From e007e2ad4dbdf8327d91b2451e5653373b46ce16 Mon Sep 17 00:00:00 2001
From: "Todd C. Miller" <Todd.Miller@courtesan.com>
Date: Sat, 19 Dec 2009 21:44:06 +0000
Subject: [PATCH] username -> user name groupname -> group name hostname ->
 host name

---
 sudo.cat            | 116 +++++++-------
 sudo.man.in         |  41 ++---
 sudo.pod            |  20 +--
 sudoers.cat         | 380 ++++++++++++++++++++++----------------------
 sudoers.ldap.cat    | 132 +++++++--------
 sudoers.ldap.man.in |  36 ++---
 sudoers.ldap.pod    |   4 +-
 sudoers.man.in      | 129 +++++++--------
 sudoers.pod         |  56 +++----
 sudoreplay.cat      |  14 +-
 sudoreplay.man.in   |   8 +-
 sudoreplay.pod      |   4 +-
 visudo.cat          |  10 +-
 visudo.man.in       |  18 +--
 visudo.pod          |   4 +-
 15 files changed, 475 insertions(+), 497 deletions(-)

diff --git a/sudo.cat b/sudo.cat
index a2f3bc153..1b33f2ce2 100644
--- a/sudo.cat
+++ b/sudo.cat
@@ -10,16 +10,18 @@ NNAAMMEE
 SSYYNNOOPPSSIISS
        ssuuddoo --hh | --KK | --kk | --LL | --VV
 
-       ssuuddoo --vv [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--pp _p_r_o_m_p_t]
+       ssuuddoo --vv [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t]
+       [--uu _u_s_e_r_n_a_m_e|_#_u_i_d]
 
-       ssuuddoo --ll[[ll]] [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t]
-       [--UU _u_s_e_r_n_a_m_e] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
+       ssuuddoo --ll[[ll]] [--AAkknnSS] [--aa _a_u_t_h___t_y_p_e] [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t]
+       [--UU _u_s_e_r _n_a_m_e] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [_c_o_m_m_a_n_d]
 
-       ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-] [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d]
-       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e] [--ii | --ss] [_c_o_m_m_a_n_d]
+       ssuuddoo [--AAbbEEHHnnPPSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
+       [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] [VVAARR=_v_a_l_u_e]
+       [--ii | --ss] [_c_o_m_m_a_n_d]
 
-       ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-] [--gg _g_r_o_u_p_n_a_m_e|_#_g_i_d]
-       [--pp _p_r_o_m_p_t] [--uu _u_s_e_r_n_a_m_e|_#_u_i_d] file ...
+       ssuuddooeeddiitt [--AAnnSS] [--aa _a_u_t_h___t_y_p_e] [--CC _f_d] [--cc _c_l_a_s_s|_-]
+       [--gg _g_r_o_u_p _n_a_m_e|_#_g_i_d] [--pp _p_r_o_m_p_t] [--uu _u_s_e_r _n_a_m_e|_#_u_i_d] file ...
 
 DDEESSCCRRIIPPTTIIOONN
        ssuuddoo allows a permitted user to execute a _c_o_m_m_a_n_d as the superuser or
@@ -56,12 +58,10 @@ DDEESSCCRRIIPPTTIIOONN
        has been invoked.  It also allows the --ee option to remain useful even
        when being run via a sudo-run script or program.  Note however, that
        the sudoers lookup is still done for root, not the user specified by
-       SUDO_USER.
 
 
 
-
-1.7.2                   September 24, 2009                      1
+1.7.3b2                 December 19, 2009                       1
 
 
 
@@ -70,6 +70,8 @@ DDEESSCCRRIIPPTTIIOONN
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       SUDO_USER.
+
        ssuuddoo can log both successful and unsuccessful attempts (as well as
        errors) to _s_y_s_l_o_g(3), a log file, or both.  By default ssuuddoo will log
        via _s_y_s_l_o_g(3) but this is changeable at configure time or via the
@@ -122,12 +124,10 @@ OOPPTTIIOONNSS
 
        -E          The --EE (_p_r_e_s_e_r_v_e _e_n_v_i_r_o_n_m_e_n_t) option will override the
                    _e_n_v___r_e_s_e_t option in _s_u_d_o_e_r_s(4)).  It is only available when
-                   either the matching command has the SETENV tag or the
-                   _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s(4).
 
 
 
-1.7.2                   September 24, 2009                      2
+1.7.3b2                 December 19, 2009                       2
 
 
 
@@ -136,6 +136,9 @@ OOPPTTIIOONNSS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+                   either the matching command has the SETENV tag or the
+                   _s_e_t_e_n_v option is set in _s_u_d_o_e_r_s(4).
+
        -e          The --ee (_e_d_i_t) option indicates that, instead of running a
                    command, the user wishes to edit one or more files.  In
                    lieu of a command, the string "sudoedit" is used when
@@ -187,13 +190,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    login shell.  This means that login-specific resource files
                    such as .profile or .login will be read by the shell.  If a
                    command is specified, it is passed to the shell for
-                   execution.  Otherwise, an interactive shell is executed.
-                   ssuuddoo attempts to change to that user's home directory
-                   before running the shell.  It also initializes the
 
 
 
-1.7.2                   September 24, 2009                      3
+1.7.3b2                 December 19, 2009                       3
 
 
 
@@ -202,6 +202,9 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+                   execution.  Otherwise, an interactive shell is executed.
+                   ssuuddoo attempts to change to that user's home directory
+                   before running the shell.  It also initializes the
                    environment, leaving _D_I_S_P_L_A_Y and _T_E_R_M unchanged, setting
                    _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_N_A_M_E, and _P_A_T_H, as well as the
                    contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t on Linux and AIX systems.  All
@@ -225,10 +228,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    prompt for a password (if one is required by _s_u_d_o_e_r_s) and
                    will not update the user's timestamp file.
 
-       -L          The --LL (_l_i_s_t defaults) option will list out the parameters
-                   that may be set in a _D_e_f_a_u_l_t_s line along with a short
-                   description for each.  This option is useful in conjunction
-                   with _g_r_e_p(1).
+       -L          The --LL (_l_i_s_t defaults) option will list the parameters that
+                   may be set in a _D_e_f_a_u_l_t_s line along with a short
+                   description for each.  This option will be removed from a
+                   future version of ssuuddoo.
 
        -l[l] [_c_o_m_m_a_n_d]
                    If no _c_o_m_m_a_n_d is specified, the --ll (_l_i_s_t) option will list
@@ -253,13 +256,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    of groups the target user is in.  The real and effective
                    group IDs, however, are still set to match the target user.
 
-       -p _p_r_o_m_p_t   The --pp (_p_r_o_m_p_t) option allows you to override the default
-                   password prompt and use a custom one.  The following
-                   percent (`%') escapes are supported:
 
 
 
-1.7.2                   September 24, 2009                      4
+1.7.3b2                 December 19, 2009                       4
 
 
 
@@ -268,11 +268,15 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
-                   %H  expanded to the local hostname including the domain
-                       name (on if the machine's hostname is fully qualified
+       -p _p_r_o_m_p_t   The --pp (_p_r_o_m_p_t) option allows you to override the default
+                   password prompt and use a custom one.  The following
+                   percent (`%') escapes are supported:
+
+                   %H  expanded to the local host name including the domain
+                       name (on if the machine's host name is fully qualified
                        or the _f_q_d_n _s_u_d_o_e_r_s option is set)
 
-                   %h  expanded to the local hostname without the domain name
+                   %h  expanded to the local host name without the domain name
 
                    %p  expanded to the user whose password is being asked for
                        (respects the _r_o_o_t_p_w, _t_a_r_g_e_t_p_w and _r_u_n_a_s_p_w flags in
@@ -318,14 +322,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
                    number and exit.  If the invoking user is already root the
                    --VV option will print out a list of the defaults ssuuddoo was
                    compiled with as well as the machine's local network
-                   addresses.
-
-       -v          If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
-                   user's timestamp, prompting for the user's password if
 
 
 
-1.7.2                   September 24, 2009                      5
+1.7.3b2                 December 19, 2009                       5
 
 
 
@@ -334,6 +334,10 @@ SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+                   addresses.
+
+       -v          If given the --vv (_v_a_l_i_d_a_t_e) option, ssuuddoo will update the
+                   user's timestamp, prompting for the user's password if
                    necessary.  This extends the ssuuddoo timeout for another 5
                    minutes (or whatever the timeout is set to in _s_u_d_o_e_r_s) but
                    does not run a command.
@@ -384,14 +388,10 @@ SSEECCUURRIITTYY NNOOTTEESS
        default _e_n_v___r_e_s_e_t behavior is encouraged.
 
        In all cases, environment variables with a value beginning with () are
-       removed as they could be interpreted as bbaasshh functions.  The list of
-       environment variables that ssuuddoo allows or denies is contained in the
-       output of sudo -V when run as root.
 
 
 
-
-1.7.2                   September 24, 2009                      6
+1.7.3b2                 December 19, 2009                       6
 
 
 
@@ -400,6 +400,10 @@ SSEECCUURRIITTYY NNOOTTEESS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       removed as they could be interpreted as bbaasshh functions.  The list of
+       environment variables that ssuuddoo allows or denies is contained in the
+       output of sudo -V when run as root.
+
        Note that the dynamic linker on most operating systems will remove
        variables that can control dynamic linking from the environment of
        setuid executables, including ssuuddoo.  Depending on the operating system
@@ -450,14 +454,10 @@ EENNVVIIRROONNMMEENNTT
        ssuuddoo utilizes the following environment variables:
 
        EDITOR          Default editor to use in --ee (sudoedit) mode if neither
-                       SUDO_EDITOR nor VISUAL is set
-
-       HOME            In --ss or --HH mode (or if sudo was configured with the
-                       --enable-shell-sets-home option), set to homedir of the
 
 
 
-1.7.2                   September 24, 2009                      7
+1.7.3b2                 December 19, 2009                       7
 
 
 
@@ -466,6 +466,10 @@ EENNVVIIRROONNMMEENNTT
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+                       SUDO_EDITOR nor VISUAL is set
+
+       HOME            In --ss or --HH mode (or if sudo was configured with the
+                       --enable-shell-sets-home option), set to homedir of the
                        target user
 
        PATH            Set to a sane value if the _s_e_c_u_r_e___p_a_t_h sudoers option
@@ -516,14 +520,10 @@ EEXXAAMMPPLLEESS
        To list the home directory of user yaz on a machine where the file
        system holding ~yaz is not exported as root:
 
-        $ sudo -u yaz ls ~yaz
-
-       To edit the _i_n_d_e_x_._h_t_m_l file as user www:
 
 
 
-
-1.7.2                   September 24, 2009                      8
+1.7.3b2                 December 19, 2009                       8
 
 
 
@@ -532,6 +532,10 @@ EEXXAAMMPPLLEESS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+        $ sudo -u yaz ls ~yaz
+
+       To edit the _i_n_d_e_x_._h_t_m_l file as user www:
+
         $ sudo -u www vi ~www/htdocs/index.html
 
        To view system logs only accessible to root and users in the adm group:
@@ -582,14 +586,10 @@ CCAAVVEEAATTSS
 
        If users have sudo ALL there is nothing to prevent them from creating
        their own program that gives them a root shell regardless of any '!'
-       elements in the user specification.
-
-       Running shell scripts via ssuuddoo can expose the same kernel bugs that
-       make setuid shell scripts unsafe on some operating systems (if your OS
 
 
 
-1.7.2                   September 24, 2009                      9
+1.7.3b2                 December 19, 2009                       9
 
 
 
@@ -598,6 +598,10 @@ CCAAVVEEAATTSS
 SUDO(1m)               MAINTENANCE COMMANDS              SUDO(1m)
 
 
+       elements in the user specification.
+
+       Running shell scripts via ssuuddoo can expose the same kernel bugs that
+       make setuid shell scripts unsafe on some operating systems (if your OS
        has a /dev/fd/ directory, setuid shell scripts are generally safe).
 
