@ -106,8 +107,8 @@ mail_no_user=on
 mail_no_host=off
 mail_no_perms=off
 mailto=root
-mailsub='*** SECURITY information for %h ***'
-badpass_message='Sorry, try again.'
+mailsub="*** SECURITY information for %h ***"
+badpass_message="Sorry, try again."
 fqdn=off
 runas_default=root
 env_editor=off
@@ -116,13 +117,21 @@ tty_tickets=off
 insults=off
 root_sudo=on
 path_info=on
+ldap_conf=/etc/ldap.conf
+ldap_secret=/etc/ldap.secret
+netsvc_conf=/etc/netsvc.conf
+noexec_file=/usr/local/libexec/sudo_noexec.so
+nsswitch_conf=/etc/nsswitch.conf
 secure_path="not set"
-INSTALL_NOEXEC=
-devdir='$(srcdir)'
+#
+# End initial values for man page substitution
+#
 dnl
 dnl Initial values for Makefile variables listed above
 dnl May be overridden by environment variables..
 dnl
+INSTALL_NOEXEC=
+devdir='$(srcdir)'
 PROGS="sudo visudo"
 : ${MANTYPE='man'}
 : ${mansrcdir='.'}
@@ -971,12 +980,12 @@ AC_ARG_WITH(ldap, [AS_HELP_STRING([--with-ldap[[=DIR]]], [enable LDAP support])]
 esac])
 
 AC_ARG_WITH(ldap-conf-file, [AS_HELP_STRING([--with-ldap-conf-file], [path to LDAP configuration file])])
-SUDO_DEFINE_UNQUOTED(_PATH_LDAP_CONF, "${with_ldap_conf_file-/etc/ldap.conf}", [Path to the ldap.conf file])
-ldap_conf=${with_ldap_conf_file-'/etc/ldap.conf'}
+test -n "$with_ldap_conf_file" && ldap_conf="$with_ldap_conf_file"
+SUDO_DEFINE_UNQUOTED(_PATH_LDAP_CONF, "$ldap_conf", [Path to the ldap.conf file])
 
 AC_ARG_WITH(ldap-secret-file, [AS_HELP_STRING([--with-ldap-secret-file], [path to LDAP secret password file])])
-SUDO_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "${with_ldap_secret_file-/etc/ldap.secret}", [Path to the ldap.secret file])
-ldap_secret=${with_ldap_secret_file-'/etc/ldap.secret'}
+test -n "$with_ldap_secret_file" && ldap_secret="$with_ldap_secret_file"
+SUDO_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "$ldap_secret", [Path to the ldap.secret file])
 
 AC_ARG_WITH(pc-insults, [AS_HELP_STRING([--with-pc-insults], [replace politically incorrect insults with less offensive ones])],
 [case $with_pc_insults in
@@ -2011,8 +2020,6 @@ AC_INCLUDES_DEFAULT
 dnl
 dnl nsswitch.conf and its equivalents
 dnl
-netsvc_conf='/etc/netsvc.conf'
-nsswitch_conf='/etc/nsswitch.conf'
 if test ${with_netsvc-"no"} != "no"; then
     SUDO_DEFINE_UNQUOTED(_PATH_NETSVC_CONF, "${with_netsvc-/etc/netsvc.conf}")
     netsvc_conf=${with_netsvc-/etc/netsvc.conf}
diff --git a/sudo.cat b/sudo.cat
index 92cab9dfb..de85025b2 100644
--- a/sudo.cat
+++ b/sudo.cat
@@ -17,8 +17,8 @@ SSYYNNOOPPSSIISS
        [--UU _u_s_e_r _n_a_m_e] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
 
        ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
-       [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e]
-       [--ii | --ss] [_c_o_m_m_a_n_d]
+       [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--rr _r_o_l_e] [--tt _t_y_p_e]
+       [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] [--ii | --ss] [_c_o_m_m_a_n_d]
 
        ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
        [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] file ...
@@ -294,6 +294,9 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    system password prompt on systems that support PAM unless
                    the _p_a_s_s_p_r_o_m_p_t___o_v_e_r_r_i_d_e flag is disabled in _s_u_d_o_e_r_s.
 
+       -r _r_o_l_e     The --rr (_r_o_l_e) option causes the new (SELinux) security
+                   context to have the role specified by _r_o_l_e.
+
        -S          The --SS (_s_t_d_i_n) option causes ssuuddoo to read the password from
                    the standard input instead of the terminal device.  The
                    password must be followed by a newline character.
@@ -305,6 +308,11 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    the shell for execution.  Otherwise, an interactive shell
                    is executed.
 
