diff --git a/plugins/sudoers/po/sudoers.pot b/plugins/sudoers/po/sudoers.pot
index 3011982f4..90070d8bc 100644
--- a/plugins/sudoers/po/sudoers.pot
+++ b/plugins/sudoers/po/sudoers.pot
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sudo 1.9.9\n"
 "Report-Msgid-Bugs-To: https://bugzilla.sudo.ws\n"
-"POT-Creation-Date: 2021-12-08 10:19-0700\n"
+"POT-Creation-Date: 2022-01-18 16:50-0700\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -46,15 +46,15 @@ msgstr ""
 #: gram.y:520 gram.y:564 gram.y:573 gram.y:582 gram.y:591 gram.y:718 gram.y:726
 #: gram.y:737 gram.y:749 gram.y:768 gram.y:923 gram.y:928 gram.y:936 gram.y:950
 #: gram.y:956 gram.y:1078 gram.y:1087 gram.y:1095 gram.y:1104 gram.y:1113
-#: gram.y:1142 gram.y:1151 gram.y:1159 gram.y:1249 gram.y:1377 gram.y:1744
-#: gram.y:1794 lib/eventlog/eventlog.c:309 lib/eventlog/eventlog.c:382
+#: gram.y:1142 gram.y:1151 gram.y:1159 gram.y:1249 gram.y:1379 gram.y:1745
+#: gram.y:1795 lib/eventlog/eventlog.c:309 lib/eventlog/eventlog.c:382
 #: lib/eventlog/eventlog.c:804 lib/eventlog/eventlog.c:881
 #: lib/eventlog/eventlog.c:1176 lib/iolog/iolog_json.c:150
 #: lib/iolog/iolog_json.c:382 lib/iolog/iolog_json.c:412
 #: lib/iolog/iolog_json.c:555 lib/iolog/iolog_legacy.c:100
 #: lib/iolog/iolog_legacy.c:111 lib/iolog/iolog_legacy.c:123
 #: lib/iolog/iolog_legacy.c:133 lib/iolog/iolog_legacy.c:139
-#: lib/iolog/iolog_loginfo.c:76 lib/iolog/iolog_loginfo.c:211
+#: lib/iolog/iolog_loginfo.c:76 lib/iolog/iolog_loginfo.c:212
 #: logsrvd/iolog_writer.c:84 logsrvd/iolog_writer.c:89
 #: logsrvd/iolog_writer.c:123 logsrvd/iolog_writer.c:172
 #: logsrvd/iolog_writer.c:212 logsrvd/iolog_writer.c:225
@@ -78,18 +78,18 @@ msgstr ""
 #: logsrvd/logsrvd_relay.c:439 logsrvd/logsrvd_relay.c:738
 #: logsrvd/logsrvd_relay.c:843 logsrvd/sendlog.c:246 logsrvd/sendlog.c:255
 #: logsrvd/sendlog.c:333 logsrvd/sendlog.c:640 plugins/sudoers/audit.c:116
-#: plugins/sudoers/auth/bsdauth.c:147 plugins/sudoers/auth/kerb5.c:118
-#: plugins/sudoers/auth/kerb5.c:146 plugins/sudoers/auth/pam.c:689
+#: plugins/sudoers/auth/bsdauth.c:150 plugins/sudoers/auth/kerb5.c:118
+#: plugins/sudoers/auth/kerb5.c:146 plugins/sudoers/auth/pam.c:688
 #: plugins/sudoers/auth/rfc1938.c:111 plugins/sudoers/auth/sia.c:59
 #: plugins/sudoers/check_aliases.c:134 plugins/sudoers/cvtsudoers.c:131
 #: plugins/sudoers/cvtsudoers.c:175 plugins/sudoers/cvtsudoers.c:192
 #: plugins/sudoers/cvtsudoers.c:203 plugins/sudoers/cvtsudoers.c:333
 #: plugins/sudoers/cvtsudoers.c:372 plugins/sudoers/cvtsudoers.c:392
-#: plugins/sudoers/cvtsudoers.c:534 plugins/sudoers/cvtsudoers.c:667
-#: plugins/sudoers/cvtsudoers.c:685 plugins/sudoers/cvtsudoers.c:755
-#: plugins/sudoers/cvtsudoers.c:870 plugins/sudoers/cvtsudoers.c:878
-#: plugins/sudoers/cvtsudoers.c:1373 plugins/sudoers/cvtsudoers.c:1377
-#: plugins/sudoers/cvtsudoers.c:1479 plugins/sudoers/cvtsudoers_csv.c:183
+#: plugins/sudoers/cvtsudoers.c:537 plugins/sudoers/cvtsudoers.c:670
+#: plugins/sudoers/cvtsudoers.c:688 plugins/sudoers/cvtsudoers.c:758
+#: plugins/sudoers/cvtsudoers.c:873 plugins/sudoers/cvtsudoers.c:881
+#: plugins/sudoers/cvtsudoers.c:1376 plugins/sudoers/cvtsudoers.c:1380
+#: plugins/sudoers/cvtsudoers.c:1482 plugins/sudoers/cvtsudoers_csv.c:183
 #: plugins/sudoers/cvtsudoers_csv.c:246 plugins/sudoers/cvtsudoers_json.c:76
 #: plugins/sudoers/cvtsudoers_ldif.c:151 plugins/sudoers/cvtsudoers_ldif.c:194
 #: plugins/sudoers/cvtsudoers_ldif.c:235 plugins/sudoers/cvtsudoers_ldif.c:300
@@ -97,36 +97,39 @@ msgstr ""
 #: plugins/sudoers/cvtsudoers_ldif.c:438 plugins/sudoers/cvtsudoers_ldif.c:449
 #: plugins/sudoers/cvtsudoers_ldif.c:456 plugins/sudoers/cvtsudoers_ldif.c:469
 #: plugins/sudoers/cvtsudoers_ldif.c:477 plugins/sudoers/cvtsudoers_ldif.c:624
-#: plugins/sudoers/cvtsudoers_merge.c:246
-#: plugins/sudoers/cvtsudoers_merge.c:292
-#: plugins/sudoers/cvtsudoers_merge.c:339
-#: plugins/sudoers/cvtsudoers_merge.c:360
-#: plugins/sudoers/cvtsudoers_merge.c:446
-#: plugins/sudoers/cvtsudoers_merge.c:457
-#: plugins/sudoers/cvtsudoers_merge.c:526
-#: plugins/sudoers/cvtsudoers_merge.c:696
-#: plugins/sudoers/cvtsudoers_merge.c:704
-#: plugins/sudoers/cvtsudoers_merge.c:927
-#: plugins/sudoers/cvtsudoers_merge.c:962 plugins/sudoers/defaults.c:665
-#: plugins/sudoers/defaults.c:1019 plugins/sudoers/defaults.c:1206
+#: plugins/sudoers/cvtsudoers_merge.c:274
+#: plugins/sudoers/cvtsudoers_merge.c:337
+#: plugins/sudoers/cvtsudoers_merge.c:383
+#: plugins/sudoers/cvtsudoers_merge.c:430
+#: plugins/sudoers/cvtsudoers_merge.c:451
+#: plugins/sudoers/cvtsudoers_merge.c:537
+#: plugins/sudoers/cvtsudoers_merge.c:548
+#: plugins/sudoers/cvtsudoers_merge.c:617
+#: plugins/sudoers/cvtsudoers_merge.c:822
+#: plugins/sudoers/cvtsudoers_merge.c:830
+#: plugins/sudoers/cvtsudoers_merge.c:1118
+#: plugins/sudoers/cvtsudoers_merge.c:1188
+#: plugins/sudoers/cvtsudoers_merge.c:1194
+#: plugins/sudoers/cvtsudoers_merge.c:1201 plugins/sudoers/defaults.c:665
+#: plugins/sudoers/defaults.c:1027 plugins/sudoers/defaults.c:1214
 #: plugins/sudoers/editor.c:190 plugins/sudoers/env.c:262
 #: plugins/sudoers/exptilde.c:92 plugins/sudoers/filedigest.c:54
 #: plugins/sudoers/filedigest.c:70 plugins/sudoers/gc.c:57
 #: plugins/sudoers/group_plugin.c:133 plugins/sudoers/interfaces.c:68
 #: plugins/sudoers/iolog.c:609 plugins/sudoers/iolog.c:635
-#: plugins/sudoers/ldap.c:184 plugins/sudoers/ldap.c:422
-#: plugins/sudoers/ldap.c:432 plugins/sudoers/ldap.c:437
-#: plugins/sudoers/ldap.c:441 plugins/sudoers/ldap.c:453
-#: plugins/sudoers/ldap.c:749 plugins/sudoers/ldap.c:913
-#: plugins/sudoers/ldap.c:1286 plugins/sudoers/ldap.c:1712
-#: plugins/sudoers/ldap.c:1749 plugins/sudoers/ldap.c:1830
-#: plugins/sudoers/ldap.c:1965 plugins/sudoers/ldap.c:2066
-#: plugins/sudoers/ldap.c:2082 plugins/sudoers/ldap_conf.c:218
+#: plugins/sudoers/ldap.c:184 plugins/sudoers/ldap.c:433
+#: plugins/sudoers/ldap.c:443 plugins/sudoers/ldap.c:448
+#: plugins/sudoers/ldap.c:452 plugins/sudoers/ldap.c:464
+#: plugins/sudoers/ldap.c:760 plugins/sudoers/ldap.c:924
+#: plugins/sudoers/ldap.c:1340 plugins/sudoers/ldap.c:1766
+#: plugins/sudoers/ldap.c:1803 plugins/sudoers/ldap.c:1884
+#: plugins/sudoers/ldap.c:2019 plugins/sudoers/ldap.c:2120
+#: plugins/sudoers/ldap.c:2136 plugins/sudoers/ldap_conf.c:218
 #: plugins/sudoers/ldap_conf.c:249 plugins/sudoers/ldap_conf.c:301
-#: plugins/sudoers/ldap_conf.c:337 plugins/sudoers/ldap_conf.c:441
-#: plugins/sudoers/ldap_conf.c:456 plugins/sudoers/ldap_conf.c:553
-#: plugins/sudoers/ldap_conf.c:586 plugins/sudoers/ldap_conf.c:678
-#: plugins/sudoers/ldap_conf.c:760 plugins/sudoers/ldap_util.c:293
+#: plugins/sudoers/ldap_conf.c:337 plugins/sudoers/ldap_conf.c:443
+#: plugins/sudoers/ldap_conf.c:458 plugins/sudoers/ldap_conf.c:563
+#: plugins/sudoers/ldap_conf.c:596 plugins/sudoers/ldap_conf.c:688
+#: plugins/sudoers/ldap_conf.c:770 plugins/sudoers/ldap_util.c:293
 #: plugins/sudoers/ldap_util.c:300 plugins/sudoers/ldap_util.c:613
 #: plugins/sudoers/linux_audit.c:86 plugins/sudoers/log_client.c:112
 #: plugins/sudoers/log_client.c:390 plugins/sudoers/log_client.c:703
@@ -151,16 +154,16 @@ msgstr ""
 #: plugins/sudoers/parse_ldif.c:627 plugins/sudoers/parse_ldif.c:652
 #: plugins/sudoers/parse_ldif.c:710 plugins/sudoers/parse_ldif.c:727
 #: plugins/sudoers/parse_ldif.c:755 plugins/sudoers/parse_ldif.c:762
-#: plugins/sudoers/policy.c:564 plugins/sudoers/policy.c:978
+#: plugins/sudoers/policy.c:570 plugins/sudoers/policy.c:981
 #: plugins/sudoers/prompt.c:93 plugins/sudoers/pwutil.c:199
 #: plugins/sudoers/pwutil.c:270 plugins/sudoers/pwutil.c:348
 #: plugins/sudoers/pwutil.c:522 plugins/sudoers/pwutil.c:587
 #: plugins/sudoers/pwutil.c:659 plugins/sudoers/pwutil.c:857
 #: plugins/sudoers/pwutil.c:913 plugins/sudoers/pwutil.c:957
 #: plugins/sudoers/pwutil.c:1014 plugins/sudoers/sssd.c:145
-#: plugins/sudoers/sssd.c:407 plugins/sudoers/sssd.c:470
-#: plugins/sudoers/sssd.c:514 plugins/sudoers/sssd.c:558
-#: plugins/sudoers/sssd.c:751 plugins/sudoers/strvec_join.c:53
+#: plugins/sudoers/sssd.c:410 plugins/sudoers/sssd.c:473
+#: plugins/sudoers/sssd.c:517 plugins/sudoers/sssd.c:561
+#: plugins/sudoers/sssd.c:754 plugins/sudoers/strvec_join.c:53
 #: plugins/sudoers/stubs.c:111 plugins/sudoers/stubs.c:119
 #: plugins/sudoers/sudoers.c:335 plugins/sudoers/sudoers.c:361
 #: plugins/sudoers/sudoers.c:429 plugins/sudoers/sudoers.c:438
@@ -238,7 +241,7 @@ msgstr ""
 msgid "Alias \"%s\" already defined"
 msgstr ""
 