 BBUUGGSS
@@ -651,10 +655,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-
-
-
-
-1.7.2                   September 24, 2009                     10
+1.7.3b2                 December 19, 2009                      10
 
 
diff --git a/sudo.man.in b/sudo.man.in
index dbfca4727..4104157f7 100644
--- a/sudo.man.in
+++ b/sudo.man.in
@@ -19,18 +19,10 @@
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\" 
 .\" $Sudo$
-.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
+.\" Automatically generated by Pod::Man 2.22 (Pod::Simple 3.07)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
@@ -74,7 +66,7 @@
 .el       .ds Aq '
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .ie \nF \{\
@@ -153,7 +145,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDO @mansectsu@"
-.TH SUDO @mansectsu@ "September 24, 2009" "1.7.2" "MAINTENANCE COMMANDS"
+.TH SUDO @mansectsu@ "December 19, 2009" "1.7.3b2" "MAINTENANCE COMMANDS"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -166,28 +158,29 @@ sudo, sudoedit \- execute a command as another user
 .PP
 \&\fBsudo\fR \fB\-v\fR [\fB\-AknS\fR]
 @BAMAN@[\fB\-a\fR\ \fIauth_type\fR]
-[\fB\-p\fR\ \fIprompt\fR]
+[\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
+[\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
 .PP
 \&\fBsudo\fR \fB\-l[l]\fR [\fB\-AknS\fR]
 @BAMAN@[\fB\-a\fR\ \fIauth_type\fR]
-[\fB\-g\fR\ \fIgroupname\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
-[\fB\-U\fR\ \fIusername\fR] [\fB\-u\fR\ \fIusername\fR|\fI#uid\fR] [\fIcommand\fR]
+[\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
+[\fB\-U\fR\ \fIuser\ name\fR] [\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR] [\fIcommand\fR]
 .PP
 \&\fBsudo\fR [\fB\-AbEHnPS\fR]
 @BAMAN@[\fB\-a\fR\ \fIauth_type\fR]
 [\fB\-C\fR\ \fIfd\fR]
 @LCMAN@[\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
-[\fB\-g\fR\ \fIgroupname\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
+[\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
 @SEMAN@[\fB\-r\fR\ \fIrole\fR] [\fB\-t\fR\ \fItype\fR]
-[\fB\-u\fR\ \fIusername\fR|\fI#uid\fR]
+[\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR]
 [\fB\s-1VAR\s0\fR=\fIvalue\fR] [\fB\-i\fR\ |\ \fB\-s\fR] [\fIcommand\fR]
 .PP
 \&\fBsudoedit\fR [\fB\-AnS\fR]
 @BAMAN@[\fB\-a\fR\ \fIauth_type\fR]
 [\fB\-C\fR\ \fIfd\fR]
 @LCMAN@[\fB\-c\fR\ \fIclass\fR|\fI\-\fR]
-[\fB\-g\fR\ \fIgroupname\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
-[\fB\-u\fR\ \fIusername\fR|\fI#uid\fR] file ...
+[\fB\-g\fR\ \fIgroup\ name\fR|\fI#gid\fR] [\fB\-p\fR\ \fIprompt\fR]
+[\fB\-u\fR\ \fIuser\ name\fR|\fI#uid\fR] file ...
 .SH "DESCRIPTION"
 .IX Header "DESCRIPTION"
 \&\fBsudo\fR allows a permitted user to execute a \fIcommand\fR as the
@@ -368,9 +361,9 @@ timestamp file.  As a result, \fBsudo\fR will prompt for a password
 timestamp file.
 .IP "\-L" 12
 .IX Item "-L"
-The \fB\-L\fR (\fIlist\fR defaults) option will list out the parameters
-that may be set in a \fIDefaults\fR line along with a short description
-for each.  This option is useful in conjunction with \fIgrep\fR\|(1).
+The \fB\-L\fR (\fIlist\fR defaults) option will list the parameters that
+may be set in a \fIDefaults\fR line along with a short description for
+each.  This option will be removed from a future version of \fBsudo\fR.
 .IP "\-l[l] [\fIcommand\fR]" 12
 .IX Item "-l[l] [command]"
 If no \fIcommand\fR is specified, the \fB\-l\fR (\fIlist\fR) option will list
@@ -403,13 +396,13 @@ escapes are supported:
 .ie n .IP "%H" 4
 .el .IP "\f(CW%H\fR" 4
 .IX Item "%H"
-expanded to the local hostname including the domain name
-(on if the machine's hostname is fully qualified or the \fIfqdn\fR
+expanded to the local host name including the domain name
+(on if the machine's host name is fully qualified or the \fIfqdn\fR
 \&\fIsudoers\fR option is set)
 .ie n .IP "%h" 4
 .el .IP "\f(CW%h\fR" 4
 .IX Item "%h"
-expanded to the local hostname without the domain name
+expanded to the local host name without the domain name
 .ie n .IP "%p" 4
 .el .IP "\f(CW%p\fR" 4
 .IX Item "%p"
diff --git a/sudo.pod b/sudo.pod
index f7c57f645..bb04234c5 100644
--- a/sudo.pod
+++ b/sudo.pod
@@ -31,29 +31,29 @@ B<sudo> B<-h> | B<-K> | B<-k> | B<-L> | B<-V>
 
 B<sudo> B<-v> [B<-AknS>]
 S<[B<-a> I<auth_type>]>
-S<[B<-g> I<groupname>|I<#gid>]> S<[B<-p> I<prompt>]>
+S<[B<-g> I<group name>|I<#gid>]> S<[B<-p> I<prompt>]>
 S<[B<-u> I<username>|I<#uid>]>
 
 B<sudo> B<-l[l]> [B<-AknS>]
 S<[B<-a> I<auth_type>]>
-S<[B<-g> I<groupname>|I<#gid>]> S<[B<-p> I<prompt>]>
-S<[B<-U> I<username>]> S<[B<-u> I<username>|I<#uid>]> [I<command>]
+S<[B<-g> I<group name>|I<#gid>]> S<[B<-p> I<prompt>]>
+S<[B<-U> I<user name>]> S<[B<-u> I<user name>|I<#uid>]> [I<command>]
 
 B<sudo> [B<-AbEHnPS>]
 S<[B<-a> I<auth_type>]>
 S<[B<-C> I<fd>]>
 S<[B<-c> I<class>|I<->]>
-S<[B<-g> I<groupname>|I<#gid>]> S<[B<-p> I<prompt>]>
+S<[B<-g> I<group name>|I<#gid>]> S<[B<-p> I<prompt>]>
 S<[B<-r> I<role>]> S<[B<-t> I<type>]>
-S<[B<-u> I<username>|I<#uid>]>
+S<[B<-u> I<user name>|I<#uid>]>
 S<[B<VAR>=I<value>]> S<[B<-i> | B<-s>]> [I<command>]
 
 B<sudoedit> [B<-AnS>]
 S<[B<-a> I<auth_type>]>
 S<[B<-C> I<fd>]>
 S<[B<-c> I<class>|I<->]>
-S<[B<-g> I<groupname>|I<#gid>]> S<[B<-p> I<prompt>]>
-S<[B<-u> I<username>|I<#uid>]> file ...
+S<[B<-g> I<group name>|I<#gid>]> S<[B<-p> I<prompt>]>
+S<[B<-u> I<user name>|I<#uid>]> file ...
 
 =head1 DESCRIPTION
 
@@ -298,13 +298,13 @@ escapes are supported:
 
 =item C<%H>
 
-expanded to the local hostname including the domain name
-(on if the machine's hostname is fully qualified or the I<fqdn>
+expanded to the local host name including the domain name
+(on if the machine's host name is fully qualified or the I<fqdn>
 I<sudoers> option is set)
 
 =item C<%h>
 
-expanded to the local hostname without the domain name
+expanded to the local host name without the domain name
 
 =item C<%p>
 
diff --git a/sudoers.cat b/sudoers.cat
index 03ec402cd..2bdffdb13 100644
--- a/sudoers.cat
+++ b/sudoers.cat
@@ -20,8 +20,7 @@ DDEESSCCRRIIPPTTIIOONN
        Form (EBNF).  Don't despair if you don't know what EBNF is; it is
        fairly simple, and the definitions below are annotated.
 
-       QQuuiicckk gguuiiddee ttoo EEBBNNFF
-
+   QQuuiicckk gguuiiddee ttoo EEBBNNFF
        EBNF is a concise and exact way of describing the grammar of a
        language.  Each EBNF definition is made up of _p_r_o_d_u_c_t_i_o_n _r_u_l_e_s.  E.g.,
 
@@ -45,8 +44,7 @@ DDEESSCCRRIIPPTTIIOONN
        will use single quotes ('') to designate what is a verbatim character
        string (as opposed to a symbol name).
 
-       AAlliiaasseess
-
+   AAlliiaasseess
        There are four kinds of aliases: User_Alias, Runas_Alias, Host_Alias
        and Cmnd_Alias.
 