+       -t _t_y_p_e     The --tt (_t_y_p_e) option causes the new (SELinux) security
+                   context to have the type specified by _t_y_p_e.  If no type is
+                   specified, the default type is derived from the specified
+                   role.
+
        -U _u_s_e_r     The --UU (_o_t_h_e_r _u_s_e_r) option is used in conjunction with the
                    --ll option to specify the user whose privileges should be
                    listed.  Only root or a user with ssuuddoo ALL on the current
@@ -314,14 +322,6 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    command as a user other than _r_o_o_t.  To specify a _u_i_d
                    instead of a _u_s_e_r _n_a_m_e, use _#_u_i_d.  When running commands as
                    a _u_i_d, many shells require that the '#' be escaped with a
-                   backslash ('\').  Note that if the _t_a_r_g_e_t_p_w Defaults option
-                   is set (see _s_u_d_o_e_r_s(4)) it is not possible to run commands
-                   with a uid not listed in the password database.
-
-       -V          The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the version
-                   number and exit.  If the invoking user is already root the
-                   --VV option will print out a list of the defaults ssuuddoo was
-                   compiled with as well as the machine's local network
 
 
 
@@ -334,6 +334,14 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+                   backslash ('\').  Note that if the _t_a_r_g_e_t_p_w Defaults option
+                   is set (see _s_u_d_o_e_r_s(4)) it is not possible to run commands
+                   with a uid not listed in the password database.
+
+       -V          The --VV (_v_e_r_s_i_o_n) option causes ssuuddoo to print the version
+                   number and exit.  If the invoking user is already root the
+                   --VV option will print out a list of the defaults ssuuddoo was
+                   compiled with as well as the machine's local network
                    addresses.
 
        -v          If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
@@ -380,14 +388,6 @@ SSEECCUURRIITTYY NNOOTTEESS
        invoking process permitted by the _e_n_v___c_h_e_c_k and _e_n_v___k_e_e_p _s_u_d_o_e_r_s
        options.  There is effectively a whitelist for environment variables.
 
-       If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s, any variables
-       not explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are
-       inherited from the invoking process.  In this case, _e_n_v___c_h_e_c_k and
-       _e_n_v___d_e_l_e_t_e behave like a blacklist.  Since it is not possible to
-       blacklist all potentially dangerous environment variables, use of the
-       default _e_n_v___r_e_s_e_t behavior is encouraged.
-
-       In all cases, environment variables with a value beginning with () are
 
 
 
@@ -400,6 +400,14 @@ SSEECCUURRIITTYY NNOOTTEESS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       If, however, the _e_n_v___r_e_s_e_t option is disabled in _s_u_d_o_e_r_s, any variables
+       not explicitly denied by the _e_n_v___c_h_e_c_k and _e_n_v___d_e_l_e_t_e options are
+       inherited from the invoking process.  In this case, _e_n_v___c_h_e_c_k and
+       _e_n_v___d_e_l_e_t_e behave like a blacklist.  Since it is not possible to
+       blacklist all potentially dangerous environment variables, use of the
+       default _e_n_v___r_e_s_e_t behavior is encouraged.
+
+       In all cases, environment variables with a value beginning with () are
        removed as they could be interpreted as bbaasshh functions.  The list of
        environment variables that ssuuddoo allows or denies is contained in the
        output of sudo -V when run as root.
@@ -446,14 +454,6 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
        Since time stamp files live in the file system, they can outlive a
        user's login session.  As a result, a user may be able to login, run a
-       command with ssuuddoo after authenticating, logout, login again, and run
-       ssuuddoo without authenticating so long as the time stamp file's
-       modification time is within 5 minutes (or whatever the timeout is set
-       to in _s_u_d_o_e_r_s).  When the _t_t_y___t_i_c_k_e_t_s option is enabled in _s_u_d_o_e_r_s, the
-       time stamp has per-tty granularity but still may outlive the user's
-       session.  On Linux systems where the devpts filesystem is used, Solaris
-       systems with the devices filesystem, as well as other systems that
-       utilize a devfs filesystem that monotonically increase the inode number
 
 
 
@@ -466,6 +466,14 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       command with ssuuddoo after authenticating, logout, login again, and run
+       ssuuddoo without authenticating so long as the time stamp file's
+       modification time is within 5 minutes (or whatever the timeout is set
+       to in _s_u_d_o_e_r_s).  When the _t_t_y___t_i_c_k_e_t_s option is enabled in _s_u_d_o_e_r_s, the
+       time stamp has per-tty granularity but still may outlive the user's
+       session.  On Linux systems where the devpts filesystem is used, Solaris
+       systems with the devices filesystem, as well as other systems that
+       utilize a devfs filesystem that monotonically increase the inode number
        of devices as they are created (such as Mac OS X), ssuuddoo is able to
        determine when a tty-based time stamp file is stale and will ignore it.
        Administrators should not rely on this feature as it is not universally
@@ -513,24 +521,24 @@ EENNVVIIRROONNMMEENNTT
 