-#: gram.y:1744 gram.y:1794 lib/eventlog/eventlog.c:309
+#: gram.y:1745 gram.y:1795 lib/eventlog/eventlog.c:309
 #: lib/eventlog/eventlog.c:804 lib/eventlog/eventlog.c:877
 #: lib/eventlog/eventlog.c:880 lib/eventlog/eventlog.c:1176
 #: lib/iolog/iolog_json.c:150 lib/iolog/iolog_json.c:381
@@ -246,7 +249,7 @@ msgstr ""
 #: lib/iolog/iolog_legacy.c:100 lib/iolog/iolog_legacy.c:111
 #: lib/iolog/iolog_legacy.c:123 lib/iolog/iolog_legacy.c:133
 #: lib/iolog/iolog_legacy.c:139 lib/iolog/iolog_loginfo.c:76
-#: lib/iolog/iolog_loginfo.c:211 logsrvd/iolog_writer.c:84
+#: lib/iolog/iolog_loginfo.c:212 logsrvd/iolog_writer.c:84
 #: logsrvd/iolog_writer.c:89 logsrvd/iolog_writer.c:123
 #: logsrvd/iolog_writer.c:162 logsrvd/iolog_writer.c:171
 #: logsrvd/iolog_writer.c:189 logsrvd/iolog_writer.c:211
@@ -273,15 +276,15 @@ msgstr ""
 #: logsrvd/sendlog.c:333 logsrvd/sendlog.c:640 logsrvd/sendlog.c:1526
 #: logsrvd/sendlog.c:1533 logsrvd/sendlog.c:1756 logsrvd/tls_init.c:293
 #: logsrvd/tls_init.c:314 logsrvd/tls_init.c:324 plugins/sudoers/audit.c:116
-#: plugins/sudoers/auth/pam.c:503 plugins/sudoers/auth/pam.c:689
+#: plugins/sudoers/auth/pam.c:502 plugins/sudoers/auth/pam.c:688
 #: plugins/sudoers/auth/rfc1938.c:111 plugins/sudoers/check_aliases.c:134
 #: plugins/sudoers/cvtsudoers.c:131 plugins/sudoers/cvtsudoers.c:174
 #: plugins/sudoers/cvtsudoers.c:191 plugins/sudoers/cvtsudoers.c:202
-#: plugins/sudoers/cvtsudoers.c:332 plugins/sudoers/cvtsudoers.c:533
-#: plugins/sudoers/cvtsudoers.c:666 plugins/sudoers/cvtsudoers.c:684
-#: plugins/sudoers/cvtsudoers.c:755 plugins/sudoers/cvtsudoers.c:870
-#: plugins/sudoers/cvtsudoers.c:877 plugins/sudoers/cvtsudoers.c:1373
-#: plugins/sudoers/cvtsudoers.c:1377 plugins/sudoers/cvtsudoers.c:1479
+#: plugins/sudoers/cvtsudoers.c:332 plugins/sudoers/cvtsudoers.c:536
+#: plugins/sudoers/cvtsudoers.c:669 plugins/sudoers/cvtsudoers.c:687
+#: plugins/sudoers/cvtsudoers.c:758 plugins/sudoers/cvtsudoers.c:873
+#: plugins/sudoers/cvtsudoers.c:880 plugins/sudoers/cvtsudoers.c:1376
+#: plugins/sudoers/cvtsudoers.c:1380 plugins/sudoers/cvtsudoers.c:1482
 #: plugins/sudoers/cvtsudoers_csv.c:182 plugins/sudoers/cvtsudoers_csv.c:245
 #: plugins/sudoers/cvtsudoers_json.c:75 plugins/sudoers/cvtsudoers_ldif.c:150
 #: plugins/sudoers/cvtsudoers_ldif.c:193 plugins/sudoers/cvtsudoers_ldif.c:234
@@ -289,38 +292,41 @@ msgstr ""
 #: plugins/sudoers/cvtsudoers_ldif.c:429 plugins/sudoers/cvtsudoers_ldif.c:437
 #: plugins/sudoers/cvtsudoers_ldif.c:448 plugins/sudoers/cvtsudoers_ldif.c:455
 #: plugins/sudoers/cvtsudoers_ldif.c:468 plugins/sudoers/cvtsudoers_ldif.c:476
-#: plugins/sudoers/cvtsudoers_ldif.c:623 plugins/sudoers/cvtsudoers_merge.c:246
-#: plugins/sudoers/cvtsudoers_merge.c:292
-#: plugins/sudoers/cvtsudoers_merge.c:338
-#: plugins/sudoers/cvtsudoers_merge.c:359
-#: plugins/sudoers/cvtsudoers_merge.c:446
-#: plugins/sudoers/cvtsudoers_merge.c:454
-#: plugins/sudoers/cvtsudoers_merge.c:457
-#: plugins/sudoers/cvtsudoers_merge.c:523
-#: plugins/sudoers/cvtsudoers_merge.c:526
-#: plugins/sudoers/cvtsudoers_merge.c:695
-#: plugins/sudoers/cvtsudoers_merge.c:703
-#: plugins/sudoers/cvtsudoers_merge.c:926
-#: plugins/sudoers/cvtsudoers_merge.c:962 plugins/sudoers/defaults.c:665
-#: plugins/sudoers/defaults.c:1019 plugins/sudoers/defaults.c:1206
+#: plugins/sudoers/cvtsudoers_ldif.c:623 plugins/sudoers/cvtsudoers_merge.c:273
+#: plugins/sudoers/cvtsudoers_merge.c:337
+#: plugins/sudoers/cvtsudoers_merge.c:383
+#: plugins/sudoers/cvtsudoers_merge.c:429
+#: plugins/sudoers/cvtsudoers_merge.c:450
+#: plugins/sudoers/cvtsudoers_merge.c:537
+#: plugins/sudoers/cvtsudoers_merge.c:545
+#: plugins/sudoers/cvtsudoers_merge.c:548
+#: plugins/sudoers/cvtsudoers_merge.c:614
+#: plugins/sudoers/cvtsudoers_merge.c:617
+#: plugins/sudoers/cvtsudoers_merge.c:821
+#: plugins/sudoers/cvtsudoers_merge.c:829
+#: plugins/sudoers/cvtsudoers_merge.c:1117
+#: plugins/sudoers/cvtsudoers_merge.c:1187
+#: plugins/sudoers/cvtsudoers_merge.c:1193
+#: plugins/sudoers/cvtsudoers_merge.c:1201 plugins/sudoers/defaults.c:665
+#: plugins/sudoers/defaults.c:1027 plugins/sudoers/defaults.c:1214
 #: plugins/sudoers/editor.c:190 plugins/sudoers/env.c:262
 #: plugins/sudoers/exptilde.c:92 plugins/sudoers/filedigest.c:54
 #: plugins/sudoers/filedigest.c:70 plugins/sudoers/gc.c:57
 #: plugins/sudoers/group_plugin.c:132 plugins/sudoers/interfaces.c:68
 #: plugins/sudoers/iolog.c:609 plugins/sudoers/iolog.c:635
-#: plugins/sudoers/ldap.c:184 plugins/sudoers/ldap.c:422
-#: plugins/sudoers/ldap.c:432 plugins/sudoers/ldap.c:437
-#: plugins/sudoers/ldap.c:441 plugins/sudoers/ldap.c:453
-#: plugins/sudoers/ldap.c:749 plugins/sudoers/ldap.c:913
-#: plugins/sudoers/ldap.c:1286 plugins/sudoers/ldap.c:1712
-#: plugins/sudoers/ldap.c:1749 plugins/sudoers/ldap.c:1830
-#: plugins/sudoers/ldap.c:1965 plugins/sudoers/ldap.c:2066
-#: plugins/sudoers/ldap.c:2082 plugins/sudoers/ldap_conf.c:218
+#: plugins/sudoers/ldap.c:184 plugins/sudoers/ldap.c:433
+#: plugins/sudoers/ldap.c:443 plugins/sudoers/ldap.c:448
+#: plugins/sudoers/ldap.c:452 plugins/sudoers/ldap.c:464
+#: plugins/sudoers/ldap.c:760 plugins/sudoers/ldap.c:924
+#: plugins/sudoers/ldap.c:1340 plugins/sudoers/ldap.c:1766
+#: plugins/sudoers/ldap.c:1803 plugins/sudoers/ldap.c:1884
+#: plugins/sudoers/ldap.c:2019 plugins/sudoers/ldap.c:2120
+#: plugins/sudoers/ldap.c:2136 plugins/sudoers/ldap_conf.c:218
 #: plugins/sudoers/ldap_conf.c:249 plugins/sudoers/ldap_conf.c:301
-#: plugins/sudoers/ldap_conf.c:337 plugins/sudoers/ldap_conf.c:441
-#: plugins/sudoers/ldap_conf.c:456 plugins/sudoers/ldap_conf.c:553
-#: plugins/sudoers/ldap_conf.c:586 plugins/sudoers/ldap_conf.c:677
-#: plugins/sudoers/ldap_conf.c:760 plugins/sudoers/ldap_util.c:292
+#: plugins/sudoers/ldap_conf.c:337 plugins/sudoers/ldap_conf.c:443
+#: plugins/sudoers/ldap_conf.c:458 plugins/sudoers/ldap_conf.c:563
+#: plugins/sudoers/ldap_conf.c:596 plugins/sudoers/ldap_conf.c:687
+#: plugins/sudoers/ldap_conf.c:770 plugins/sudoers/ldap_util.c:292
 #: plugins/sudoers/ldap_util.c:299 plugins/sudoers/ldap_util.c:613
 #: plugins/sudoers/linux_audit.c:86 plugins/sudoers/log_client.c:112
 #: plugins/sudoers/log_client.c:221 plugins/sudoers/log_client.c:242
@@ -350,11 +356,11 @@ msgstr ""
 #: plugins/sudoers/policy.c:152 plugins/sudoers/policy.c:161
 #: plugins/sudoers/policy.c:170 plugins/sudoers/policy.c:197
 #: plugins/sudoers/policy.c:338 plugins/sudoers/policy.c:353
-#: plugins/sudoers/policy.c:355 plugins/sudoers/policy.c:385
-#: plugins/sudoers/policy.c:394 plugins/sudoers/policy.c:442
-#: plugins/sudoers/policy.c:452 plugins/sudoers/policy.c:461
-#: plugins/sudoers/policy.c:470 plugins/sudoers/policy.c:564
-#: plugins/sudoers/policy.c:978 plugins/sudoers/prompt.c:93
+#: plugins/sudoers/policy.c:355 plugins/sudoers/policy.c:391
+#: plugins/sudoers/policy.c:400 plugins/sudoers/policy.c:448
+#: plugins/sudoers/policy.c:458 plugins/sudoers/policy.c:467
+#: plugins/sudoers/policy.c:476 plugins/sudoers/policy.c:570
+#: plugins/sudoers/policy.c:981 plugins/sudoers/prompt.c:93
 #: plugins/sudoers/pwutil.c:199 plugins/sudoers/pwutil.c:270
 #: plugins/sudoers/pwutil.c:348 plugins/sudoers/pwutil.c:522
 #: plugins/sudoers/pwutil.c:587 plugins/sudoers/pwutil.c:659
@@ -363,9 +369,9 @@ msgstr ""
 #: plugins/sudoers/set_perms.c:363 plugins/sudoers/set_perms.c:706
 #: plugins/sudoers/set_perms.c:1073 plugins/sudoers/set_perms.c:1380
 #: plugins/sudoers/set_perms.c:1549 plugins/sudoers/sssd.c:144
-#: plugins/sudoers/sssd.c:407 plugins/sudoers/sssd.c:470
-#: plugins/sudoers/sssd.c:514 plugins/sudoers/sssd.c:558
-#: plugins/sudoers/sssd.c:751 plugins/sudoers/strvec_join.c:53
+#: plugins/sudoers/sssd.c:410 plugins/sudoers/sssd.c:473
+#: plugins/sudoers/sssd.c:517 plugins/sudoers/sssd.c:561
+#: plugins/sudoers/sssd.c:754 plugins/sudoers/strvec_join.c:53
 #: plugins/sudoers/stubs.c:111 plugins/sudoers/stubs.c:119
 #: plugins/sudoers/sudoers.c:335 plugins/sudoers/sudoers.c:361
 #: plugins/sudoers/sudoers.c:429 plugins/sudoers/sudoers.c:438
@@ -395,11 +401,11 @@ msgstr ""
 #: plugins/sudoers/cvtsudoers_ldif.c:244 plugins/sudoers/cvtsudoers_ldif.c:251
 #: plugins/sudoers/cvtsudoers_ldif.c:580 plugins/sudoers/env.c:326
 #: plugins/sudoers/env.c:333 plugins/sudoers/env.c:444
-#: plugins/sudoers/ldap.c:520 plugins/sudoers/ldap.c:753
-#: plugins/sudoers/ldap.c:1086 plugins/sudoers/ldap_conf.c:222
+#: plugins/sudoers/ldap.c:531 plugins/sudoers/ldap.c:764
+#: plugins/sudoers/ldap.c:1137 plugins/sudoers/ldap_conf.c:222
 #: plugins/sudoers/ldap_conf.c:312 plugins/sudoers/ldap_util.c:485
-#: plugins/sudoers/linux_audit.c:92 plugins/sudoers/policy.c:594
-#: plugins/sudoers/policy.c:763 plugins/sudoers/policy.c:774
+#: plugins/sudoers/linux_audit.c:92 plugins/sudoers/policy.c:600
+#: plugins/sudoers/policy.c:769 plugins/sudoers/policy.c:780
 #: plugins/sudoers/prompt.c:168 plugins/sudoers/strvec_join.c:62
 #: plugins/sudoers/testsudoers.c:245 plugins/sudoers/toke_util.c:206 toke.l:908
 #: toke.l:1110
@@ -573,7 +579,7 @@ msgid "invalid timing file line: %s"
 msgstr ""
 