@@ -59,9 +57,11 @@ DDEESSCCRRIIPPTTIIOONN
 
         Runas_Alias ::= NAME '=' Runas_List
 
+        Host_Alias ::= NAME '=' Host_List
 
 
-1.7.2                   September 24, 2009                      1
+
+1.7.3b2                 December 19, 2009                       1
 
 
 
@@ -71,8 +71,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-        Host_Alias ::= NAME '=' Host_List
-
         Cmnd_Alias ::= NAME '=' Cmnd_List
 
         NAME ::= [A-Z]([A-Z][0-9]_)*
@@ -94,23 +92,23 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         User_List ::= User |
                       User ',' User_List
 
-        User ::= '!'* username |
+        User ::= '!'* user name |
                  '!'* '#'uid |
                  '!'* '%'group |
                  '!'* '+'netgroup |
                  '!'* '%:'nonunix_group |
                  '!'* User_Alias
 
-       A User_List is made up of one or more usernames, uids (prefixed with
+       A User_List is made up of one or more user names, uids (prefixed with
        '#'), system groups (prefixed with '%'), netgroups (prefixed with '+')
        and User_Aliases.  Each list item may be prefixed with zero or more '!'
        operators.  An odd number of '!' operators negate the value of the
        item; an even number just cancel each other out.
 
-       A username, group, netgroup and nonunix_groups may be enclosed in
-       double quotes to avoid the need for escaping special characters.
-       Alternately, special characters may be specified in escaped hex mode,
-       e.g. \x20 for space.
+       A user name, group, netgroup or nonunix_group may be enclosed in double
+       quotes to avoid the need for escaping special characters.  Alternately,
+       special characters may be specified in escaped hex mode, e.g. \x20 for
+       space.
 
        The nonunix_group syntax depends on the underlying implementation.  For
        instance, the QAS AD backend supports the following formats:
@@ -124,10 +122,12 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        Note that quotes around group names are optional.  Unquoted strings
        must use a backslash (\) to escape spaces and the '@' symbol.
 
+        Runas_List ::= Runas_Member |
+                       Runas_Member ',' Runas_List
 
 
 
-1.7.2                   September 24, 2009                      2
+1.7.3b2                 December 19, 2009                       2
 
 
 
@@ -136,32 +136,30 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-        Runas_List ::= Runas_Member |
-                       Runas_Member ',' Runas_List
 
-        Runas_Member ::= '!'* username |
+        Runas_Member ::= '!'* user name |
                          '!'* '#'uid |
                          '!'* '%'group |
                          '!'* +netgroup |
                          '!'* Runas_Alias
 
        A Runas_List is similar to a User_List except that instead of
-       User_Aliases it can contain Runas_Aliases.  Note that usernames and
+       User_Aliases it can contain Runas_Aliases.  Note that user names and
        groups are matched as strings.  In other words, two users (groups) with
        the same uid (gid) are considered to be distinct.  If you wish to match
-       all usernames with the same uid (e.g. root and toor), you can use a uid
-       instead (#0 in the example given).
+       all user names with the same uid (e.g. root and toor), you can use a
+       uid instead (#0 in the example given).
 
         Host_List ::= Host |
                       Host ',' Host_List
 
-        Host ::= '!'* hostname |
+        Host ::= '!'* host name |
                  '!'* ip_addr |
                  '!'* network(/netmask)? |
                  '!'* '+'netgroup |
                  '!'* Host_Alias
 
-       A Host_List is made up of one or more hostnames, IP addresses, network
+       A Host_List is made up of one or more host names, IP addresses, network
        numbers, netgroups (prefixed with '+') and other aliases.  Again, the
        value of an item may be negated with the '!' operator.  If you do not
        specify a netmask along with the network number, ssuuddoo will query each
@@ -169,17 +167,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        corresponds to one of the hosts's network interfaces, the corresponding
        netmask will be used.  The netmask may be specified either in standard
        IP address notation (e.g. 255.255.255.0 or ffff:ffff:ffff:ffff::), or
-       CIDR notation (number of bits, e.g. 24 or 64).  A hostname may include
+       CIDR notation (number of bits, e.g. 24 or 64).  A host name may include
        shell-style wildcards (see the Wildcards section below), but unless the
-       hostname command on your machine returns the fully qualified hostname,
-       you'll need to use the _f_q_d_n option for wildcards to be useful.
+       host name command on your machine returns the fully qualified host
+       name, you'll need to use the _f_q_d_n option for wildcards to be useful.
 
         Cmnd_List ::= Cmnd |
                       Cmnd ',' Cmnd_List
 
-        commandname ::= filename |
-                        filename args |
-                        filename '""'
+        commandname ::= file name |
+                        file name args |
+                        file name '""'
 
         Cmnd ::= '!'* commandname |
                  '!'* directory |
@@ -187,13 +185,15 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                  '!'* Cmnd_Alias
 
        A Cmnd_List is a list of one or more commandnames, directories, and
-       other aliases.  A commandname is a fully qualified filename which may
+       other aliases.  A commandname is a fully qualified file name which may
        include shell-style wildcards (see the Wildcards section below).  A
-       simple filename allows the user to run the command with any arguments
+       simple file name allows the user to run the command with any arguments
+       he/she wishes.  However, you may also specify command line arguments
+       (including wildcards).  Alternately, you can specify "" to indicate
 
 
 
-1.7.2                   September 24, 2009                      3
+1.7.3b2                 December 19, 2009                       3
 
 
 
@@ -202,10 +202,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       he/she wishes.  However, you may also specify command line arguments
-       (including wildcards).  Alternately, you can specify "" to indicate
        that the command may only be run wwiitthhoouutt command line arguments.  A
-       directory is a fully qualified pathname ending in a '/'.  When you
+       directory is a fully qualified path name ending in a '/'.  When you
        specify a directory in a Cmnd_List, the user will be able to run any
        file within that directory (but not in any subdirectories therein).
 
@@ -217,8 +215,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        to permit a user to run ssuuddoo with the --ee option (or as ssuuddooeeddiitt).  It
        may take command line arguments just as a normal command does.
 
-       DDeeffaauullttss
-
+   DDeeffaauullttss
        Certain configuration options may be changed from their default values
        at runtime via one or more Default_Entry lines.  These may affect all
        users on any host, all users on a specific host, a specific user, a
@@ -256,10 +253,13 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        not exist in a list.
 
        Defaults entries are parsed in the following order: generic, host and
+       user Defaults first, then runas Defaults and finally command defaults.
+
+       See "SUDOERS OPTIONS" for a list of supported Defaults parameters.
 
 
 
-1.7.2                   September 24, 2009                      4
+1.7.3b2                 December 19, 2009                       4
 
 
 
@@ -268,12 +268,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       user Defaults first, then runas Defaults and finally command defaults.
-
-       See "SUDOERS OPTIONS" for a list of supported Defaults parameters.
-
-       UUsseerr SSppeecciiffiiccaattiioonn
-
+   UUsseerr SSppeecciiffiiccaattiioonn
         User_Spec ::= User_List Host_List '=' Cmnd_Spec_List \
                       (':' Host_List '=' Cmnd_Spec_List)*
 
@@ -294,8 +289,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        The basic structure of a user specification is `who = where (as_whom)
        what'.  Let's break that down into its constituent parts:
 
-       RRuunnaass__SSppeecc
-
+   RRuunnaass__SSppeecc
        A Runas_Spec determines the user and/or the group that a command may be
        run as.  A fully-specified Runas_Spec consists of two Runas_Lists (as
        defined above) separated by a colon (':') and enclosed in a set of
@@ -323,9 +317,15 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        It is also possible to override a Runas_Spec later on in an entry.  If
        we modify the entry like so:
 
+        dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
+
+       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
+       and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
 
 
-1.7.2                   September 24, 2009                      5
+
+
+1.7.3b2                 December 19, 2009                       5
 
 
 
@@ -334,11 +334,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-        dgb    boulder = (operator) /bin/ls, (root) /bin/kill, /usr/bin/lprm
-
-       Then user ddggbb is now allowed to run _/_b_i_n_/_l_s as ooppeerraattoorr, but  _/_b_i_n_/_k_i_l_l
-       and _/_u_s_r_/_b_i_n_/_l_p_r_m as rroooott.
-
        We can extend this to allow ddggbb to run /bin/ls with either the user or
        group set to ooppeerraattoorr:
 
@@ -352,8 +347,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
         tcm    boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \
                /usr/local/bin/minicom
 
-       TTaagg__SSppeecc
-
+   TTaagg__SSppeecc
        A command may have zero or more tags associated with it.  There are
        eight possible tag values, NOPASSWD, PASSWD, NOEXEC, EXEC, SETENV,
        NOSETENV, TRANSCRIPT and NOTRANSCRIPT.  Once a tag is set on a Cmnd,
@@ -388,10 +382,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        pertain to the current host.  This behavior may be overridden via the
        verifypw and listpw options.
 
+       _N_O_E_X_E_C _a_n_d _E_X_E_C
+
+       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
+       operating system supports it, the NOEXEC tag can be used to prevent a
+       dynamically-linked executable from running further commands itself.
 
 
 
-1.7.2                   September 24, 2009                      6
+
+1.7.3b2                 December 19, 2009                       6
 
 
 
@@ -400,12 +400,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       _N_O_E_X_E_C _a_n_d _E_X_E_C
-
-       If ssuuddoo has been compiled with _n_o_e_x_e_c support and the underlying
-       operating system supports it, the NOEXEC tag can be used to prevent a
-       dynamically-linked executable from running further commands itself.
-
        In the following example, user aaaarroonn may run _/_u_s_r_/_b_i_n_/_m_o_r_e and
        _/_u_s_r_/_b_i_n_/_v_i but shell escapes will be disabled.
 
@@ -430,12 +424,11 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        basis.  For more information, see the description of _t_r_a_n_s_c_r_i_p_t in the
        "SUDOERS OPTIONS" section below.
 
-       WWiillddccaarrddss
-
+   WWiillddccaarrddss
        ssuuddoo allows shell-style _w_i_l_d_c_a_r_d_s (aka meta or glob characters) to be
-       used in hostnames, pathnames and command line arguments in the _s_u_d_o_e_r_s
-       file.  Wildcard matching is done via the PPOOSSIIXX _g_l_o_b(3) and _f_n_m_a_t_c_h(3)
-       routines.  Note that these are _n_o_t regular expressions.
+       used in host names, path names and command line arguments in the
+       _s_u_d_o_e_r_s file.  Wildcard matching is done via the PPOOSSIIXX _g_l_o_b(3) and
+       _f_n_m_a_t_c_h(3) routines.  Note that these are _n_o_t regular expressions.
 
        *       Matches any set of zero or more characters.
 