        SUDO_UID        Set to the user ID of the user who invoked sudo
 
-       SUDO_USER       Set to the login of the user who invoked sudo
 
-       USER            Set to the target user (root unless the --uu option is
-                       specified)
 
-       VISUAL          Default editor to use in --ee (sudoedit) mode if
-                       SUDO_EDITOR is not set
+1.7.3b3                   June 10, 2010                         8
 
 
 
-1.7.3b3                   June 10, 2010                         8
 
 
+SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       SUDO_USER       Set to the login of the user who invoked sudo
 
-SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
+       USER            Set to the target user (root unless the --uu option is
+                       specified)
 
+       VISUAL          Default editor to use in --ee (sudoedit) mode if
+                       SUDO_EDITOR is not set
 
 FFIILLEESS
        _/_e_t_c_/_s_u_d_o_e_r_s            List of who can run what
@@ -578,14 +586,6 @@ SSEEEE AALLSSOO
        _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(4), _s_u_d_o_e_r_s(5),
        _v_i_s_u_d_o(1m)
 
-AAUUTTHHOORRSS
-       Many people have worked on ssuuddoo over the years; this version consists
-       of code written primarily by:
-
-               Todd C. Miller
-
-       See the HISTORY file in the ssuuddoo distribution or visit
-       http://www.sudo.ws/sudo/history.html for a short history of ssuuddoo.
 
 
 
@@ -598,6 +598,15 @@ AAUUTTHHOORRSS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+AAUUTTHHOORRSS
+       Many people have worked on ssuuddoo over the years; this version consists
+       of code written primarily by:
+
+               Todd C. Miller
+
+       See the HISTORY file in the ssuuddoo distribution or visit
+       http://www.sudo.ws/sudo/history.html for a short history of ssuuddoo.
+
 CCAAVVEEAATTSS
        There is no easy way to prevent a user from gaining a root shell if
        that user is allowed to run arbitrary commands via ssuuddoo.  Also, many
@@ -646,15 +655,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-
-
-
-
-
-
-
-
 1.7.3b3                   June 10, 2010                        10
 
 
diff --git a/sudoers.cat b/sudoers.cat
index 667c0682d..0b6725d27 100644
--- a/sudoers.cat
+++ b/sudoers.cat
@@ -275,10 +275,12 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Cmnd_Spec_List ::= Cmnd_Spec |
                            Cmnd_Spec ',' Cmnd_Spec_List
 
-        Cmnd_Spec ::= Runas_Spec? Tag_Spec* Cmnd
+        Cmnd_Spec ::= Runas_Spec? SELinux_Spec? Tag_Spec* Cmnd
 
         Runas_Spec ::= '(' Runas_List? (':' Runas_List)? ')'
 
+        SELinux_Spec ::= ('ROLE=role' | 'TYPE=type')
+
         Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
                       'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
                       'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
@@ -320,8 +322,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
         dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
 
-       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
-       and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
 
 
 
@@ -334,6 +334,9 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
+       and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
+
        We can extend this to allow ddggbb to run /bin/ls with either the user or
        group set to ooppeerraattoorr:
 
@@ -347,6 +350,13 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         tcm    boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
                /usr/local/bin/minicom
 
+   SSEELLiinnuuxx__SSppeecc
+       On systems with SELinux support, _s_u_d_o_e_r_s entries may optionally have an
+       SELinux role and/or type associated with a command.  If a role or type
+       is specified with the command it will override any default values
+       specified in _s_u_d_o_e_r_s.  A role or type specified on the command line,
+       however, will supercede the values in _s_u_d_o_e_r_s.
+
    TTaagg__SSppeecc
        A command may have zero or more tags associated with it.  There are
        eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV,
@@ -378,27 +388,27 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        By default, if the NOPASSWD tag is applied to any of the entries for a
        user on the current host, he or she will be able to run sudo -l without
        a password.  Additionally, a user may only run sudo -v without a
-       password if the NOPASSWD tag is present for all a user's entries that
-       pertain to the current host.  This behavior may be overridden via the
-       verifypw and listpw options.
 
-       _N_O_E_X_E_C _a_n_d _E_X_E_C
 
-       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
-       operating system supports it, the NOEXEC tag can be used to prevent a
-       dynamically-linked executable from running further commands itself.
 
+1.7.3b3                   June 10, 2010                         6
 
 
 
-1.7.3b3                   June 10, 2010                         6
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       password if the NOPASSWD tag is present for all a user's entries that
+       pertain to the current host.  This behavior may be overridden via the
+       verifypw and listpw options.
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       _N_O_E_X_E_C _a_n_d _E_X_E_C
 
+       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
+       operating system supports it, the NOEXEC tag can be used to prevent a
+       dynamically-linked executable from running further commands itself.
 