 #: logsrvd/iolog_writer.c:130 plugins/sudoers/logging.c:803
-#: plugins/sudoers/policy.c:544
+#: plugins/sudoers/policy.c:550
 msgid "unable to generate UUID"
 msgstr ""
 
@@ -644,8 +650,8 @@ msgstr ""
 
 #: logsrvd/iolog_writer.c:811 logsrvd/logsrvd_journal.c:420
 #: logsrvd/logsrvd_queue.c:110 logsrvd/tls_init.c:245
-#: plugins/sudoers/check.c:274 plugins/sudoers/cvtsudoers.c:727
-#: plugins/sudoers/cvtsudoers.c:748 plugins/sudoers/cvtsudoers.c:1439
+#: plugins/sudoers/check.c:267 plugins/sudoers/cvtsudoers.c:730
+#: plugins/sudoers/cvtsudoers.c:751 plugins/sudoers/cvtsudoers.c:1442
 #: plugins/sudoers/cvtsudoers_csv.c:681 plugins/sudoers/cvtsudoers_json.c:885
 #: plugins/sudoers/cvtsudoers_ldif.c:697 plugins/sudoers/sudoers.c:1092
 #: plugins/sudoers/sudoreplay.c:1466 plugins/sudoers/timestamp.c:433
@@ -815,7 +821,7 @@ msgstr ""
 msgid "Unable to attach user data to the ssl object: %s"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1596 logsrvd/logsrvd.c:1949
+#: logsrvd/logsrvd.c:1596 logsrvd/logsrvd.c:1948
 msgid "unable to setup listen socket"
 msgstr ""
 
@@ -824,53 +830,53 @@ msgstr ""
 msgid "unexpected signal %d"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1851
+#: logsrvd/logsrvd.c:1850
 msgid "sudo log server"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1853 logsrvd/sendlog.c:116
+#: logsrvd/logsrvd.c:1852 logsrvd/sendlog.c:116
 msgid "Options:"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1855
+#: logsrvd/logsrvd.c:1854
 msgid "path to configuration file"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1857 logsrvd/sendlog.c:118
+#: logsrvd/logsrvd.c:1856 logsrvd/sendlog.c:118
 msgid "display help message and exit"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1859
+#: logsrvd/logsrvd.c:1858
 msgid "do not fork, run in the foreground"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1861
+#: logsrvd/logsrvd.c:1860
 msgid "percent chance connections will drop"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1863 logsrvd/sendlog.c:148
+#: logsrvd/logsrvd.c:1862 logsrvd/sendlog.c:148
 msgid "display version information and exit"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1913 logsrvd/sendlog.c:1725
+#: logsrvd/logsrvd.c:1912 logsrvd/sendlog.c:1725
 msgid "Protobuf-C version 1.3 or higher required"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1929
+#: logsrvd/logsrvd.c:1928
 #, c-format
 msgid "invalid random drop value: %s"
 msgstr ""
 