@@ -454,10 +447,17 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
            /bin/ls [[\:alpha\:]]*
 
+       Would match any file name beginning with a letter.
+
+       Note that a forward slash ('/') will nnoott be matched by wildcards used
+       in the path name.  When matching the command line arguments, however, a
+       slash ddooeess get matched by wildcards.  This is to make a path like:
+
+           /usr/bin/*
 
 
 
-1.7.2                   September 24, 2009                      7
+1.7.3b2                 December 19, 2009                       7
 
 
 
@@ -466,26 +466,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       Would match any filename beginning with a letter.
-
-       Note that a forward slash ('/') will nnoott be matched by wildcards used
-       in the pathname.  When matching the command line arguments, however, a
-       slash ddooeess get matched by wildcards.  This is to make a path like:
-
-           /usr/bin/*
-
        match _/_u_s_r_/_b_i_n_/_w_h_o but not _/_u_s_r_/_b_i_n_/_X_1_1_/_x_t_e_r_m.
 
-       EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
-
+   EExxcceeppttiioonnss ttoo wwiillddccaarrdd rruulleess
        The following exceptions apply to the above rules:
 
        ""      If the empty string "" is the only command line argument in the
                _s_u_d_o_e_r_s entry it means that command is not allowed to be run
                with aannyy arguments.
 
-       IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
-
+   IInncclluuddiinngg ootthheerr ffiilleess ffrroomm wwiitthhiinn ssuuddooeerrss
        It is possible to include other _s_u_d_o_e_r_s files from within the _s_u_d_o_e_r_s
        file currently being parsed using the #include and #includedir
        directives.
@@ -505,8 +495,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        A hard limit of 128 nested include files is enforced to prevent include
        file loops.
 
-       The filename may include the %h escape, signifying the short form of
-       the hostname.  I.e., if the machine's hostname is "xerxes", then
+       The file name may include the %h escape, signifying the short form of
+       the host name.  I.e., if the machine's host name is "xerxes", then
 
        #include /etc/sudoers.%h
 
@@ -520,18 +510,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        ssuuddoo will read each file in _/_e_t_c_/_s_u_d_o_e_r_s_._d, skipping file names that
        end in ~ or contain a . character to avoid causing problems with
-
-
-
-1.7.2                   September 24, 2009                      8
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
        package manager or editor temporary/backup files.  Files are parsed in
        sorted lexical order.  That is, _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_0_1___f_i_r_s_t will be parsed
        before _/_e_t_c_/_s_u_d_o_e_r_s_._d_/_1_0___s_e_c_o_n_d.  Be aware that because the sorting is
@@ -542,10 +520,21 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        Note that unlike files included via #include, vviissuuddoo will not edit the
        files in a #includedir directory unless one of them contains a syntax
        error.  It is still possible to run vviissuuddoo with the -f flag to edit the
+
+
+
+1.7.3b2                 December 19, 2009                       8
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
        files directly.
 
-       OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
-
+   OOtthheerr ssppeecciiaall cchhaarraacctteerrss aanndd rreesseerrvveedd wwoorrddss
        The pound sign ('#') is used to indicate a comment (unless it is part
        of a #include directive or unless it occurs in the context of a user
        name and is followed by one or more digits, in which case it is treated
@@ -573,7 +562,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        characters in a _U_s_e_r _S_p_e_c_i_f_i_c_a_t_i_o_n ('=', ':', '(', ')') is optional.
 
        The following characters must be escaped with a backslash ('\') when
-       used as part of a word (e.g. a username or hostname): '@', '!', '=',
+       used as part of a word (e.g. a user name or host name): '@', '!', '=',
        ':', ',', '(', ')', '\'.
 
 SSUUDDOOEERRSS OOPPTTIIOONNSS
@@ -586,18 +575,6 @@ SSUUDDOOEERRSS OOPPTTIIOONNSS
        always_set_home If set, ssuuddoo will set the HOME environment variable to
                        the home directory of the target user (which is root
                        unless the --uu option is used).  This effectively means
-
-
-
-1.7.2                   September 24, 2009                      9
-
-
-
-
-
-SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
-
-
                        that the --HH option is always implied.  This flag is _o_f_f
                        by default.
 
@@ -609,10 +586,27 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        closefrom_override
                        If set, the user may use ssuuddoo's --CC option which
+
+
+
+1.7.3b2                 December 19, 2009                       9
+
+
+
+
+
+SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
+
+
                        overrides the default starting point at which ssuuddoo
                        begins closing open file descriptors.  This flag is _o_f_f
                        by default.
 
+       compress_transcript
+                       If set, and the _t_r_a_n_s_c_r_i_p_t flag is also set, ssuuddoo will
+                       compress the transcript logs using zzlliibb.  This flag is
+                       _o_n by default when ssuuddoo is compiled with zzlliibb support.
+
        env_editor      If set, vviissuuddoo will use the value of the EDITOR or
                        VISUAL environment variables before falling back on the
                        default editor list.  Note that this may create a
@@ -634,28 +628,34 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        variable.  This flag is _o_n by default.
 
        fast_glob       Normally, ssuuddoo uses the _g_l_o_b(3) function to do shell-
-                       style globbing when matching pathnames.  However, since
-                       it accesses the file system, _g_l_o_b(3) can take a long
-                       time to complete for some patterns, especially when the
-                       pattern references a network file system that is
-                       mounted on demand (automounted).  The _f_a_s_t___g_l_o_b option
-                       causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function, which does
-                       not access the file system to do its matching.  The
-                       disadvantage of _f_a_s_t___g_l_o_b is that it is unable to match
-                       relative pathnames such as _._/_l_s or _._._/_b_i_n_/_l_s.  This
-                       flag is _o_f_f by default.
+                       style globbing when matching path names.  However,
+                       since it accesses the file system, _g_l_o_b(3) can take a
+                       long time to complete for some patterns, especially
+                       when the pattern references a network file system that
+                       is mounted on demand (automounted).  The _f_a_s_t___g_l_o_b
+                       option causes ssuuddoo to use the _f_n_m_a_t_c_h(3) function,
+                       which does not access the file system to do its
+                       matching.  The disadvantage of _f_a_s_t___g_l_o_b is that it is
+                       unable to match relative path names such as _._/_l_s or
+                       _._._/_b_i_n_/_l_s.  This flag is _o_f_f by default.
 
-       fqdn            Set this flag if you want to put fully qualified
-                       hostnames in the _s_u_d_o_e_r_s file.  I.e., instead of myhost
-                       you would use myhost.mydomain.edu.  You may still use
-                       the short form if you wish (and even mix the two).
-                       Beware that turning on _f_q_d_n requires ssuuddoo to make DNS
-                       lookups which may make ssuuddoo unusable if DNS stops
-                       working (for example if the machine is not plugged into
+       fqdn            Set this flag if you want to put fully qualified host
+                       names in the _s_u_d_o_e_r_s file.  I.e., instead of myhost you
+                       would use myhost.mydomain.edu.  You may still use the
+                       short form if you wish (and even mix the two).  Beware
+                       that turning on _f_q_d_n requires ssuuddoo to make DNS lookups
+                       which may make ssuuddoo unusable if DNS stops working (for
+                       example if the machine is not plugged into the
+                       network).  Also note that you must use the host's
+                       official name as DNS knows it.  That is, you may not
+                       use a host alias (CNAME entry) due to performance
+                       issues and the fact that there is no way to get all
+                       aliases from DNS.  If your machine's host name (as
+                       returned by the hostname command) is already fully
 
 
 
-1.7.2                   September 24, 2009                     10
+1.7.3b2                 December 19, 2009                      10
 
 
 
@@ -664,12 +664,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       the network).  Also note that you must use the host's
-                       official name as DNS knows it.  That is, you may not
-                       use a host alias (CNAME entry) due to performance
-                       issues and the fact that there is no way to get all
-                       aliases from DNS.  If your machine's hostname (as
-                       returned by the hostname command) is already fully
                        qualified you shouldn't need to set _f_q_d_n.  This flag is
                        _o_f_f by default.
 
@@ -693,8 +687,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        insults         If set, ssuuddoo will insult users when they enter an
                        incorrect password.  This flag is _o_f_f by default.
 
-       log_host        If set, the hostname will be logged in the (non-syslog)
-                       ssuuddoo log file.  This flag is _o_f_f by default.
+       log_host        If set, the host name will be logged in the (non-
+                       syslog) ssuuddoo log file.  This flag is _o_f_f by default.
 
        log_year        If set, the four-digit year will be logged in the (non-
                        syslog) ssuuddoo log file.  This flag is _o_f_f by default.
@@ -718,10 +712,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        allowed to run commands on the current host.  This flag
                        is _o_f_f by default.
 
+       mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o user if the
+                       invoking user is allowed to use ssuuddoo but the command
+                       they are trying is not listed in their _s_u_d_o_e_r_s file
+                       entry or is explicitly denied.  This flag is _o_f_f by
+                       default.
 
 
 
-1.7.2                   September 24, 2009                     11
+
+1.7.3b2                 December 19, 2009                      11
 
 
 
@@ -730,12 +730,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-       mail_no_perms   If set, mail will be sent to the _m_a_i_l_t_o user if the
-                       invoking user is allowed to use ssuuddoo but the command
-                       they are trying is not listed in their _s_u_d_o_e_r_s file
-                       entry or is explicitly denied.  This flag is _o_f_f by
-                       default.
-
        mail_no_user    If set, mail will be sent to the _m_a_i_l_t_o user if the
                        invoking user is not in the _s_u_d_o_e_r_s file.  This flag is
                        _o_n by default.
@@ -784,10 +778,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        to a real tty.  When this flag is set, ssuuddoo can only be
                        run from a login session and not via other means such
                        as _c_r_o_n(1m) or cgi-bin scripts.  This flag is _o_f_f by
+                       default.
+
+       root_sudo       If set, root is allowed to run ssuuddoo too.  Disabling
+                       this prevents users from "chaining" ssuuddoo commands to
+                       get a root shell by doing something like "sudo sudo
+                       /bin/sh".  Note, however, that turning off _r_o_o_t___s_u_d_o
 
 
 
-1.7.2                   September 24, 2009                     12
+1.7.3b2                 December 19, 2009                      12
 
 
 
@@ -796,12 +796,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       default.
-
-       root_sudo       If set, root is allowed to run ssuuddoo too.  Disabling
-                       this prevents users from "chaining" ssuuddoo commands to
-                       get a root shell by doing something like "sudo sudo
-                       /bin/sh".  Note, however, that turning off _r_o_o_t___s_u_d_o
                        will also prevent root and from running ssuuddooeeddiitt.
                        Disabling _r_o_o_t___s_u_d_o provides no real additional
                        security; it exists purely for historical reasons.
@@ -850,10 +844,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        stay_setuid     Normally, when ssuuddoo executes a command the real and
                        effective UIDs are set to the target user (root by
+                       default).  This option changes that behavior such that
+                       the real UID is left as the invoking user's UID.  In
+                       other words, this makes ssuuddoo act as a setuid wrapper.
+                       This can be useful on systems that disable some
+                       potentially dangerous functionality when a program is
+                       run setuid.  This option is only effective on systems
 