        In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
        _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
@@ -444,27 +454,28 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        [!...]  Matches any character nnoott in the specified range.
 
-       \x      For any character "x", evaluates to "x".  This is used to
-               escape special characters such as: "*", "?", "[", and "}".
 
-       POSIX character classes may also be used if your system's _g_l_o_b(3) and
-       _f_n_m_a_t_c_h(3) functions support them.  However, because the ':' character
-       has special meaning in _s_u_d_o_e_r_s, it must be escaped.  For example:
 
-           /bin/ls [[\:alpha\:]]*
 
-       Would match any file name beginning with a letter.
+1.7.3b3                   June 10, 2010                         7
 
 
 
-1.7.3b3                   June 10, 2010                         7
 
 
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       \x      For any character "x", evaluates to "x".  This is used to
+               escape special characters such as: "*", "?", "[", and "}".
 
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+       POSIX character classes may also be used if your system's _g_l_o_b(3) and
+       _f_n_m_a_t_c_h(3) functions support them.  However, because the ':' character
+       has special meaning in _s_u_d_o_e_r_s, it must be escaped.  For example:
 
+           /bin/ls [[\:alpha\:]]*
+
+       Would match any file name beginning with a letter.
 
        Note that a forward slash ('/') will nnoott be matched by wildcards used
        in the path name.  When matching the command line arguments, however, a
@@ -509,17 +520,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        will cause ssuuddoo to include the file _/_e_t_c_/_s_u_d_o_e_r_s_._x_e_r_x_e_s.
 
        The #includedir directive can be used to create a _s_u_d_o_._d directory that
-       the system package manager can drop _s_u_d_o_e_r_s rules into as part of
-       package installation.  For example, given:
-
-       #includedir /etc/sudoers.d
-
-       ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that
-       end in ~ or contain a . character to avoid causing problems with
-       package manager or editor temporary/backup files.  Files are parsed in
-       sorted lexical order.  That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed
-       before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Be aware that because the sorting is
-       lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr
 
 
 
@@ -532,6 +532,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       the system package manager can drop _s_u_d_o_e_r_s rules into as part of
+       package installation.  For example, given:
+
+       #includedir /etc/sudoers.d
+
+       ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that
+       end in ~ or contain a . character to avoid causing problems with
+       package manager or editor temporary/backup files.  Files are parsed in
+       sorted lexical order.  That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed
+       before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Be aware that because the sorting is
+       lexical, not numeric, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1___w_h_o_o_p_s would be loaded aafftteerr
        _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Using a consistent number of leading zeroes
        in the file names can be used to avoid such problems.
 
@@ -576,17 +587,6 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
        earlier.  A list of all supported Defaults parameters, grouped by type,
        are listed below.
 
-       BBoooolleeaann FFllaaggss:
-
-       always_set_home If set, ssuuddoo will set the HOME environment variable to
-                       the home directory of the target user (which is root
-                       unless the --uu option is used).  This effectively means
-                       that the --HH option is always implied.  This flag is _o_f_f
-                       by default.
-
-       authenticate    If set, users must authenticate themselves via a
-                       password (or other means of authentication) before they
-
 
 
 1.7.3b3                   June 10, 2010                         9
@@ -598,6 +598,16 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       BBoooolleeaann FFllaaggss:
+
+       always_set_home If set, ssuuddoo will set the HOME environment variable to
+                       the home directory of the target user (which is root
+                       unless the --uu option is used).  This effectively means
+                       that the --HH option is always implied.  This flag is _o_f_f
+                       by default.
+
+       authenticate    If set, users must authenticate themselves via a
+                       password (or other means of authentication) before they
                        may run commands.  This default may be overridden via
                        the PASSWD and NOPASSWD tags.  This flag is _o_n by
                        default.
@@ -621,7 +631,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        alternative is to place a colon-separated list of
                        editors in the editor variable.  vviissuuddoo will then only
                        use the EDITOR or VISUAL if they match a value
-                       specified in editor.  This flag is _o_n by default.
+                       specified in editor.  This flag is _o_f_f by default.
 
        env_reset       If set, ssuuddoo will reset the environment to only contain
                        the LOGNAME, SHELL, USER, USERNAME and the SUDO_*
@@ -642,16 +652,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        option causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function,
                        which does not access the file system to do its
                        matching.  The disadvantage of _f_a_s_t___g_l_o_b is that it is
-                       unable to match relative path names such as _._/_l_s or
-                       _._._/_b_i_n_/_l_s.  This has security implications when path
-                       names that include globbing characters are used with
-                       the negation operator, '!', as such rules can be
-                       trivially bypassed.  As such, this option should not be
-                       used when _s_u_d_o_e_r_s contains rules that contain negated
-                       path names which include globbing characters.  This
-                       flag is _o_f_f by default.
-
-       fqdn            Set this flag if you want to put fully qualified host
 