-#: logsrvd/logsrvd.c:1932 logsrvd/sendlog.c:1779
+#: logsrvd/logsrvd.c:1931 logsrvd/sendlog.c:1779
 #: plugins/sudoers/cvtsudoers.c:246 plugins/sudoers/sudoreplay.c:301
 #: plugins/sudoers/visudo.c:177
 #, c-format
 msgid "%s version %s\n"
 msgstr ""
 
-#: logsrvd/logsrvd_conf.c:390 plugins/sudoers/check.c:336
+#: logsrvd/logsrvd_conf.c:390 plugins/sudoers/check.c:329
 #: plugins/sudoers/exptilde.c:85 plugins/sudoers/iolog.c:118
-#: plugins/sudoers/policy.c:1214 plugins/sudoers/sudoers.c:486
+#: plugins/sudoers/policy.c:1217 plugins/sudoers/sudoers.c:486
 #: plugins/sudoers/sudoers.c:1347 plugins/sudoers/testsudoers.c:215
 #: plugins/sudoers/testsudoers.c:382
 #, c-format
@@ -1333,7 +1339,7 @@ msgstr ""
 msgid "unable to get time of day"
 msgstr ""
 
-#: plugins/sudoers/auth/aix_auth.c:277
+#: plugins/sudoers/auth/aix_auth.c:280
 #, c-format
 msgid "unable to change password for %s"
 msgstr ""
@@ -1355,28 +1361,28 @@ msgstr ""
 msgid "unable to initialize BSD authentication"
 msgstr ""
 
-#: plugins/sudoers/auth/bsdauth.c:183
+#: plugins/sudoers/auth/bsdauth.c:186
 msgid "your account has expired"
 msgstr ""
 
-#: plugins/sudoers/auth/bsdauth.c:185
+#: plugins/sudoers/auth/bsdauth.c:188
 msgid "approval failed"
 msgstr ""
 
-#: plugins/sudoers/auth/fwtk.c:58
+#: plugins/sudoers/auth/fwtk.c:61
 msgid "unable to read fwtk config"
 msgstr ""
 
-#: plugins/sudoers/auth/fwtk.c:63
+#: plugins/sudoers/auth/fwtk.c:66
 msgid "unable to connect to authentication server"
 msgstr ""
 
-#: plugins/sudoers/auth/fwtk.c:69 plugins/sudoers/auth/fwtk.c:94
-#: plugins/sudoers/auth/fwtk.c:126
+#: plugins/sudoers/auth/fwtk.c:72 plugins/sudoers/auth/fwtk.c:97
+#: plugins/sudoers/auth/fwtk.c:129
 msgid "lost connection to authentication server"
 msgstr ""
 
-#: plugins/sudoers/auth/fwtk.c:73
+#: plugins/sudoers/auth/fwtk.c:76
 #, c-format
 msgid ""
 "authentication server error:\n"
@@ -1428,40 +1434,40 @@ msgstr ""
 msgid "%s: Cannot verify TGT! Possible attack!: %s"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:216
+#: plugins/sudoers/auth/pam.c:224
 #, c-format
 msgid "unable to initialize PAM: %s"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:338
+#: plugins/sudoers/auth/pam.c:337
 #, c-format
 msgid "PAM authentication error: %s"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:357
+#: plugins/sudoers/auth/pam.c:356
 msgid "account validation failure, is your account locked?"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:368
+#: plugins/sudoers/auth/pam.c:367
 msgid "Account or password is expired, reset your password and try again"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:374
+#: plugins/sudoers/auth/pam.c:373
 #, c-format
 msgid "unable to change expired password: %s"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:385
+#: plugins/sudoers/auth/pam.c:384
 msgid "Password expired, contact your system administrator"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:390
+#: plugins/sudoers/auth/pam.c:389
 msgid ""
 "Account expired or PAM config lacks an \"account\" section for sudo, contact "
 "your system administrator"
 msgstr ""
 
-#: plugins/sudoers/auth/pam.c:398 plugins/sudoers/auth/pam.c:403
+#: plugins/sudoers/auth/pam.c:397 plugins/sudoers/auth/pam.c:402
 #, c-format
 msgid "PAM account management error: %s"
 msgstr ""
@@ -1471,67 +1477,67 @@ msgstr ""
 msgid "you do not exist in the %s database"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:72
+#: plugins/sudoers/auth/securid5.c:75
 msgid "failed to initialise the ACE API library"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:103
+#: plugins/sudoers/auth/securid5.c:106
 msgid "unable to contact the SecurID server"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:112
+#: plugins/sudoers/auth/securid5.c:115
 msgid "User ID locked for SecurID Authentication"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:116 plugins/sudoers/auth/securid5.c:167
+#: plugins/sudoers/auth/securid5.c:119 plugins/sudoers/auth/securid5.c:170
 msgid "invalid username length for SecurID"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:120 plugins/sudoers/auth/securid5.c:172
+#: plugins/sudoers/auth/securid5.c:123 plugins/sudoers/auth/securid5.c:175
 msgid "invalid Authentication Handle for SecurID"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:124
+#: plugins/sudoers/auth/securid5.c:127
 msgid "SecurID communication failed"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:128 plugins/sudoers/auth/securid5.c:215
+#: plugins/sudoers/auth/securid5.c:131 plugins/sudoers/auth/securid5.c:218
 msgid "unknown SecurID error"
 msgstr ""
 
-#: plugins/sudoers/auth/securid5.c:162
+#: plugins/sudoers/auth/securid5.c:165
 msgid "invalid passcode length for SecurID"
 msgstr ""
 
-#: plugins/sudoers/auth/sia.c:69 plugins/sudoers/auth/sia.c:123
+#: plugins/sudoers/auth/sia.c:69 plugins/sudoers/auth/sia.c:126
 msgid "unable to initialize SIA session"
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:132
+#: plugins/sudoers/auth/sudo_auth.c:134
 msgid "invalid authentication methods"
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:134
+#: plugins/sudoers/auth/sudo_auth.c:136
 msgid ""
 "Invalid authentication methods compiled into sudo!  You may not mix "
 "standalone and non-standalone authentication."
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:255 plugins/sudoers/auth/sudo_auth.c:305
+#: plugins/sudoers/auth/sudo_auth.c:257 plugins/sudoers/auth/sudo_auth.c:309
 msgid "no authentication methods"
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:257
+#: plugins/sudoers/auth/sudo_auth.c:259
 msgid ""
 "There are no authentication methods compiled into sudo!  If you want to turn "
 "off authentication, use the --disable-authentication configure option."
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:307
+#: plugins/sudoers/auth/sudo_auth.c:311
 msgid "Unable to initialize authentication methods."
 msgstr ""
 
-#: plugins/sudoers/auth/sudo_auth.c:471
+#: plugins/sudoers/auth/sudo_auth.c:482
 msgid "Authentication methods:"
 msgstr ""
 
@@ -1543,17 +1549,17 @@ msgstr ""
 msgid "unable to commit audit record"
 msgstr ""
 
-#: plugins/sudoers/check.c:264
+#: plugins/sudoers/check.c:257
 #, c-format
 msgid "error reading lecture file %s"
 msgstr ""
 
-#: plugins/sudoers/check.c:270
+#: plugins/sudoers/check.c:263
 #, c-format
 msgid "ignoring lecture file %s: not a regular file"
 msgstr ""
 
-#: plugins/sudoers/check.c:283
+#: plugins/sudoers/check.c:276
 msgid ""
 "\n"
 "We trust you have received the usual lecture from the local System\n"
@@ -1565,7 +1571,7 @@ msgid ""
 "\n"
 msgstr ""
 
-#: plugins/sudoers/check.c:331 plugins/sudoers/check.c:341
+#: plugins/sudoers/check.c:324 plugins/sudoers/check.c:334
 #: plugins/sudoers/sudoers.c:885 plugins/sudoers/sudoers.c:906
 #: plugins/sudoers/tsdump.c:119
 #, c-format
@@ -1634,60 +1640,60 @@ msgstr ""
 msgid "unable to initialize sudoers default values"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:522 plugins/sudoers/ldap_conf.c:431
+#: plugins/sudoers/cvtsudoers.c:525 plugins/sudoers/ldap_conf.c:433
 #, c-format
 msgid "%s: %s: %s: %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:581
+#: plugins/sudoers/cvtsudoers.c:584
 #, c-format
 msgid "%s: unknown key word %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:627
+#: plugins/sudoers/cvtsudoers.c:630
 #, c-format
 msgid "invalid defaults type: %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:650
+#: plugins/sudoers/cvtsudoers.c:653
 #, c-format
 msgid "invalid suppression type: %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:691 plugins/sudoers/cvtsudoers.c:707
+#: plugins/sudoers/cvtsudoers.c:694 plugins/sudoers/cvtsudoers.c:710
 #, c-format
 msgid "invalid filter: %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:751 plugins/sudoers/visudo.c:958
+#: plugins/sudoers/cvtsudoers.c:754 plugins/sudoers/visudo.c:958
 #, c-format
 msgid "failed to parse %s file, unknown error"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:759
+#: plugins/sudoers/cvtsudoers.c:762
 #, c-format
 msgid "parse error in %s near line %d\n"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:762
+#: plugins/sudoers/cvtsudoers.c:765
 #, c-format
 msgid "parse error in %s\n"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:1486 plugins/sudoers/sudoreplay.c:1145
+#: plugins/sudoers/cvtsudoers.c:1489 plugins/sudoers/sudoreplay.c:1145
 #: plugins/sudoers/timestamp.c:317 plugins/sudoers/timestamp.c:320
 #, c-format
 msgid "unable to write to %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:1509
+#: plugins/sudoers/cvtsudoers.c:1512
 #, c-format
 msgid ""
 "%s - convert between sudoers file formats\n"
 "\n"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers.c:1511
+#: plugins/sudoers/cvtsudoers.c:1514
 msgid ""
 "\n"
 "Options:\n"
@@ -1712,14 +1718,14 @@ msgstr ""
 #: plugins/sudoers/cvtsudoers_csv.c:452 plugins/sudoers/cvtsudoers_csv.c:466
 #: plugins/sudoers/cvtsudoers_json.c:654 plugins/sudoers/cvtsudoers_json.c:669
 #: plugins/sudoers/cvtsudoers_ldif.c:347 plugins/sudoers/cvtsudoers_ldif.c:360
-#: plugins/sudoers/ldap.c:504
+#: plugins/sudoers/ldap.c:515
 msgid "unable to get GMT time"
 msgstr ""
 