 
 
-1.7.2                   September 24, 2009                     13
+1.7.3b2                 December 19, 2009                      13
 
 
 
@@ -862,21 +862,16 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       default).  This option changes that behavior such that
-                       the real UID is left as the invoking user's UID.  In
-                       other words, this makes ssuuddoo act as a setuid wrapper.
-                       This can be useful on systems that disable some
-                       potentially dangerous functionality when a program is
-                       run setuid.  This option is only effective on systems
                        with either the _s_e_t_r_e_u_i_d_(_) or _s_e_t_r_e_s_u_i_d_(_) function.
                        This flag is _o_f_f by default.
 
        targetpw        If set, ssuuddoo will prompt for the password of the user
                        specified by the --uu option (defaults to root) instead
-                       of the password of the invoking user.  Note that this
-                       precludes the use of a uid not listed in the passwd
-                       database as an argument to the --uu option.  This flag is
-                       _o_f_f by default.
+                       of the password of the invoking user.  In addition, the
+                       timestamp file name will include the target user's
+                       name.  Note that this flag precludes the use of a uid
+                       not listed in the passwd database as an argument to the
+                       --uu option.  This flag is _o_f_f by default.
 
        transcript      If set, ssuuddoo will log a transcript of the command being
                        run, similar to the _s_c_r_i_p_t(1) command.  In this mode
@@ -916,10 +911,15 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
        use_loginclass  If set, ssuuddoo will apply the defaults specified for the
                        target user's login class if one exists.  Only
                        available if ssuuddoo is configured with the
+                       --with-logincap option.  This flag is _o_f_f by default.
+
+       visiblepw       By default, ssuuddoo will refuse to run if the user must
+                       enter a password but it is not possible to disable echo
+                       on the terminal.  If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo
 
 
 
-1.7.2                   September 24, 2009                     14
+1.7.3b2                 December 19, 2009                      14
 
 
 
@@ -928,11 +928,6 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
-                       --with-logincap option.  This flag is _o_f_f by default.
-
-       visiblepw       By default, ssuuddoo will refuse to run if the user must
-                       enter a password but it is not possible to disable echo
-                       on the terminal.  If the _v_i_s_i_b_l_e_p_w flag is set, ssuuddoo
                        will prompt for a password even when it would be
                        visible on the screen.  This makes it possible to run
                        things like "rsh somehost sudo ls" since _r_s_h(1) does
@@ -960,16 +955,20 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        the option to disable word wrap).
 
        passwd_timeout  Number of minutes before the ssuuddoo password prompt times
-                       out.  The default is 5; set this to 0 for no password
+                       out.  The timeout may include a fractional component if
+                       minute granularity is insufficient, for example 2.5.
+                       The default is 5; set this to 0 for no password
                        timeout.
 
        timestamp_timeout
                        Number of minutes that can elapse before ssuuddoo will ask
-                       for a passwd again.  The default is 5.  Set this to 0
-                       to always prompt for a password.  If set to a value
-                       less than 0 the user's timestamp will never expire.
-                       This can be used to allow users to create or delete
-                       their own timestamps via sudo -v and sudo -k
+                       for a passwd again.  The timeout may include a
+                       fractional component if minute granularity is
+                       insufficient, for example 2.5.  The default is 5.  Set
+                       this to 0 to always prompt for a password.  If set to a
+                       value less than 0 the user's timestamp will never
+                       expire.  This can be used to allow users to create or
+                       delete their own timestamps via sudo -v and sudo -k
                        respectively.
 
        umask           Umask to use when running the command.  Negate this
@@ -985,7 +984,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     15
+
+1.7.3b2                 December 19, 2009                      15
 
 
 
@@ -1006,8 +1006,8 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        your system.
 
        mailsub         Subject of the mail sent to the _m_a_i_l_t_o user. The escape
-                       %h will expand to the hostname of the machine.  Default
-                       is *** SECURITY information for %h ***.
+                       %h will expand to the host name of the machine.
+                       Default is *** SECURITY information for %h ***.
 
        noexec_file     Path to a shared library containing dummy versions of
                        the _e_x_e_c_v_(_), _e_x_e_c_v_e_(_) and _f_e_x_e_c_v_e_(_) library functions
@@ -1021,11 +1021,11 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                        environment variable.  The following percent (`%')
                        escapes are supported:
 
-                       %H  expanded to the local hostname including the domain
-                           name (on if the machine's hostname is fully
+                       %H  expanded to the local host name including the
+                           domain name (on if the machine's host name is fully
                            qualified or the _f_q_d_n option is set)
 
-                       %h  expanded to the local hostname without the domain
+                       %h  expanded to the local host name without the domain
                            name
 
                        %p  expanded to the user whose password is being asked
@@ -1051,7 +1051,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     16
+1.7.3b2                 December 19, 2009                      16
 
 
 
@@ -1117,7 +1117,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     17
+1.7.3b2                 December 19, 2009                      17
 
 
 
@@ -1177,13 +1177,13 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
                    is if you want to have the "root path" be separate from the
                    "user path."  Users in the group specified by the
                    _e_x_e_m_p_t___g_r_o_u_p option are not affected by _s_e_c_u_r_e___p_a_t_h.  This
-                   option is @secure_path@ by default.
+                   option is not set by default.
 
        syslog      Syslog facility if syslog is being used for logging (negate
 
 
 
-1.7.2                   September 24, 2009                     18
+1.7.3b2                 December 19, 2009                      18
 
 
 
@@ -1249,7 +1249,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     19
+1.7.3b2                 December 19, 2009                      19
 
 
 
@@ -1315,7 +1315,7 @@ EEXXAAMMPPLLEESS
 
 
 
-1.7.2                   September 24, 2009                     20
+1.7.3b2                 December 19, 2009                      20
 
 
 
@@ -1381,7 +1381,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     21
+1.7.3b2                 December 19, 2009                      21
 
 
 
@@ -1419,7 +1419,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
        The user ppeettee is allowed to change anyone's password except for root on
        the _H_P_P_A machines.  Note that this assumes _p_a_s_s_w_d(1) does not take
-       multiple usernames on the command line.
+       multiple user names on the command line.
 
         bob            SPARC = (OP) ALL : SGI = (OP) ALL
 
@@ -1447,7 +1447,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     22
+1.7.3b2                 December 19, 2009                      22
 
 
 
@@ -1513,7 +1513,7 @@ PPRREEVVEENNTTIINNGG SSHHEELLLL EESSCCAAPPEESS
 
 
 
-1.7.2                   September 24, 2009                     23
+1.7.3b2                 December 19, 2009                      23
 
 
 
@@ -1579,7 +1579,7 @@ SUDOERS(4)             MAINTENANCE COMMANDS            SUDOERS(4)
 
 
 
-1.7.2                   September 24, 2009                     24
+1.7.3b2                 December 19, 2009                      24
 
 
 
@@ -1608,8 +1608,8 @@ CCAAVVEEAATTSS
        syntactically incorrect _s_u_d_o_e_r_s file.
 
        When using netgroups of machines (as opposed to users), if you store
-       fully qualified hostnames in the netgroup (as is usually the case), you
-       either need to have the machine's hostname be fully qualified as
+       fully qualified host name in the netgroup (as is usually the case), you
+       either need to have the machine's host name be fully qualified as
        returned by the hostname command or use the _f_q_d_n option in _s_u_d_o_e_r_s.
 
 BBUUGGSS
@@ -1645,6 +1645,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7.2                   September 24, 2009                     25
+1.7.3b2                 December 19, 2009                      25
 
 
diff --git a/sudoers.ldap.cat b/sudoers.ldap.cat
index 234931dea..1b5b1e271 100644
--- a/sudoers.ldap.cat
+++ b/sudoers.ldap.cat
@@ -52,16 +52,16 @@ DDEESSCCRRIIPPTTIIOONN
        Cmnd_Alias that is referenced by multiple users, one can create a
        sudoRole that contains the commands and assign multiple users to it.
 
-       SSUUDDOOeerrss LLDDAAPP ccoonnttaaiinneerr
-
+   SSUUDDOOeerrss LLDDAAPP ccoonnttaaiinneerr
        The _s_u_d_o_e_r_s configuration is contained in the ou=SUDOers LDAP
        container.
 
        Sudo first looks for the cn=default entry in the SUDOers container.  If
+       found, the multi-valued sudoOption attribute is parsed in the same
 
 
 
-1.7.2                     June 11, 2009                         1
+1.7.3b2                 December 19, 2009                       1
 
 
 
@@ -70,7 +70,6 @@ DDEESSCCRRIIPPTTIIOONN
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-       found, the multi-valued sudoOption attribute is parsed in the same
        manner as a global Defaults line in _/_e_t_c_/_s_u_d_o_e_r_s.  In the following
        example, the SSH_AUTH_SOCK variable will be preserved in the
        environment for all users.
@@ -127,7 +126,8 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
 
-1.7.2                     June 11, 2009                         2
+
+1.7.3b2                 December 19, 2009                       2
 
 
 
@@ -144,8 +144,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            sudoHost: ALL
            sudoCommand: ALL
 
-       AAnnaattoommyy ooff LLDDAAPP ssuuddooeerrss llooookkuupp
-
+   AAnnaattoommyy ooff LLDDAAPP ssuuddooeerrss llooookkuupp
        When looking up a sudoer using LDAP there are only two or three LDAP
        queries per invocation.  The first query is to parse the global
        options.  The second is to match against the user's name and the groups
@@ -154,8 +153,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
        third query returns all entries containing user netgroups and checks to
        see if the user belongs to any of them.
 
-       DDiiffffeerreenncceess bbeettwweeeenn LLDDAAPP aanndd nnoonn--LLDDAAPP ssuuddooeerrss
-
+   DDiiffffeerreenncceess bbeettwweeeenn LLDDAAPP aanndd nnoonn--LLDDAAPP ssuuddooeerrss
        There are some subtle differences in the way sudoers is handled once in
        LDAP.  Probably the biggest is that according to the RFC, LDAP ordering
        is arbitrary and you cannot expect that Attributes and Entries are
@@ -190,10 +188,12 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            objectClass: top
            cn: role2
            sudoUser: puddles
+           sudoHost: ALL
+           sudoCommand: !/bin/sh
 
 
 
-1.7.2                     June 11, 2009                         3
+1.7.3b2                 December 19, 2009                       3
 
 
 
@@ -202,8 +202,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           sudoHost: ALL
-           sudoCommand: !/bin/sh
            sudoCommand: ALL
 
        Another difference is that negations on the Host, User or Runas are
@@ -224,8 +222,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            sudoHost: ALL
            sudoHost: !web01
 
-       SSuuddooeerrss SScchheemmaa
-
+   SSuuddooeerrss SScchheemmaa
        In order to use ssuuddoo's LDAP support, the ssuuddoo schema must be installed
        on your LDAP server.  In addition, be sure to index the 'sudoUser'
        attribute.
@@ -238,8 +235,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
        The schema for ssuuddoo in OpenLDAP form is included in the EXAMPLES
        section.
 