 
 
@@ -664,6 +664,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       unable to match relative path names such as _._/_l_s or
+                       _._._/_b_i_n_/_l_s.  This has security implications when path
+                       names that include globbing characters are used with
+                       the negation operator, '!', as such rules can be
+                       trivially bypassed.  As such, this option should not be
+                       used when _s_u_d_o_e_r_s contains rules that contain negated
+                       path names which include globbing characters.  This
+                       flag is _o_f_f by default.
+
+       fqdn            Set this flag if you want to put fully qualified host
                        names in the _s_u_d_o_e_r_s file.  I.e., instead of myhost you
                        would use myhost.mydomain.edu.  You may still use the
                        short form if you wish (and even mix the two).  Beware
@@ -681,7 +691,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        ignore_dot      If set, ssuuddoo will ignore '.' or '' (current dir) in the
                        PATH environment variable; the PATH itself is not
-                       modified.  This flag is _o_n by default.
+                       modified.  This flag is _o_f_f by default.
 
        ignore_local_sudoers
                        If set via LDAP, parsing of _/_e_t_c_/_s_u_d_o_e_r_s will be
@@ -697,7 +707,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        _o_f_f by default.
 
        insults         If set, ssuuddoo will insult users when they enter an
-                       incorrect password.  This flag is _o_n by default.
+                       incorrect password.  This flag is _o_f_f by default.
 
        log_host        If set, the host name will be logged in the (non-
                        syslog) ssuuddoo log file.  This flag is _o_f_f by default.
@@ -708,16 +718,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        long_otp_prompt When validating with a One Time Password (OPT) scheme
                        such as SS//KKeeyy or OOPPIIEE, a two-line prompt is used to
                        make it easier to cut and paste the challenge to a
-                       local window.  It's not as pretty as the default but
-                       some people find it more convenient.  This flag is _o_f_f
-                       by default.
-
-       mail_always     Send mail to the _m_a_i_l_t_o user every time a users runs
-                       ssuuddoo.  This flag is _o_f_f by default.
-
-       mail_badpass    Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
-                       does not enter the correct password.  This flag is _o_f_f
-                       by default.
 
 
 
@@ -730,6 +730,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       local window.  It's not as pretty as the default but
+                       some people find it more convenient.  This flag is _o_f_f
+                       by default.
+
+       mail_always     Send mail to the _m_a_i_l_t_o user every time a users runs
+                       ssuuddoo.  This flag is _o_f_f by default.
+
+       mail_badpass    Send mail to the _m_a_i_l_t_o user if the user running ssuuddoo
+                       does not enter the correct password.  This flag is _o_f_f
+                       by default.
+
        mail_no_host    If set, mail will be sent to the _m_a_i_l_t_o user if the
                        invoking user exists in the _s_u_d_o_e_r_s file, but is not
                        allowed to run commands on the current host.  This flag
@@ -773,17 +784,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        _p_r_e_s_e_r_v_e___g_r_o_u_p_s is set, the user's existing group
                        vector is left unaltered.  The real and effective group
                        IDs, however, are still set to match the target user.
-                       This flag is _o_f_f by default.
-
-       pwfeedback      By default, ssuuddoo reads the password like most other
-                       Unix programs, by turning off echo until the user hits
-                       the return (or enter) key.  Some users become confused
-                       by this as it appears to them that ssuuddoo has hung at
-                       this point.  When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide
-                       visual feedback when the user presses a key.  Note that
-                       this does have a security impact as an onlooker may be
-                       able to determine the length of the password being
-                       entered.  This flag is _o_f_f by default.
 
 
 
@@ -796,6 +796,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       This flag is _o_f_f by default.
+
+       pwfeedback      By default, ssuuddoo reads the password like most other
+                       Unix programs, by turning off echo until the user hits
+                       the return (or enter) key.  Some users become confused
+                       by this as it appears to them that ssuuddoo has hung at
+                       this point.  When _p_w_f_e_e_d_b_a_c_k is set, ssuuddoo will provide
+                       visual feedback when the user presses a key.  Note that
+                       this does have a security impact as an onlooker may be
+                       able to determine the length of the password being
+                       entered.  This flag is _o_f_f by default.
+
        requiretty      If set, ssuuddoo will only run when the user is logged in
                        to a real tty.  When this flag is set, ssuuddoo can only be
                        run from a login session and not via other means such
@@ -838,18 +850,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        the value of _s_e_t___l_o_g_n_a_m_e.  This flag is _o_f_f by default.
 