 #: plugins/sudoers/cvtsudoers_csv.c:457 plugins/sudoers/cvtsudoers_csv.c:471
 #: plugins/sudoers/cvtsudoers_json.c:659 plugins/sudoers/cvtsudoers_json.c:674
 #: plugins/sudoers/cvtsudoers_ldif.c:352 plugins/sudoers/cvtsudoers_ldif.c:365
-#: plugins/sudoers/ldap.c:512
+#: plugins/sudoers/ldap.c:523
 msgid "unable to format timestamp"
 msgstr ""
 
@@ -1740,42 +1746,53 @@ msgid ""
 "specified."
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:438
+#: plugins/sudoers/cvtsudoers_merge.c:252
+#: plugins/sudoers/cvtsudoers_merge.c:293
+#, c-format
+msgid "%s:%d:%d: converting host list to ALL"
+msgstr ""
+
+#: plugins/sudoers/cvtsudoers_merge.c:529
 #, c-format
 msgid "unable to find alias %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:441
+#: plugins/sudoers/cvtsudoers_merge.c:532
 #, c-format
 msgid "%s:%d:%d: renaming alias %s to %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:498
+#: plugins/sudoers/cvtsudoers_merge.c:589
 #, c-format
 msgid "%s:%d:%d: removing duplicate alias %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:658
+#: plugins/sudoers/cvtsudoers_merge.c:787
 #, c-format
 msgid "%s:%d:%d: conflicting Defaults entry \"%s\" host-specific in %s:%d:%d"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:698
+#: plugins/sudoers/cvtsudoers_merge.c:824
 #, c-format
 msgid "%s:%d:%d: made Defaults \"%s\" specific to host %s"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:718
-#, c-format
-msgid "%s:%d:%d: removing Defaults \"%s\" overridden by subsequent entries"
-msgstr ""
-
-#: plugins/sudoers/cvtsudoers_merge.c:723
+#: plugins/sudoers/cvtsudoers_merge.c:850
 #, c-format
 msgid "%s:%d:%d: unable to make Defaults \"%s\" host-specific"
 msgstr ""
 
-#: plugins/sudoers/cvtsudoers_merge.c:943
+#: plugins/sudoers/cvtsudoers_merge.c:860
+#, c-format
+msgid "%s:%d:%d: removing Defaults \"%s\" overridden by subsequent entries"
+msgstr ""
+
+#: plugins/sudoers/cvtsudoers_merge.c:1048
+#, c-format
+msgid "%s:%d:%d: merging userspec into %s:%d:%d"
+msgstr ""
+
+#: plugins/sudoers/cvtsudoers_merge.c:1142
 #, c-format
 msgid "%s:%d:%d: removing userspec overridden by subsequent entries"
 msgstr ""
@@ -2176,283 +2193,288 @@ msgid "PAM service name to use for login shells: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:402
-msgid "Attempt to establish PAM credentials for the target user"
+#, c-format
+msgid "PAM service name to use when sudo is run with the -A option: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:406
-msgid "Create a new PAM session for the command to run in"
+msgid "Attempt to establish PAM credentials for the target user"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:410
-msgid "Perform PAM account validation management"
+msgid "Create a new PAM session for the command to run in"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:414
+msgid "Perform PAM account validation management"
+msgstr ""
+
+#: plugins/sudoers/def_data.c:418
 #, c-format
 msgid "Maximum I/O log sequence number: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:418
+#: plugins/sudoers/def_data.c:422
 msgid "Enable sudoers netgroup support"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:422
+#: plugins/sudoers/def_data.c:426
 msgid ""
 "Check parent directories for writability when editing files with sudoedit"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:426
+#: plugins/sudoers/def_data.c:430
 msgid "Follow symbolic links when editing files with sudoedit"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:430
+#: plugins/sudoers/def_data.c:434
 msgid "Query the group plugin for unknown system groups"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:434
+#: plugins/sudoers/def_data.c:438
 msgid "Match netgroups based on the entire tuple: user, host and domain"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:438
+#: plugins/sudoers/def_data.c:442
 msgid "Allow commands to be run even if sudo cannot write to the audit log"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:442
+#: plugins/sudoers/def_data.c:446
 msgid "Allow commands to be run even if sudo cannot write to the I/O log"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:446
+#: plugins/sudoers/def_data.c:450
 msgid "Allow commands to be run even if sudo cannot write to the log file"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:450
+#: plugins/sudoers/def_data.c:454
 msgid "Resolve groups in sudoers and match on the group ID, not the name"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:454
+#: plugins/sudoers/def_data.c:458
 #, c-format
 msgid ""
 "Log entries larger than this value will be split into multiple syslog "
 "messages: %u"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:458
+#: plugins/sudoers/def_data.c:462
 #, c-format
 msgid "User that will own the I/O log files: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:462
+#: plugins/sudoers/def_data.c:466
 #, c-format
 msgid "Group that will own the I/O log files: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:466
+#: plugins/sudoers/def_data.c:470
 #, c-format
 msgid "File mode to use for the I/O log files: 0%o"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:470
+#: plugins/sudoers/def_data.c:474
 #, c-format
 msgid "Execute commands by file descriptor instead of by path: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:474
+#: plugins/sudoers/def_data.c:478
 msgid ""
 "Ignore unknown Defaults entries in sudoers instead of producing a warning"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:478
+#: plugins/sudoers/def_data.c:482
 #, c-format
 msgid "Time in seconds after which the command will be terminated: %u"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:482
+#: plugins/sudoers/def_data.c:486
 msgid "Allow the user to specify a timeout on the command line"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:486
+#: plugins/sudoers/def_data.c:490
 msgid "Flush I/O log data to disk immediately instead of buffering it"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:490
-msgid "Include the process ID when logging via syslog"
-msgstr ""
-
 #: plugins/sudoers/def_data.c:494
-#, c-format
-msgid "Type of authentication timestamp record: %s"
+msgid "Include the process ID when logging via syslog"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:498
 #, c-format
-msgid "Authentication failure message: %s"
+msgid "Type of authentication timestamp record: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:502
-msgid "Ignore case when matching user names"
+#, c-format
+msgid "Authentication failure message: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:506
-msgid "Ignore case when matching group names"
+msgid "Ignore case when matching user names"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:510
-msgid "Log when a command is allowed by sudoers"
+msgid "Ignore case when matching group names"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:514
-msgid "Log when a command is denied by sudoers"
+msgid "Log when a command is allowed by sudoers"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:518
-msgid "Sudo log server(s) to connect to with optional port"
+msgid "Log when a command is denied by sudoers"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:522
+msgid "Sudo log server(s) to connect to with optional port"
+msgstr ""
+
+#: plugins/sudoers/def_data.c:526
 #, c-format
 msgid "Sudo log server timeout in seconds: %u"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:526
+#: plugins/sudoers/def_data.c:530
 msgid ""
 "Enable SO_KEEPALIVE socket option on the socket connected to the logserver"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:530
+#: plugins/sudoers/def_data.c:534
 #, c-format
 msgid "Path to the audit server's CA bundle file: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:534
+#: plugins/sudoers/def_data.c:538
 #, c-format
 msgid "Path to the sudoers certificate file: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:538
+#: plugins/sudoers/def_data.c:542
 #, c-format
 msgid "Path to the sudoers private key file: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:542
+#: plugins/sudoers/def_data.c:546
 msgid "Verify that the log server's certificate is valid"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:546
+#: plugins/sudoers/def_data.c:550
 msgid "Allow the use of unknown runas user and/or group ID"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:550
+#: plugins/sudoers/def_data.c:554
 msgid "Only permit running commands as a user with a valid shell"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:554
+#: plugins/sudoers/def_data.c:558
 msgid "Set the pam remote user to the user running sudo"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:558
-msgid "Set the pam remote host to the local host name"
-msgstr ""
-
 #: plugins/sudoers/def_data.c:562
-#, c-format
-msgid "Working directory to change to before executing the command: %s"
+msgid "Set the pam remote host to the local host name"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:566
 #, c-format
-msgid "Root directory to change to before executing the command: %s"
+msgid "Working directory to change to before executing the command: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:570
 #, c-format
-msgid "The format of logs to produce: %s"
+msgid "Root directory to change to before executing the command: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:574
-msgid "Enable SELinux RBAC support"
+#, c-format
+msgid "The format of logs to produce: %s"
 msgstr ""
 