-       CCoonnffiigguurriinngg llddaapp..ccoonnff
-
+   CCoonnffiigguurriinngg llddaapp..ccoonnff
        Sudo reads the _/_e_t_c_/_l_d_a_p_._c_o_n_f file for LDAP-specific configuration.
        Typically, this file is shared amongst different LDAP-aware clients.
        As such, most of the settings are not ssuuddoo-specific.  Note that ssuuddoo
@@ -256,10 +252,14 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
        UURRII ldap[s]://[hostname[:port]] ...
            Specifies a whitespace-delimited list of one or more URIs
+           describing the LDAP server(s) to connect to.  The _p_r_o_t_o_c_o_l may be
+           either llddaapp or llddaappss, the latter being for servers that support TLS
+           (SSL) encryption.  If no _p_o_r_t is specified, the default is port 389
+           for ldap:// or port 636 for ldaps://.  If no _h_o_s_t_n_a_m_e is specified,
 
 
 
-1.7.2                     June 11, 2009                         4
+1.7.3b2                 December 19, 2009                       4
 
 
 
@@ -268,10 +268,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           describing the LDAP server(s) to connect to.  The _p_r_o_t_o_c_o_l may be
-           either llddaapp or llddaappss, the latter being for servers that support TLS
-           (SSL) encryption.  If no _p_o_r_t is specified, the default is port 389
-           for ldap:// or port 636 for ldaps://.  If no _h_o_s_t_n_a_m_e is specified,
            ssuuddoo will connect to llooccaallhhoosstt.  Only systems using the OpenSSL
            libraries support the mixing of ldap:// and ldaps:// URIs.  The
            Netscape-derived libraries used on most commercial versions of Unix
@@ -322,10 +318,14 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            identity.  By default, most LDAP servers will allow anonymous
            access.
 
+       BBIINNDDPPWW secret
+           The BBIINNDDPPWW parameter specifies the password to use when performing
+           LDAP operations.  This is typically used in conjunction with the
+           BBIINNDDDDNN parameter.
 
 
 
-1.7.2                     June 11, 2009                         5
+1.7.3b2                 December 19, 2009                       5
 
 
 
@@ -334,11 +334,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-       BBIINNDDPPWW secret
-           The BBIINNDDPPWW parameter specifies the password to use when performing
-           LDAP operations.  This is typically used in conjunction with the
-           BBIINNDDDDNN parameter.
-
        RROOOOTTBBIINNDDDDNN DN
            The RROOOOTTBBIINNDDDDNN parameter specifies the identity, in the form of a
            Distinguished Name (DN), to use when performing privileged LDAP
@@ -389,9 +384,14 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            used to authenticate the client to the LDAP server.  The
            certificate type depends on the LDAP libraries used.
 
+           OpenLDAP:
+               tls_cert /etc/ssl/client_cert.pem
+
+           Netscape-derived:
 
 
-1.7.2                     June 11, 2009                         6
+
+1.7.3b2                 December 19, 2009                       6
 
 
 
@@ -400,10 +400,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           OpenLDAP:
-               tls_cert /etc/ssl/client_cert.pem
-
-           Netscape-derived:
                tls_cert /var/ldap/cert7.db
 
            When using Netscape-derived libraries, this file may also contain
@@ -455,9 +451,13 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            The path to the Kerberos 5 credential cache to use when
            authenticating with the remote server.
 
+       See the ldap.conf entry in the EXAMPLES section.
 
 
-1.7.2                     June 11, 2009                         7
+
+
+
+1.7.3b2                 December 19, 2009                       7
 
 
 
@@ -466,10 +466,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-       See the ldap.conf entry in the EXAMPLES section.
-
-       CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff
-
+   CCoonnffiigguurriinngg nnsssswwiittcchh..ccoonnff
        Unless it is disabled at build time, ssuuddoo consults the Name Service
        Switch file, _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f, to specify the _s_u_d_o_e_r_s search order.
        Sudo looks for a line beginning with sudoers: and uses this to
@@ -502,8 +499,7 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
        Note that _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f is supported even when the underlying
        operating system does not use an nsswitch.conf file.
 
-       CCoonnffiigguurriinngg nneettssvvcc..ccoonnff
-
+   CCoonnffiigguurriinngg nneettssvvcc..ccoonnff
        On AIX systems, the _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f file is consulted instead of
        _/_e_t_c_/_n_s_s_w_i_t_c_h_._c_o_n_f.  ssuuddoo simply treats _n_e_t_s_v_c_._c_o_n_f as a variant of
        _n_s_s_w_i_t_c_h_._c_o_n_f; information in the previous section unrelated to the
@@ -521,9 +517,13 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
        To treat LDAP as authoratative and only use the local sudoers file if
        the user is not present in LDAP, use:
 
+           sudoers = ldap = auth, files
+
+       Note that in the above example, the auth qualfier only affects user
 
 
-1.7.2                     June 11, 2009                         8
+
+1.7.3b2                 December 19, 2009                       8
 
 
 
@@ -532,9 +532,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-           sudoers = ldap = auth, files
-
-       Note that in the above example, the auth qualfier only affects user
        lookups; both LDAP and _s_u_d_o_e_r_s will be queried for Defaults entries.
 
        If the _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f file is not present or there is no sudoers
@@ -550,8 +547,7 @@ FFIILLEESS
        _/_e_t_c_/_n_e_t_s_v_c_._c_o_n_f        determines sudoers source order on AIX
 
 EEXXAAMMPPLLEESS
-       EExxaammppllee llddaapp..ccoonnff
-
+   EExxaammppllee llddaapp..ccoonnff
          # Either specify one or more URIs or one or more host:port pairs.
          # If neither is specified sudo will default to localhost, port 389.
          #
@@ -586,10 +582,14 @@ EEXXAAMMPPLLEESS
          #
          # LDAP protocol version, defaults to 3
          #ldap_version 3
+         #
+         # Define if you want to use an encrypted LDAP connection.
+         # Typically, you must also set the port to 636 (ldaps).
+         #ssl on
 
 
 
-1.7.2                     June 11, 2009                         9
+1.7.3b2                 December 19, 2009                       9
 
 
 
@@ -598,10 +598,6 @@ EEXXAAMMPPLLEESS
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-         #
-         # Define if you want to use an encrypted LDAP connection.
-         # Typically, you must also set the port to 636 (ldaps).
-         #ssl on
          #
          # Define if you want to use port 389 and switch to
          # encryption before the bind credentials are sent.
@@ -652,10 +648,14 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
          # SDK will prevent specific file names from working.  For this reason
          # it is suggested that tls_cert and tls_key be set to a directory,
          # not a file name.
+         #
+         # The certificate database specified by tls_cert may contain CA certs
+         # and/or the client's cert.  If the client's cert is included, tls_key
+         # should be specified as well.
 
 
 
-1.7.2                     June 11, 2009                        10
+1.7.3b2                 December 19, 2009                      10
 
 
 
@@ -664,24 +664,19 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-         #
-         # The certificate database specified by tls_cert may contain CA certs
-         # and/or the client's cert.  If the client's cert is included, tls_key
-         # should be specified as well.
          # For backward compatibility, "sslpath" may be used in place of tls_cert.
          #tls_cert /var/ldap
          #tls_key /var/ldap
          #
          # If using SASL authentication for LDAP (OpenSSL)
          # use_sasl yes
-         # sasl_auth_id <SASL username>
+         # sasl_auth_id <SASL user name>
          # rootuse_sasl yes
-         # rootsasl_auth_id <SASL username for root access>
+         # rootsasl_auth_id <SASL user name for root access>
          # sasl_secprops none
          # krb5_ccname /etc/.ldapcache
 
-       SSuuddoo sscchheemmaa ffoorr OOppeennLLDDAAPP
-
+   SSuuddoo sscchheemmaa ffoorr OOppeennLLDDAAPP
        The following schema is in OpenLDAP format.  Simply copy it to the
        schema directory (e.g. _/_e_t_c_/_o_p_e_n_l_d_a_p_/_s_c_h_e_m_a), add the proper include
        line in slapd.conf and restart ssllaappdd.
@@ -718,10 +713,15 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
            EQUALITY caseExactIA5Match
            SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
 
+        attributetype ( 1.3.6.1.4.1.15953.9.1.6
+           NAME 'sudoRunAsUser'
+           DESC 'User(s) impersonated by sudo'
+           EQUALITY caseExactIA5Match
+           SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
 
 
 
-1.7.2                     June 11, 2009                        11
+1.7.3b2                 December 19, 2009                      11
 
 
 
@@ -730,11 +730,6 @@ SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 SUDOERS.LDAP(4)        MAINTENANCE COMMANDS       SUDOERS.LDAP(4)
 