        setenv          Allow the user to disable the _e_n_v___r_e_s_e_t option from the
-                       command line.  Additionally, environment variables set
-                       via the command line are not subject to the
-                       restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or
-                       _e_n_v___k_e_e_p.  As such, only trusted users should be
-                       allowed to set variables in this manner.  This flag is
-                       _o_f_f by default.
-
-       shell_noargs    If set and ssuuddoo is invoked with no arguments it acts as
-                       if the --ss option had been given.  That is, it runs a
-                       shell as root (the shell is determined by the SHELL
-                       environment variable if it is set, falling back on the
-                       shell listed in the invoking user's /etc/passwd entry
 
 
 
@@ -862,6 +862,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       command line.  Additionally, environment variables set
+                       via the command line are not subject to the
+                       restrictions imposed by _e_n_v___c_h_e_c_k, _e_n_v___d_e_l_e_t_e, or
+                       _e_n_v___k_e_e_p.  As such, only trusted users should be
+                       allowed to set variables in this manner.  This flag is
+                       _o_f_f by default.
+
+       shell_noargs    If set and ssuuddoo is invoked with no arguments it acts as
+                       if the --ss option had been given.  That is, it runs a
+                       shell as root (the shell is determined by the SHELL
+                       environment variable if it is set, falling back on the
+                       shell listed in the invoking user's /etc/passwd entry
                        if not).  This flag is _o_f_f by default.
 
        stay_setuid     Normally, when ssuuddoo executes a command the real and
@@ -905,18 +917,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        using a unique session ID that is included in the
                        normal ssuuddoo log line, prefixed with _T_S_I_D_=.
 
-                       Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m)
-                       utility, which can also be used to list or search the
-                       available logs.
-
-       tty_tickets     If set, users must authenticate on a per-tty basis.
-                       Normally, ssuuddoo uses a directory in the ticket dir with
-                       the same name as the user running it.  With this flag
-                       enabled, ssuuddoo will use a file named for the tty the
-                       user is logged in on in that directory.  This flag is
-                       _o_f_f by default.
-
-
 
 
 1.7.3b3                   June 10, 2010                        14
@@ -928,6 +928,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+                       Output logs may be viewed with the _s_u_d_o_r_e_p_l_a_y(1m)
+                       utility, which can also be used to list or search the
+                       available logs.
+
+       tty_tickets     If set, users must authenticate on a per-tty basis.
+                       Normally, ssuuddoo uses a directory in the ticket dir with
+                       the same name as the user running it.  With this flag
+                       enabled, ssuuddoo will use a file named for the tty the
+                       user is logged in on in that directory.  This flag is
+                       _o_f_f by default.
+
        umask_override  If set, ssuuddoo will set the umask as specified by _s_u_d_o_e_r_s
                        without modification.  This makes it possible to
                        specify a more permissive umask in _s_u_d_o_e_r_s than the
@@ -971,17 +982,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        IInntteeggeerrss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
-       loglinelen      Number of characters per line for the file log.  This
-                       value is used to decide when to wrap lines for nicer
-                       log files.  This has no effect on the syslog log file,
-                       only the file log.  The default is 80 (use 0 or negate
-                       the option to disable word wrap).
-
-       passwd_timeout  Number of minutes before the ssuuddoo password prompt times
-                       out, or 0 for no timeout.  The timeout may include a
-                       fractional component if minute granularity is
-                       insufficient, for example 2.5.  The default is 5.
-
 
 
 
@@ -994,6 +994,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       loglinelen      Number of characters per line for the file log.  This
+                       value is used to decide when to wrap lines for nicer
+                       log files.  This has no effect on the syslog log file,
+                       only the file log.  The default is 80 (use 0 or negate
+                       the option to disable word wrap).
+
+       passwd_timeout  Number of minutes before the ssuuddoo password prompt times
+                       out, or 0 for no timeout.  The timeout may include a
+                       fractional component if minute granularity is
+                       insufficient, for example 2.5.  The default is 5.
+
        timestamp_timeout
                        Number of minutes that can elapse before ssuuddoo will ask
                        for a passwd again.  The timeout may include a
@@ -1038,17 +1049,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        LD_PRELOAD or its equivalent.  Defaults to
                        _/_u_s_r_/_l_o_c_a_l_/_l_i_b_e_x_e_c_/_s_u_d_o___n_o_e_x_e_c_._s_o.
 