 #: plugins/sudoers/def_data.c:578
+msgid "Enable SELinux RBAC support"
+msgstr ""
+
+#: plugins/sudoers/def_data.c:582
 #, c-format
 msgid "Path to the file that is created the first time sudo is run: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:582
+#: plugins/sudoers/def_data.c:586
 msgid "Intercept further commands and apply sudoers restrictions to them"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:586
+#: plugins/sudoers/def_data.c:590
 msgid "Log sub-commands run by the original command"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:590
+#: plugins/sudoers/def_data.c:594
 msgid "Log the exit status of commands"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:594
+#: plugins/sudoers/def_data.c:598
 msgid "Subsequent commands in an intercepted session must be authenticated"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:598
+#: plugins/sudoers/def_data.c:602
 msgid "Allow an intercepted command to run set setuid or setgid programs"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:602
+#: plugins/sudoers/def_data.c:606
 #, c-format
 msgid ""
 "The maximum size to which the process's address space may grow (in bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:606
+#: plugins/sudoers/def_data.c:610
 #, c-format
 msgid "The largest size core dump file that may be created (in bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:610
+#: plugins/sudoers/def_data.c:614
 #, c-format
 msgid ""
 "The maximum amount of CPU time that the process may use (in seconds): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:614
+#: plugins/sudoers/def_data.c:618
 #, c-format
 msgid "The maximum size of the data segment for the process (in bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:618
+#: plugins/sudoers/def_data.c:622
 #, c-format
 msgid "The largest size file that the process may create (in bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:622
+#: plugins/sudoers/def_data.c:626
 #, c-format
 msgid "The maximum number of locks that the process may establish: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:626
+#: plugins/sudoers/def_data.c:630
 #, c-format
 msgid "The maximum size that the process may lock in memory (in bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:630
+#: plugins/sudoers/def_data.c:634
 #, c-format
 msgid "The maximum number of files that the process may have open: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:634
+#: plugins/sudoers/def_data.c:638
 #, c-format
 msgid ""
 "The maximum number of processes that the user may run simultaneously: %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:638
+#: plugins/sudoers/def_data.c:642
 #, c-format
 msgid ""
 "The maximum size to which the process's resident set size may grow (in "
 "bytes): %s"
 msgstr ""
 
-#: plugins/sudoers/def_data.c:642
+#: plugins/sudoers/def_data.c:646
 #, c-format
 msgid "The maximum size to which the process's stack may grow (in bytes): %s"
 msgstr ""
@@ -2512,32 +2534,32 @@ msgstr ""
 msgid "%s: value \"%s\" is invalid for option \"%s\""
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1124
+#: plugins/sudoers/defaults.c:1132
 #, c-format
 msgid "%s:%d:%d: path name for \"%s\" too long"
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1127
+#: plugins/sudoers/defaults.c:1135
 #, c-format
 msgid "%s: path name for \"%s\" too long"
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1138
+#: plugins/sudoers/defaults.c:1146
 #, c-format
 msgid "%s:%d:%d: values for \"%s\" must start with a '/', '~', or '*'"
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1142
+#: plugins/sudoers/defaults.c:1150
 #, c-format
 msgid "%s: values for \"%s\" must start with a '/', '~', or '*'"
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1153
+#: plugins/sudoers/defaults.c:1161
 #, c-format
 msgid "%s:%d:%d: values for \"%s\" must start with a '/'"
 msgstr ""
 
-#: plugins/sudoers/defaults.c:1157
+#: plugins/sudoers/defaults.c:1165
 #, c-format
 msgid "%s: values for \"%s\" must start with a '/'"
 msgstr ""
@@ -2586,7 +2608,7 @@ msgstr ""
 msgid "%s must only be writable by owner"
 msgstr ""
 
-#: plugins/sudoers/group_plugin.c:96 plugins/sudoers/sssd.c:566
+#: plugins/sudoers/group_plugin.c:96 plugins/sudoers/sssd.c:569
 #, c-format
 msgid "unable to load %s: %s"
 msgstr ""
@@ -2664,18 +2686,18 @@ msgstr ""
 msgid "you must set TLS_CERT in %s to use SSL"
 msgstr ""
 
-#: plugins/sudoers/ldap.c:1663
+#: plugins/sudoers/ldap.c:1717
 #, c-format
 msgid "unable to initialize LDAP: %s"
 msgstr ""
 
-#: plugins/sudoers/ldap.c:1700
+#: plugins/sudoers/ldap.c:1754
 msgid ""
 "start_tls specified but LDAP libs do not support ldap_start_tls_s() or "
 "ldap_start_tls_s_np()"
 msgstr ""
 
-#: plugins/sudoers/ldap.c:1837 plugins/sudoers/parse_ldif.c:747
+#: plugins/sudoers/ldap.c:1891 plugins/sudoers/parse_ldif.c:747
 #, c-format
 msgid "invalid sudoOrder attribute: %s"
 msgstr ""
@@ -2932,82 +2954,82 @@ msgstr ""
 msgid "unable to parse network address list"
 msgstr ""
 
-#: plugins/sudoers/policy.c:479
+#: plugins/sudoers/policy.c:485
 msgid "user name not set by sudo front-end"
 msgstr ""
 
-#: plugins/sudoers/policy.c:483
+#: plugins/sudoers/policy.c:489
 msgid "user-ID not set by sudo front-end"
 msgstr ""
 
-#: plugins/sudoers/policy.c:487
+#: plugins/sudoers/policy.c:493
 msgid "group-ID not set by sudo front-end"
 msgstr ""
 
-#: plugins/sudoers/policy.c:491
+#: plugins/sudoers/policy.c:497
 msgid "host name not set by sudo front-end"
 msgstr ""
 
-#: plugins/sudoers/policy.c:693
+#: plugins/sudoers/policy.c:699
 #, c-format
 msgid "invalid working directory: %s"
 msgstr ""
 
-#: plugins/sudoers/policy.c:869
+#: plugins/sudoers/policy.c:875
 #, c-format
 msgid "invalid chroot directory: %s"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1051 plugins/sudoers/visudo.c:243
+#: plugins/sudoers/policy.c:1054 plugins/sudoers/visudo.c:243
 #: plugins/sudoers/visudo.c:880
 #, c-format
 msgid "unable to execute %s"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1121 plugins/sudoers/policy.c:1158
-#: plugins/sudoers/policy.c:1180 plugins/sudoers/policy.c:1206
+#: plugins/sudoers/policy.c:1124 plugins/sudoers/policy.c:1161
+#: plugins/sudoers/policy.c:1183 plugins/sudoers/policy.c:1209
 #, c-format
 msgid "%s: invalid mode flags from sudo front end: 0x%x"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1237
+#: plugins/sudoers/policy.c:1240
 #, c-format
 msgid "Sudoers policy plugin version %s\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1239
+#: plugins/sudoers/policy.c:1242
 #, c-format
 msgid "Sudoers file grammar version %d\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1243
+#: plugins/sudoers/policy.c:1246
 #, c-format
 msgid ""
 "\n"
 "Sudoers path: %s\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1246
+#: plugins/sudoers/policy.c:1249
 #, c-format
 msgid "nsswitch path: %s\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1248
+#: plugins/sudoers/policy.c:1251
 #, c-format
 msgid "ldap.conf path: %s\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1249
+#: plugins/sudoers/policy.c:1252
 #, c-format
 msgid "ldap.secret path: %s\n"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1282
+#: plugins/sudoers/policy.c:1285
 #, c-format
 msgid "unable to register hook of type %d (version %d.%d)"
 msgstr ""
 
-#: plugins/sudoers/policy.c:1300
+#: plugins/sudoers/policy.c:1303
 #, c-format
 msgid "unable to deregister hook of type %d (version %d.%d)"
 msgstr ""
@@ -3135,13 +3157,13 @@ msgstr ""
 msgid "truncated audit path argv[0]: %s"
 msgstr ""
 
-#: plugins/sudoers/sssd.c:569
+#: plugins/sudoers/sssd.c:572
 msgid "unable to initialize SSS source. Is SSSD installed on your machine?"
 msgstr ""
 