 
-        attributetype ( 1.3.6.1.4.1.15953.9.1.6
-           NAME 'sudoRunAsUser'
-           DESC 'User(s) impersonated by sudo'
-           EQUALITY caseExactIA5Match
-           SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
 
         attributetype ( 1.3.6.1.4.1.15953.9.1.7
            NAME 'sudoRunAsGroup'
@@ -787,6 +782,11 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7.2                     June 11, 2009                        12
+
+
+
+
+
+1.7.3b2                 December 19, 2009                      12
 
 
diff --git a/sudoers.ldap.man.in b/sudoers.ldap.man.in
index 4b22d79b8..f9a37ddbd 100644
--- a/sudoers.ldap.man.in
+++ b/sudoers.ldap.man.in
@@ -15,18 +15,10 @@
 .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\" 
 .\" $Sudo$
-.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
+.\" Automatically generated by Pod::Man 2.22 (Pod::Simple 3.07)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
@@ -70,7 +62,7 @@
 .el       .ds Aq '
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .ie \nF \{\
@@ -149,7 +141,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOERS.LDAP @mansectform@"
-.TH SUDOERS.LDAP @mansectform@ "June 11, 2009" "1.7.2" "MAINTENANCE COMMANDS"
+.TH SUDOERS.LDAP @mansectform@ "December 19, 2009" "1.7.3b2" "MAINTENANCE COMMANDS"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -201,7 +193,7 @@ to have multiple users listed in a sudoRole.  Instead of defining
 a Cmnd_Alias that is referenced by multiple users, one can create
 a sudoRole that contains the commands and assign multiple users
 to it.
-.Sh "SUDOers \s-1LDAP\s0 container"
+.SS "SUDOers \s-1LDAP\s0 container"
 .IX Subsection "SUDOers LDAP container"
 The \fIsudoers\fR configuration is contained in the \f(CW\*(C`ou=SUDOers\*(C'\fR \s-1LDAP\s0
 container.
@@ -271,7 +263,7 @@ on any host via \fBsudo\fR:
 \&    sudoHost: ALL
 \&    sudoCommand: ALL
 .Ve
-.Sh "Anatomy of \s-1LDAP\s0 sudoers lookup"
+.SS "Anatomy of \s-1LDAP\s0 sudoers lookup"
 .IX Subsection "Anatomy of LDAP sudoers lookup"
 When looking up a sudoer using \s-1LDAP\s0 there are only two or three
 \&\s-1LDAP\s0 queries per invocation.  The first query is to parse the global
@@ -280,7 +272,7 @@ groups that the user belongs to.  (The special \s-1ALL\s0 tag is matched
 in this query too.)  If no match is returned for the user's name
 and groups, a third query returns all entries containing user
 netgroups and checks to see if the user belongs to any of them.
-.Sh "Differences between \s-1LDAP\s0 and non-LDAP sudoers"
+.SS "Differences between \s-1LDAP\s0 and non-LDAP sudoers"
 .IX Subsection "Differences between LDAP and non-LDAP sudoers"
 There are some subtle differences in the way sudoers is handled
 once in \s-1LDAP\s0.  Probably the biggest is that according to the \s-1RFC\s0,
@@ -342,7 +334,7 @@ behave the way one might expect.
 \&    sudoHost: ALL
 \&    sudoHost: !web01
 .Ve
-.Sh "Sudoers Schema"
+.SS "Sudoers Schema"
 .IX Subsection "Sudoers Schema"
 In order to use \fBsudo\fR's \s-1LDAP\s0 support, the \fBsudo\fR schema must be
 installed on your \s-1LDAP\s0 server.  In addition, be sure to index the
@@ -355,7 +347,7 @@ be found in the \fBsudo\fR distribution.
 .PP
 The schema for \fBsudo\fR in OpenLDAP form is included in the \s-1EXAMPLES\s0
 section.
-.Sh "Configuring ldap.conf"
+.SS "Configuring ldap.conf"
 .IX Subsection "Configuring ldap.conf"
 Sudo reads the \fI@ldap_conf@\fR file for LDAP-specific configuration.
 Typically, this file is shared amongst different LDAP-aware clients.
@@ -538,7 +530,7 @@ The path to the Kerberos 5 credential cache to use when authenticating
 with the remote server.
 .PP
 See the \f(CW\*(C`ldap.conf\*(C'\fR entry in the \s-1EXAMPLES\s0 section.
-.Sh "Configuring nsswitch.conf"
+.SS "Configuring nsswitch.conf"
 .IX Subsection "Configuring nsswitch.conf"
 Unless it is disabled at build time, \fBsudo\fR consults the Name
 Service Switch file, \fI@nsswitch_conf@\fR, to specify the \fIsudoers\fR
@@ -579,7 +571,7 @@ sudoers line, the following default is assumed:
 .PP
 Note that \fI@nsswitch_conf@\fR is supported even when the underlying
 operating system does not use an nsswitch.conf file.
-.Sh "Configuring netsvc.conf"
+.SS "Configuring netsvc.conf"
 .IX Subsection "Configuring netsvc.conf"
 On \s-1AIX\s0 systems, the \fI@netsvc_conf@\fR file is consulted instead of
 \&\fI@nsswitch_conf@\fR.  \fBsudo\fR simply treats \fInetsvc.conf\fR as a
@@ -632,7 +624,7 @@ determines sudoers source order
 determines sudoers source order on \s-1AIX\s0
 .SH "EXAMPLES"
 .IX Header "EXAMPLES"
-.Sh "Example ldap.conf"
+.SS "Example ldap.conf"
 .IX Subsection "Example ldap.conf"
 .Vb 10
 \&  # Either specify one or more URIs or one or more host:port pairs.
@@ -733,13 +725,13 @@ determines sudoers source order on \s-1AIX\s0
 \&  #
 \&  # If using SASL authentication for LDAP (OpenSSL)
 \&  # use_sasl yes
-\&  # sasl_auth_id <SASL username>
+\&  # sasl_auth_id <SASL user name>
 \&  # rootuse_sasl yes
-\&  # rootsasl_auth_id <SASL username for root access>
+\&  # rootsasl_auth_id <SASL user name for root access>
 \&  # sasl_secprops none
 \&  # krb5_ccname /etc/.ldapcache
 .Ve
-.Sh "Sudo schema for OpenLDAP"
+.SS "Sudo schema for OpenLDAP"
 .IX Subsection "Sudo schema for OpenLDAP"
 The following schema is in OpenLDAP format.  Simply copy it to the
 schema directory (e.g. \fI/etc/openldap/schema\fR), add the proper
diff --git a/sudoers.ldap.pod b/sudoers.ldap.pod
index 4e686f383..9da13cc85 100644
--- a/sudoers.ldap.pod
+++ b/sudoers.ldap.pod
@@ -637,9 +637,9 @@ determines sudoers source order on AIX
   #
   # If using SASL authentication for LDAP (OpenSSL)
   # use_sasl yes
-  # sasl_auth_id <SASL username>
+  # sasl_auth_id <SASL user name>
   # rootuse_sasl yes
-  # rootsasl_auth_id <SASL username for root access>
+  # rootsasl_auth_id <SASL user name for root access>
   # sasl_secprops none
   # krb5_ccname /etc/.ldapcache
 