-       passprompt      The default prompt to use when asking for a password;
-                       can be overridden via the --pp option or the SUDO_PROMPT
-                       environment variable.  The following percent (`%')
-                       escapes are supported:
-
-                       %H  expanded to the local host name including the
-                           domain name (on if the machine's host name is fully
-                           qualified or the _f_q_d_n option is set)
-
-                       %h  expanded to the local host name without the domain
-
 
 
 1.7.3b3                   June 10, 2010                        16
@@ -1060,6 +1060,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
+       passprompt      The default prompt to use when asking for a password;
+                       can be overridden via the --pp option or the SUDO_PROMPT
+                       environment variable.  The following percent (`%')
+                       escapes are supported:
+
+                       %H  expanded to the local host name including the
+                           domain name (on if the machine's host name is fully
+                           qualified or the _f_q_d_n option is set)
+
+                       %h  expanded to the local host name without the domain
                            name
 
                        %p  expanded to the user whose password is being asked
@@ -1076,6 +1086,12 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
                        The default value is Password:.
 
+       role            The default SELinux role to use when constructing a new
+                       security context to run the command.  The default role
+                       may be overridden on a per-command basis in _s_u_d_o_e_r_s or
+                       via command line options.  This option is only
+                       available whe ssuuddoo is built with SELinux support.
+
        runas_default   The default user to run commands as if the --uu option is
                        not specified on the command line.  This defaults to
                        root.  Note that if _r_u_n_a_s___d_e_f_a_u_l_t is set it mmuusstt occur
@@ -1097,6 +1113,24 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        timestampowner  The owner of the timestamp directory and the timestamps
                        stored therein.  The default is root.
 
+       type            The default SELinux type to use when constructing a new
+
+
+
+1.7.3b3                   June 10, 2010                        17
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
+                       security context to run the command.  The default type
+                       may be overridden on a per-command basis in _s_u_d_o_e_r_s or
+                       via command line options.  This option is only
+                       available whe ssuuddoo is built with SELinux support.
+
        SSttrriinnggss tthhaatt ccaann bbee uusseedd iinn aa bboooolleeaann ccoonntteexxtt:
 
        askpass     The _a_s_k_p_a_s_s option specifies the fully qualified path to a
@@ -1114,18 +1148,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                    the program being run.  Entries in this file should either
                    be of the form VARIABLE=value or export VARIABLE=value.
                    The value may optionally be surrounded by single or double
-
-
-
-1.7.3b3                   June 10, 2010                        17
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
                    quotes.  Variables in this file are subject to other ssuuddoo
                    environment settings such as _e_n_v___k_e_e_p and _e_n_v___c_h_e_c_k.
 
@@ -1158,6 +1180,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
                    all     All the user's _s_u_d_o_e_r_s entries for the current host
                            must have the NOPASSWD flag set to avoid entering a
+
+
+
+1.7.3b3                   June 10, 2010                        18
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
                            password.
 
                    always  The user must always enter a password to use the --ll
@@ -1180,18 +1214,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        mailerflags Flags to use when invoking mailer. Defaults to --tt.
 
-
-
-
-1.7.3b3                   June 10, 2010                        18
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        mailerpath  Path to mail program used to send warning mail.  Defaults
                    to the path to sendmail found at configure time.
 
@@ -1213,7 +1235,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                    option is not set by default.
 
        syslog      Syslog facility if syslog is being used for logging (negate
-                   to disable syslog logging).  Defaults to authpriv.
+                   to disable syslog logging).  Defaults to local2.
 
        verifypw    This option controls when a password will be required when
                    a user runs ssuuddoo with the --vv option.  It has the following
@@ -1224,6 +1246,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                            password.
 
                    always  The user must always enter a password to use the --vv
+
+
+
+1.7.3b3                   June 10, 2010                        19
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
                            option.
 
                    any     At least one of the user's _s_u_d_o_e_r_s entries for the
@@ -1246,18 +1280,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        programs.  The argument may be a double-quoted, space-
                        separated list or a single value without double-quotes.
                        The list can be replaced, added to, deleted from, or
-
-
-
-1.7.3b3                   June 10, 2010                        19
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
                        disabled by using the =, +=, -=, and ! operators
                        respectively.  Regardless of whether the env_reset
                        option is enabled or disabled, variables specified by
@@ -1290,6 +1312,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        with the _-_V option.
 
        When logging via _s_y_s_l_o_g(3), ssuuddoo accepts the following values for the
+
+
+
+1.7.3b3                   June 10, 2010                        20
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        syslog facility (the value of the ssyysslloogg Parameter): aauutthhpprriivv (if your
        OS supports it), aauutthh, ddaaeemmoonn, uusseerr, llooccaall00, llooccaall11, llooccaall22, llooccaall33,
        llooccaall44, llooccaall55, llooccaall66, and llooccaall77.  The following syslog priorities
@@ -1309,21 +1343,6 @@ EEXXAAMMPPLLEESS
        Below are example _s_u_d_o_e_r_s entries.  Admittedly, some of these are a bit
        contrived.  First, we define our _a_l_i_a_s_e_s:
 