-#: plugins/sudoers/sssd.c:577 plugins/sudoers/sssd.c:586
-#: plugins/sudoers/sssd.c:595 plugins/sudoers/sssd.c:604
-#: plugins/sudoers/sssd.c:613
+#: plugins/sudoers/sssd.c:580 plugins/sudoers/sssd.c:589
+#: plugins/sudoers/sssd.c:598 plugins/sudoers/sssd.c:607
+#: plugins/sudoers/sssd.c:616
 #, c-format
 msgid "unable to find symbol \"%s\" in %s"
 msgstr ""
diff --git a/po/sudo.pot b/po/sudo.pot
index 8e2ba32af..c2d5d4b7f 100644
--- a/po/sudo.pot
+++ b/po/sudo.pot
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sudo 1.9.9\n"
 "Report-Msgid-Bugs-To: https://bugzilla.sudo.ws\n"
-"POT-Creation-Date: 2021-12-08 10:19-0700\n"
+"POT-Creation-Date: 2022-01-18 16:50-0700\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -49,15 +49,15 @@ msgstr ""
 #: src/exec_pty.c:1296 src/exec_pty.c:1303 src/exec_pty.c:1311
 #: src/exec_pty.c:1774 src/load_plugins.c:156 src/load_plugins.c:181
 #: src/load_plugins.c:217 src/load_plugins.c:449 src/load_plugins.c:455
-#: src/parse_args.c:190 src/parse_args.c:211 src/parse_args.c:285
-#: src/parse_args.c:630 src/parse_args.c:652 src/parse_args.c:677
+#: src/parse_args.c:192 src/parse_args.c:213 src/parse_args.c:287
+#: src/parse_args.c:632 src/parse_args.c:654 src/parse_args.c:679
 #: src/preserve_fds.c:46 src/preserve_fds.c:131 src/selinux.c:89
-#: src/selinux.c:369 src/selinux.c:489 src/selinux.c:498 src/sesh.c:113
+#: src/selinux.c:362 src/selinux.c:474 src/selinux.c:483 src/sesh.c:113
 #: src/sesh.c:146 src/sesh.c:152 src/sesh.c:159 src/sesh.c:165 src/sesh.c:410
-#: src/sudo.c:636 src/sudo.c:706 src/sudo.c:716 src/sudo.c:741 src/sudo.c:764
-#: src/sudo.c:773 src/sudo.c:782 src/sudo.c:799 src/sudo.c:849 src/sudo.c:859
-#: src/sudo.c:888 src/sudo.c:1087 src/sudo.c:1108 src/sudo.c:1401
-#: src/sudo.c:1570 src/sudo.c:1797 src/sudo.c:2131 src/sudo_edit.c:89
+#: src/sudo.c:639 src/sudo.c:709 src/sudo.c:719 src/sudo.c:744 src/sudo.c:767
+#: src/sudo.c:776 src/sudo.c:785 src/sudo.c:802 src/sudo.c:844 src/sudo.c:854
+#: src/sudo.c:883 src/sudo.c:1083 src/sudo.c:1104 src/sudo.c:1397
+#: src/sudo.c:1566 src/sudo.c:1793 src/sudo.c:2127 src/sudo_edit.c:89
 #: src/sudo_edit.c:149 src/sudo_edit.c:429 src/sudo_edit.c:438
 #: src/sudo_edit.c:539 src/sudo_edit.c:546 src/sudo_edit.c:677
 #: src/sudo_edit.c:697 src/sudo_intercept_common.c:113
@@ -88,38 +88,44 @@ msgstr ""
 #: src/exec_pty.c:1289 src/exec_pty.c:1296 src/exec_pty.c:1303
 #: src/exec_pty.c:1311 src/exec_pty.c:1774 src/load_plugins.c:156
 #: src/load_plugins.c:181 src/load_plugins.c:217 src/load_plugins.c:449
-#: src/load_plugins.c:455 src/parse_args.c:190 src/parse_args.c:212
-#: src/parse_args.c:285 src/parse_args.c:630 src/parse_args.c:652
-#: src/parse_args.c:677 src/preserve_fds.c:46 src/preserve_fds.c:131
-#: src/selinux.c:89 src/selinux.c:369 src/selinux.c:489 src/selinux.c:498
-#: src/sesh.c:113 src/sesh.c:411 src/sudo.c:227 src/sudo.c:636 src/sudo.c:888
-#: src/sudo.c:1087 src/sudo.c:1108 src/sudo.c:1401 src/sudo.c:1570
-#: src/sudo.c:1797 src/sudo.c:2131 src/sudo_edit.c:89 src/sudo_edit.c:149
+#: src/load_plugins.c:455 src/parse_args.c:192 src/parse_args.c:214
+#: src/parse_args.c:287 src/parse_args.c:632 src/parse_args.c:654
+#: src/parse_args.c:679 src/preserve_fds.c:46 src/preserve_fds.c:131
+#: src/selinux.c:89 src/selinux.c:362 src/selinux.c:474 src/selinux.c:483
+#: src/sesh.c:113 src/sesh.c:411 src/sudo.c:230 src/sudo.c:639 src/sudo.c:883
+#: src/sudo.c:1083 src/sudo.c:1104 src/sudo.c:1397 src/sudo.c:1566
+#: src/sudo.c:1793 src/sudo.c:2127 src/sudo_edit.c:89 src/sudo_edit.c:149
 #: src/sudo_edit.c:429 src/sudo_edit.c:438 src/sudo_edit.c:539
 #: src/sudo_edit.c:546 src/sudo_edit.c:677 src/sudo_edit.c:697
 #: src/sudo_intercept_common.c:113 src/sudo_intercept_common.c:317
 msgid "unable to allocate memory"
 msgstr ""
 
-#: lib/util/mkdir_parents.c:68 lib/util/sudo_conf.c:704 src/selinux.c:235
-#: src/selinux.c:265 src/sudo.c:368 src/sudo_edit.c:494 src/sudo_edit.c:559
+#: lib/util/mkdir_parents.c:63
+#, c-format
+msgid "unable to stat %.*s"
+msgstr ""
+
+#: lib/util/mkdir_parents.c:69
+#, c-format
+msgid "%.*s exists but is not a directory (0%o)"
+msgstr ""
+
+#: lib/util/mkdir_parents.c:102 lib/util/sudo_conf.c:704 src/selinux.c:235
+#: src/selinux.c:265 src/sudo.c:371 src/sudo_edit.c:494 src/sudo_edit.c:559
 #, c-format
 msgid "unable to open %s"
 msgstr ""
 
-#: lib/util/mkdir_parents.c:83
+#: lib/util/mkdir_parents.c:119 lib/util/mkdir_parents.c:127
+#: lib/util/mkdir_parents.c:136
 #, c-format
-msgid "unable to mkdir %s"
+msgid "unable to open %.*s"
 msgstr ""
 
-#: lib/util/mkdir_parents.c:92 lib/util/sudo_conf.c:681 src/copy_file.c:150
+#: lib/util/mkdir_parents.c:157
 #, c-format
-msgid "unable to stat %s"
-msgstr ""
-
-#: lib/util/mkdir_parents.c:97
-#, c-format
-msgid "%s exists but is not a directory (0%o)"
+msgid "unable to mkdir %.*s"
 msgstr ""
 
 #: lib/util/strsignal.c:50
@@ -159,6 +165,11 @@ msgstr ""
 msgid "invalid max groups \"%s\" in %s, line %u"
 msgstr ""
 
+#: lib/util/sudo_conf.c:681 src/copy_file.c:150
+#, c-format
+msgid "unable to stat %s"
+msgstr ""
+
 #: lib/util/sudo_conf.c:684
 #, c-format
 msgid "%s is not a regular file"
@@ -281,12 +292,12 @@ msgstr ""
 msgid "invalid PolicyCheckRequest"
 msgstr ""
 
-#: src/exec_intercept.c:362 src/sudo.c:1213 src/sudo.c:1258 src/sudo.c:1302
+#: src/exec_intercept.c:362 src/sudo.c:1209 src/sudo.c:1254 src/sudo.c:1298
 msgid "command rejected by policy"
 msgstr ""
 
-#: src/exec_intercept.c:455 src/sudo.c:1218 src/sudo.c:1263 src/sudo.c:1307
-#: src/sudo.c:1381
+#: src/exec_intercept.c:455 src/sudo.c:1214 src/sudo.c:1259 src/sudo.c:1303
+#: src/sudo.c:1377
 msgid "policy plugin error"
 msgstr ""
 
@@ -336,7 +347,7 @@ msgstr ""
 msgid "unable to restore tty label"
 msgstr ""
 
-#: src/exec_monitor.c:637 src/sesh.c:123 src/sudo.c:1164
+#: src/exec_monitor.c:637 src/sesh.c:123 src/sudo.c:1160
 #, c-format
 msgid "unable to execute %s"
 msgstr ""
@@ -441,200 +452,200 @@ msgid "policy plugin %s does not include a check_policy method"
 msgstr ""
 
 #: src/net_ifs.c:210 src/net_ifs.c:376 src/net_ifs.c:437 src/net_ifs.c:624
-#: src/net_ifs.c:855 src/sudo.c:483 src/sudo_edit.c:398 src/sudo_edit.c:406
+#: src/net_ifs.c:855 src/sudo.c:486 src/sudo_edit.c:398 src/sudo_edit.c:406
 #, c-format
 msgid "internal error, %s overflow"
 msgstr ""
 
-#: src/parse_args.c:232
+#: src/parse_args.c:234
 #, c-format
 msgid "invalid environment variable name: %s"
 msgstr ""
 
-#: src/parse_args.c:335
+#: src/parse_args.c:337
 msgid "the argument to -C must be a number greater than or equal to 3"
 msgstr ""
 
-#: src/parse_args.c:566
+#: src/parse_args.c:568
 msgid "you may not specify both the -i and -s options"
 msgstr ""
 
-#: src/parse_args.c:571
+#: src/parse_args.c:573
 msgid "you may not specify both the -i and -E options"
 msgstr ""
 
-#: src/parse_args.c:581
+#: src/parse_args.c:583
 msgid "the -E option is not valid in edit mode"
 msgstr ""
 
-#: src/parse_args.c:584
+#: src/parse_args.c:586
 msgid "you may not specify environment variables in edit mode"
 msgstr ""
 
-#: src/parse_args.c:594
+#: src/parse_args.c:596
 msgid "the -U option may only be used with the -l option"
 msgstr ""
 
-#: src/parse_args.c:598
+#: src/parse_args.c:600
 msgid "the -A and -S options may not be used together"
 msgstr ""
 
-#: src/parse_args.c:691
+#: src/parse_args.c:693
 msgid "sudoedit is not supported on this platform"
 msgstr ""
 
-#: src/parse_args.c:774
+#: src/parse_args.c:776
 msgid ""
 "Only one of the -e, -h, -i, -K, -l, -s, -v or -V options may be specified"
 msgstr ""
 
-#: src/parse_args.c:790
+#: src/parse_args.c:792
 #, c-format
 msgid ""
 "%s - edit files as another user\n"
 "\n"
 msgstr ""
 
-#: src/parse_args.c:792
+#: src/parse_args.c:794
 #, c-format
 msgid ""
 "%s - execute a command as another user\n"
 "\n"
 msgstr ""
 
-#: src/parse_args.c:798
+#: src/parse_args.c:800
 msgid ""
 "\n"
 "Options:\n"
 msgstr ""
 
-#: src/parse_args.c:800
+#: src/parse_args.c:802
 msgid "use a helper program for password prompting"
 msgstr ""
 
-#: src/parse_args.c:803
+#: src/parse_args.c:805
 msgid "use specified BSD authentication type"
 msgstr ""
 
-#: src/parse_args.c:807
+#: src/parse_args.c:809
 msgid "run command in the background"
 msgstr ""
 
-#: src/parse_args.c:810
+#: src/parse_args.c:812
 msgid "ring bell when prompting"
 msgstr ""
 
-#: src/parse_args.c:812
+#: src/parse_args.c:814
 msgid "close all file descriptors >= num"
 msgstr ""
 
-#: src/parse_args.c:815
+#: src/parse_args.c:817
 msgid "run command with the specified BSD login class"
 msgstr ""
 
-#: src/parse_args.c:818
+#: src/parse_args.c:820
 msgid "change the working directory before running command"
 msgstr ""
 
-#: src/parse_args.c:821
+#: src/parse_args.c:823
 msgid "preserve user environment when running command"
 msgstr ""
 
-#: src/parse_args.c:823
+#: src/parse_args.c:825
 msgid "preserve specific environment variables"
 msgstr ""
 
-#: src/parse_args.c:825
+#: src/parse_args.c:827
 msgid "edit files instead of running a command"
 msgstr ""
 
-#: src/parse_args.c:828
+#: src/parse_args.c:830
 msgid "run command as the specified group name or ID"
 msgstr ""
 
-#: src/parse_args.c:831
+#: src/parse_args.c:833
 msgid "set HOME variable to target user's home dir"
 msgstr ""
 
-#: src/parse_args.c:834
+#: src/parse_args.c:836
 msgid "display help message and exit"
 msgstr ""
 
-#: src/parse_args.c:836
+#: src/parse_args.c:838
 msgid "run command on host (if supported by plugin)"
 msgstr ""
 
-#: src/parse_args.c:839
+#: src/parse_args.c:841
 msgid "run login shell as the target user; a command may also be specified"
 msgstr ""
 
-#: src/parse_args.c:841
+#: src/parse_args.c:843
 msgid "remove timestamp file completely"
 msgstr ""
 
-#: src/parse_args.c:844
+#: src/parse_args.c:846
 msgid "invalidate timestamp file"
 msgstr ""
 
-#: src/parse_args.c:847
+#: src/parse_args.c:849
 msgid ""
 "list user's privileges or check a specific command; use twice for longer "
 "format"
 msgstr ""
 
-#: src/parse_args.c:850
+#: src/parse_args.c:852
 msgid "non-interactive mode, no prompts are used"
 msgstr ""
 
-#: src/parse_args.c:853
+#: src/parse_args.c:855
 msgid "preserve group vector instead of setting to target's"
 msgstr ""
 
-#: src/parse_args.c:856
+#: src/parse_args.c:858
 msgid "use the specified password prompt"
 msgstr ""
 
-#: src/parse_args.c:858
+#: src/parse_args.c:860
 msgid "change the root directory before running command"
 msgstr ""
 
-#: src/parse_args.c:861
+#: src/parse_args.c:863
 msgid "create SELinux security context with specified role"
 msgstr ""
 
-#: src/parse_args.c:864
+#: src/parse_args.c:866
 msgid "read password from standard input"
 msgstr ""
 
-#: src/parse_args.c:867
+#: src/parse_args.c:869
 msgid "run shell as the target user; a command may also be specified"
 msgstr ""
 
-#: src/parse_args.c:871
+#: src/parse_args.c:873
 msgid "create SELinux security context with specified type"
 msgstr ""
 
-#: src/parse_args.c:874
+#: src/parse_args.c:876
 msgid "terminate command after the specified time limit"
 msgstr ""
 
-#: src/parse_args.c:877
+#: src/parse_args.c:879
 msgid "in list mode, display privileges for user"
 msgstr ""
 
-#: src/parse_args.c:880
+#: src/parse_args.c:882
 msgid "run command (or edit file) as specified user name or ID"
 msgstr ""
 
-#: src/parse_args.c:882
+#: src/parse_args.c:884
 msgid "display version information and exit"
 msgstr ""
 
-#: src/parse_args.c:885
+#: src/parse_args.c:887
 msgid "update user's timestamp without running a command"
 msgstr ""
 
-#: src/parse_args.c:888
+#: src/parse_args.c:890
 msgid "stop processing command line arguments"
 msgstr ""
 
@@ -687,44 +698,49 @@ msgstr ""
 msgid "unable to set new tty context"
 msgstr ""
 
-#: src/selinux.c:327
-msgid "failed to get new context"
+#: src/selinux.c:323
+#, c-format
+msgid "you must specify a role for type %s"
 msgstr ""
 
-#: src/selinux.c:345
+#: src/selinux.c:329
 #, c-format
 msgid "unable to get default type for role %s"
 msgstr ""
 
-#: src/selinux.c:357
+#: src/selinux.c:341
+msgid "failed to get new context"
+msgstr ""
+
+#: src/selinux.c:350
 #, c-format
 msgid "failed to set new role %s"
 msgstr ""
 
-#: src/selinux.c:361
+#: src/selinux.c:354
 #, c-format
 msgid "failed to set new type %s"
 msgstr ""
 
-#: src/selinux.c:373
+#: src/selinux.c:366
 #, c-format
 msgid "%s is not a valid context"
 msgstr ""
 
-#: src/selinux.c:402
+#: src/selinux.c:394
 msgid "failed to get old context"
 msgstr ""
 
-#: src/selinux.c:408
+#: src/selinux.c:400
 msgid "unable to determine enforcing mode."
 msgstr ""
 
-#: src/selinux.c:440
+#: src/selinux.c:425
 #, c-format
 msgid "unable to set exec context to %s"
 msgstr ""
 
-#: src/selinux.c:447
+#: src/selinux.c:432
 #, c-format
 msgid "unable to set key creation context to %s"
 msgstr ""
@@ -811,141 +827,153 @@ msgstr ""
 msgid "warning, resource control assignment failed for project \"%s\""
 msgstr ""
 
-#: src/sudo.c:213
+#: src/sudo.c:216
 #, c-format
 msgid "Sudo version %s\n"
 msgstr ""
 
-#: src/sudo.c:215
+#: src/sudo.c:218
 #, c-format
 msgid "Configure options: %s\n"
 msgstr ""
 
-#: src/sudo.c:223
+#: src/sudo.c:226
 msgid "fatal error, unable to load plugins"
 msgstr ""
 
-#: src/sudo.c:269
+#: src/sudo.c:272
 msgid "plugin did not return a command to execute"
 msgstr ""
 
-#: src/sudo.c:302
+#: src/sudo.c:305
 #, c-format
 msgid "unexpected sudo mode 0x%x"
 msgstr ""
 
-#: src/sudo.c:550
+#: src/sudo.c:553
 #, c-format
 msgid "you do not exist in the %s database"
 msgstr ""
 
-#: src/sudo.c:607
+#: src/sudo.c:610
 msgid "unable to determine tty"
 msgstr ""
 
-#: src/sudo.c:948
+#: src/sudo.c:908
+msgid ""
+"The \"no new privileges\" flag is set, which prevents sudo from running as "
+"root."
+msgstr ""
+
+#: src/sudo.c:910
+msgid ""
+"If sudo is running in a container, you may need to adjust the container "
+"configuration to disable the flag."
+msgstr ""
+
+#: src/sudo.c:944
 #, c-format
 msgid "%s must be owned by uid %d and have the setuid bit set"
 msgstr ""
 
-#: src/sudo.c:951
+#: src/sudo.c:947
 #, c-format
 msgid ""
 "effective uid is not %d, is %s on a file system with the 'nosuid' option set "
 "or an NFS file system without root privileges?"
 msgstr ""
 
-#: src/sudo.c:957
+#: src/sudo.c:953
 #, c-format
 msgid "effective uid is not %d, is sudo installed setuid root?"
 msgstr ""
 
-#: src/sudo.c:973 src/tgetpass.c:333
+#: src/sudo.c:969 src/tgetpass.c:333
 msgid "unable to set supplementary group IDs"
 msgstr ""
 
-#: src/sudo.c:980
+#: src/sudo.c:976
 #, c-format
 msgid "unable to set effective gid to runas gid %u"
 msgstr ""
 
-#: src/sudo.c:986
+#: src/sudo.c:982
 #, c-format
 msgid "unable to set gid to runas gid %u"
 msgstr ""
 
-#: src/sudo.c:1029
+#: src/sudo.c:1025
 #, c-format
 msgid "unexpected child termination condition: %d"
 msgstr ""
 
-#: src/sudo.c:1136
+#: src/sudo.c:1132
 msgid "unable to initialize policy plugin"
 msgstr ""
 
-#: src/sudo.c:1198
+#: src/sudo.c:1194
 #, c-format
 msgid "policy plugin %s is missing the \"check_policy\" method"
 msgstr ""
 
-#: src/sudo.c:1244
+#: src/sudo.c:1240
 #, c-format
 msgid "policy plugin %s does not support listing privileges"
 msgstr ""
 
-#: src/sudo.c:1288
+#: src/sudo.c:1284
 #, c-format
 msgid "policy plugin %s does not support the -v option"
 msgstr ""
 
-#: src/sudo.c:1326
+#: src/sudo.c:1322
 #, c-format
 msgid "policy plugin %s does not support the -k/-K options"
 msgstr ""
 
-#: src/sudo.c:1455
+#: src/sudo.c:1451
 #, c-format
 msgid "error initializing I/O plugin %s"
 msgstr ""
 
-#: src/sudo.c:1458
+#: src/sudo.c:1454
 msgid "error initializing I/O plugin"
 msgstr ""
 
-#: src/sudo.c:1607
+#: src/sudo.c:1603
 #, c-format
 msgid "error initializing audit plugin %s"
 msgstr ""
 
-#: src/sudo.c:1686
+#: src/sudo.c:1682
 #, c-format
 msgid "%s: unable to log error event%s%s"
 msgstr ""
 
-#: src/sudo.c:1722
+#: src/sudo.c:1718
 #, c-format
 msgid "%s: unable to log accept event%s%s"
 msgstr ""
 
-#: src/sudo.c:1727 src/sudo.c:1765
+#: src/sudo.c:1723 src/sudo.c:1761
 msgid "audit plugin error"
 msgstr ""
 
-#: src/sudo.c:1760
+#: src/sudo.c:1756
 #, c-format
 msgid "%s: unable to log reject event%s%s"
 msgstr ""
 
-#: src/sudo.c:1820
+#: src/sudo.c:1816
 #, c-format
 msgid "error initializing approval plugin %s"
 msgstr ""
 
-#: src/sudo.c:1890
+#: src/sudo.c:1886
 msgid "command rejected by approver"
 msgstr ""
 
-#: src/sudo.c:1900
+#: src/sudo.c:1896
 msgid "approval plugin error"
 msgstr ""