-
-
-
-
-
-
-1.7.3b3                   June 10, 2010                        20
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
         # User alias specification
         User_Alias     FULLTIMERS = millert, mikef, dowdy
         User_Alias     PARTTIMERS = bostley, jwfox, crawl
@@ -1359,6 +1378,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Cmnd_Alias     PAGERS = /usr/bin/more, /usr/bin/pg, /usr/bin/less
 
        Here we override some of the compiled in default values.  We want ssuuddoo
+
+
+
+1.7.3b3                   June 10, 2010                        21
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        to log via _s_y_s_l_o_g(3) using the _a_u_t_h facility in all cases.  We don't
        want to subject the full time staff to the ssuuddoo lecture, user mmiilllleerrtt
        need not give a password, and we don't want to reset the LOGNAME, USER
@@ -1378,18 +1409,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         Defaults!PAGERS        noexec
 
        The _U_s_e_r _s_p_e_c_i_f_i_c_a_t_i_o_n is the part that actually determines who may run
-
-
-
-1.7.3b3                   June 10, 2010                        21
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        what.
 
         root           ALL = (ALL) ALL
@@ -1425,6 +1444,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         operator       ALL = DUMPS, KILL, SHUTDOWN, HALT, REBOOT, PRINTING,\
                        sudoedit /etc/printcap, /usr/oper/bin/
 
+
+
+
+1.7.3b3                   June 10, 2010                        22
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        The ooppeerraattoorr user may run commands limited to simple maintenance.
        Here, those are commands related to backups, killing processes, the
        printing system, shutting down the system, and any commands in the
@@ -1445,17 +1476,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        the _H_P_P_A machines.  Note that this assumes _p_a_s_s_w_d(1) does not take
        multiple user names on the command line.
 
-
-
-1.7.3b3                   June 10, 2010                        22
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
         bob            SPARC = (OP) ALL : SGI = (OP) ALL
 
        The user bboobb may run anything on the _S_P_A_R_C and _S_G_I machines as any user
@@ -1490,6 +1510,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         jill           SERVERS = /usr/bin/, !SU, !SHELLS
 
        For any machine in the _S_E_R_V_E_R_S Host_Alias, jjiillll may run any commands in
+
+
+
+1.7.3b3                   June 10, 2010                        23
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        the directory _/_u_s_r_/_b_i_n_/ except for those commands belonging to the _S_U
        and _S_H_E_L_L_S Cmnd_Aliases.
 
@@ -1509,19 +1541,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        and wim), may run any command as user www (which owns the web pages) or
        simply _s_u(1) to www.
 
-
-
-
-
-1.7.3b3                   June 10, 2010                        23
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
         ALL            CDROM = NOPASSWD: /sbin/umount /CDROM,\
                        /sbin/mount -o nosuid\,nodev /dev/cd0a /CDROM
 
@@ -1557,6 +1576,18 @@ SSEECCUURRIITTYY NNOOTTEESS
              /usr/bin/chfn [a-zA-Z0-9]*, !/usr/bin/* root
 
        User jjoohhnn can still run /usr/bin/passwd root if _f_a_s_t___g_l_o_b is enabled by
+
+
+
+1.7.3b3                   June 10, 2010                        24
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        changing to _/_u_s_r_/_b_i_n and running ./passwd root instead.
 
 PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
@@ -1576,18 +1607,6 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
                  number of programs that offer shell escapes, restricting
                  users to the set of programs that do not if often unworkable.
 
-
-
-
-1.7.3b3                   June 10, 2010                        24
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        noexec    Many systems that support shared libraries have the ability
                  to override default library functions by pointing an
                  environment variable (usually LD_PRELOAD) to an alternate
@@ -1623,6 +1642,18 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                  documented in the User Specification section above.  Here is
                  that example again:
 
+
+
+
+1.7.3b3                   June 10, 2010                        25
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
                   aaron  shanty = NOEXEC: /usr/bin/more, /usr/bin/vi
 
                  This allows user aaaarroonn to run _/_u_s_r_/_b_i_n_/_m_o_r_e and _/_u_s_r_/_b_i_n_/_v_i
@@ -1642,18 +1673,6 @@ SSEEEE AALLSSOO
 
 CCAAVVEEAATTSS
        The _s_u_d_o_e_r_s file should aallwwaayyss be edited by the vviissuuddoo command which
-
-
-
-1.7.3b3                   June 10, 2010                        25
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        locks the file and does grammatical checking. It is imperative that
        _s_u_d_o_e_r_s be free of syntax errors since ssuuddoo will not run with a
        syntactically incorrect _s_u_d_o_e_r_s file.
@@ -1690,25 +1709,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 
 
 1.7.3b3                   June 10, 2010                        26
-- 
2.40.0