diff --git a/sudoers.man.in b/sudoers.man.in
index 958299395..6df75dd95 100644
--- a/sudoers.man.in
+++ b/sudoers.man.in
@@ -19,18 +19,10 @@
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\" 
 .\" $Sudo$
-.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
+.\" Automatically generated by Pod::Man 2.22 (Pod::Simple 3.07)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
@@ -74,7 +66,7 @@
 .el       .ds Aq '
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .ie \nF \{\
@@ -153,7 +145,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOERS @mansectform@"
-.TH SUDOERS @mansectform@ "September 24, 2009" "1.7.2" "MAINTENANCE COMMANDS"
+.TH SUDOERS @mansectform@ "December 19, 2009" "1.7.3b2" "MAINTENANCE COMMANDS"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -173,7 +165,7 @@ not necessarily the most specific match).
 The \fIsudoers\fR grammar will be described below in Extended Backus-Naur
 Form (\s-1EBNF\s0).  Don't despair if you don't know what \s-1EBNF\s0 is; it is
 fairly simple, and the definitions below are annotated.
-.Sh "Quick guide to \s-1EBNF\s0"
+.SS "Quick guide to \s-1EBNF\s0"
 .IX Subsection "Quick guide to EBNF"
 \&\s-1EBNF\s0 is a concise and exact way of describing the grammar of a language.
 Each \s-1EBNF\s0 definition is made up of \fIproduction rules\fR.  E.g.,
@@ -206,7 +198,7 @@ one or more times.
 Parentheses may be used to group symbols together.  For clarity,
 we will use single quotes ('') to designate what is a verbatim character
 string (as opposed to a symbol name).
-.Sh "Aliases"
+.SS "Aliases"
 .IX Subsection "Aliases"
 There are four kinds of aliases: \f(CW\*(C`User_Alias\*(C'\fR, \f(CW\*(C`Runas_Alias\*(C'\fR,
 \&\f(CW\*(C`Host_Alias\*(C'\fR and \f(CW\*(C`Cmnd_Alias\*(C'\fR.
@@ -250,7 +242,7 @@ The definitions of what constitutes a valid \fIalias\fR member follow.
 \& User_List ::= User |
 \&               User \*(Aq,\*(Aq User_List
 \&
-\& User ::= \*(Aq!\*(Aq* username |
+\& User ::= \*(Aq!\*(Aq* user name |
 \&          \*(Aq!\*(Aq* \*(Aq#\*(Aquid |
 \&          \*(Aq!\*(Aq* \*(Aq%\*(Aqgroup |
 \&          \*(Aq!\*(Aq* \*(Aq+\*(Aqnetgroup |
@@ -258,13 +250,13 @@ The definitions of what constitutes a valid \fIalias\fR member follow.
 \&          \*(Aq!\*(Aq* User_Alias
 .Ve
 .PP
-A \f(CW\*(C`User_List\*(C'\fR is made up of one or more usernames, uids (prefixed
+A \f(CW\*(C`User_List\*(C'\fR is made up of one or more user names, uids (prefixed
 with '#'), system groups (prefixed with '%'), netgroups (prefixed
 with '+') and \f(CW\*(C`User_Alias\*(C'\fRes.  Each list item may be prefixed with
 zero or more '!' operators.  An odd number of '!' operators negate
 the value of the item; an even number just cancel each other out.
 .PP
-A \f(CW\*(C`username\*(C'\fR, \f(CW\*(C`group\*(C'\fR, \f(CW\*(C`netgroup\*(C'\fR and \f(CW\*(C`nonunix_groups\*(C'\fR may
+A \f(CW\*(C`user name\*(C'\fR, \f(CW\*(C`group\*(C'\fR, \f(CW\*(C`netgroup\*(C'\fR or \f(CW\*(C`nonunix_group\*(C'\fR may
 be enclosed in double quotes to avoid the need for escaping special
 characters.  Alternately, special characters may be specified in
 escaped hex mode, e.g. \ex20 for space.
@@ -285,7 +277,7 @@ use a backslash (\e) to escape spaces and the '@' symbol.
 \& Runas_List ::= Runas_Member |
 \&                Runas_Member \*(Aq,\*(Aq Runas_List
 \&
-\& Runas_Member ::= \*(Aq!\*(Aq* username |
+\& Runas_Member ::= \*(Aq!\*(Aq* user name |
 \&                  \*(Aq!\*(Aq* \*(Aq#\*(Aquid |
 \&                  \*(Aq!\*(Aq* \*(Aq%\*(Aqgroup |
 \&                  \*(Aq!\*(Aq* +netgroup |
@@ -294,23 +286,23 @@ use a backslash (\e) to escape spaces and the '@' symbol.
 .PP
 A \f(CW\*(C`Runas_List\*(C'\fR is similar to a \f(CW\*(C`User_List\*(C'\fR except that instead
 of \f(CW\*(C`User_Alias\*(C'\fRes it can contain \f(CW\*(C`Runas_Alias\*(C'\fRes.  Note that
-usernames and groups are matched as strings.  In other words, two
+user names and groups are matched as strings.  In other words, two
 users (groups) with the same uid (gid) are considered to be distinct.
-If you wish to match all usernames with the same uid (e.g.\ root
+If you wish to match all user names with the same uid (e.g.\ root
 and toor), you can use a uid instead (#0 in the example given).
 .PP
 .Vb 2
 \& Host_List ::= Host |
 \&               Host \*(Aq,\*(Aq Host_List
 \&
-\& Host ::= \*(Aq!\*(Aq* hostname |
+\& Host ::= \*(Aq!\*(Aq* host name |
 \&          \*(Aq!\*(Aq* ip_addr |
 \&          \*(Aq!\*(Aq* network(/netmask)? |
 \&          \*(Aq!\*(Aq* \*(Aq+\*(Aqnetgroup |
 \&          \*(Aq!\*(Aq* Host_Alias
 .Ve
 .PP
-A \f(CW\*(C`Host_List\*(C'\fR is made up of one or more hostnames, \s-1IP\s0 addresses,
+A \f(CW\*(C`Host_List\*(C'\fR is made up of one or more host names, \s-1IP\s0 addresses,
 network numbers, netgroups (prefixed with '+') and other aliases.
 Again, the value of an item may be negated with the '!' operator.
 If you do not specify a netmask along with the network number,
@@ -319,19 +311,19 @@ if the network number corresponds to one of the hosts's network
 interfaces, the corresponding netmask will be used.  The netmask
 may be specified either in standard \s-1IP\s0 address notation
 (e.g.\ 255.255.255.0 or ffff:ffff:ffff:ffff::),
-or \s-1CIDR\s0 notation (number of bits, e.g.\ 24 or 64).  A hostname may
+or \s-1CIDR\s0 notation (number of bits, e.g.\ 24 or 64).  A host name may
 include shell-style wildcards (see the Wildcards section below),
-but unless the \f(CW\*(C`hostname\*(C'\fR command on your machine returns the fully
-qualified hostname, you'll need to use the \fIfqdn\fR option for
+but unless the \f(CW\*(C`host name\*(C'\fR command on your machine returns the fully
+qualified host name, you'll need to use the \fIfqdn\fR option for
 wildcards to be useful.
 .PP
 .Vb 2
 \& Cmnd_List ::= Cmnd |
 \&               Cmnd \*(Aq,\*(Aq Cmnd_List
 \&
-\& commandname ::= filename |
-\&                 filename args |
-\&                 filename \*(Aq""\*(Aq
+\& commandname ::= file name |
+\&                 file name args |
+\&                 file name \*(Aq""\*(Aq
 \&
 \& Cmnd ::= \*(Aq!\*(Aq* commandname |
 \&          \*(Aq!\*(Aq* directory |
@@ -340,13 +332,13 @@ wildcards to be useful.
 .Ve
 .PP
 A \f(CW\*(C`Cmnd_List\*(C'\fR is a list of one or more commandnames, directories, and other
-aliases.  A commandname is a fully qualified filename which may include
+aliases.  A commandname is a fully qualified file name which may include
 shell-style wildcards (see the Wildcards section below).  A simple
-filename allows the user to run the command with any arguments he/she
+file name allows the user to run the command with any arguments he/she
 wishes.  However, you may also specify command line arguments (including
 wildcards).  Alternately, you can specify \f(CW""\fR to indicate that the command
 may only be run \fBwithout\fR command line arguments.  A directory is a
-fully qualified pathname ending in a '/'.  When you specify a directory
+fully qualified path name ending in a '/'.  When you specify a directory
 in a \f(CW\*(C`Cmnd_List\*(C'\fR, the user will be able to run any file within that directory
 (but not in any subdirectories therein).
 .PP
@@ -358,7 +350,7 @@ arguments: ',', ':', '=', '\e'.  The special command \f(CW"sudoedit"\fR
 is used to permit a user to run \fBsudo\fR with the \fB\-e\fR option (or
 as \fBsudoedit\fR).  It may take command line arguments just as
 a normal command does.
-.Sh "Defaults"
+.SS "Defaults"
 .IX Subsection "Defaults"
 Certain configuration options may be changed from their default
 values at runtime via one or more \f(CW\*(C`Default_Entry\*(C'\fR lines.  These
@@ -403,7 +395,7 @@ and user Defaults first, then runas Defaults and finally command
 defaults.
 .PP
 See \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" for a list of supported Defaults parameters.
-.Sh "User Specification"
+.SS "User Specification"
 .IX Subsection "User Specification"
 .Vb 2
 \& User_Spec ::= User_List Host_List \*(Aq=\*(Aq Cmnd_Spec_List \e
@@ -426,7 +418,7 @@ run as \fBroot\fR, but this can be changed on a per-command basis.
 .PP
 The basic structure of a user specification is `who = where (as_whom)
 what'.  Let's break that down into its constituent parts:
-.Sh "Runas_Spec"
+.SS "Runas_Spec"
 .IX Subsection "Runas_Spec"
 A \f(CW\*(C`Runas_Spec\*(C'\fR determines the user and/or the group that a command
 may be run as.  A fully-specified \f(CW\*(C`Runas_Spec\*(C'\fR consists of two
@@ -484,7 +476,7 @@ only the group will be set, the command still runs as user \fBtcm\fR.
 \& tcm    boulder = (:dialer) /usr/bin/tip, /usr/bin/cu, \e
 \&        /usr/local/bin/minicom
 .Ve
-.Sh "Tag_Spec"
+.SS "Tag_Spec"
 .IX Subsection "Tag_Spec"
 A command may have zero or more tags associated with it.  There are
 eight possible tag values, \f(CW\*(C`NOPASSWD\*(C'\fR, \f(CW\*(C`PASSWD\*(C'\fR, \f(CW\*(C`NOEXEC\*(C'\fR,
@@ -562,10 +554,10 @@ be overridden by use of the \f(CW\*(C`UNSETENV\*(C'\fR tag.
 These tags override the value of the \fItranscript\fR option on a
 per-command basis.  For more information, see the description of
 \&\fItranscript\fR in the \*(L"\s-1SUDOERS\s0 \s-1OPTIONS\s0\*(R" section below.
-.Sh "Wildcards"
+.SS "Wildcards"
 .IX Subsection "Wildcards"
 \&\fBsudo\fR allows shell-style \fIwildcards\fR (aka meta or glob characters)
-to be used in hostnames, pathnames and command line arguments in
+to be used in host names, path names and command line arguments in
 the \fIsudoers\fR file.  Wildcard matching is done via the \fB\s-1POSIX\s0\fR
 \&\fIglob\fR\|(3) and \fIfnmatch\fR\|(3) routines.  Note that these are \fInot\fR
 regular expressions.
@@ -600,10 +592,10 @@ escaped.  For example:
 \&    /bin/ls [[\e:alpha\e:]]*
 .Ve
 .PP
-Would match any filename beginning with a letter.
+Would match any file name beginning with a letter.
 .PP
 Note that a forward slash ('/') will \fBnot\fR be matched by
-wildcards used in the pathname.  When matching the command
+wildcards used in the path name.  When matching the command
 line arguments, however, a slash \fBdoes\fR get matched by
 wildcards.  This is to make a path like:
 .PP
@@ -612,7 +604,7 @@ wildcards.  This is to make a path like:
 .Ve
 .PP
 match \fI/usr/bin/who\fR but not \fI/usr/bin/X11/xterm\fR.
-.Sh "Exceptions to wildcard rules"
+.SS "Exceptions to wildcard rules"
 .IX Subsection "Exceptions to wildcard rules"
 The following exceptions apply to the above rules:
 .ie n .IP """""" 8
@@ -621,7 +613,7 @@ The following exceptions apply to the above rules:
 If the empty string \f(CW""\fR is the only command line argument in the
 \&\fIsudoers\fR entry it means that command is not allowed to be run
 with \fBany\fR arguments.
-.Sh "Including other files from within sudoers"
+.SS "Including other files from within sudoers"
 .IX Subsection "Including other files from within sudoers"
 It is possible to include other \fIsudoers\fR files from within the
 \&\fIsudoers\fR file currently being parsed using the \f(CW\*(C`#include\*(C'\fR and
@@ -645,8 +637,8 @@ Upon reaching the end of \fI/etc/sudoers.local\fR, the rest of
 themselves include other files.  A hard limit of 128 nested include
 files is enforced to prevent include file loops.
 .PP
-The filename may include the \f(CW%h\fR escape, signifying the short form
-of the hostname.  I.e., if the machine's hostname is \*(L"xerxes\*(R", then
+The file name may include the \f(CW%h\fR escape, signifying the short form
+of the host name.  I.e., if the machine's host name is \*(L"xerxes\*(R", then
 .PP
 \&\f(CW\*(C`#include /etc/sudoers.%h\*(C'\fR
 .PP
@@ -673,7 +665,7 @@ Note that unlike files included via \f(CW\*(C`#include\*(C'\fR, \fBvisudo\fR wil
 edit the files in a \f(CW\*(C`#includedir\*(C'\fR directory unless one of them
 contains a syntax error.  It is still possible to run \fBvisudo\fR
 with the \f(CW\*(C`\-f\*(C'\fR flag to edit the files directly.
-.Sh "Other special characters and reserved words"
+.SS "Other special characters and reserved words"
 .IX Subsection "Other special characters and reserved words"
 The pound sign ('#') is used to indicate a comment (unless it is
 part of a #include directive or unless it occurs in the context of
@@ -703,7 +695,7 @@ Whitespace between elements in a list as well as special syntactic
 characters in a \fIUser Specification\fR ('=', ':', '(', ')') is optional.
 .PP
 The following characters must be escaped with a backslash ('\e') when
-used as part of a word (e.g.\ a username or hostname):
+used as part of a word (e.g.\ a user name or host name):
 \&'@', '!', '=', ':', ',', '(', ')', '\e'.
 .SH "SUDOERS OPTIONS"
 .IX Header "SUDOERS OPTIONS"
@@ -729,6 +721,11 @@ This flag is \fIon\fR by default.
 If set, the user may use \fBsudo\fR's \fB\-C\fR option which
 overrides the default starting point at which \fBsudo\fR begins
 closing open file descriptors.  This flag is \fIoff\fR by default.
+.IP "compress_transcript" 16
+.IX Item "compress_transcript"
+If set, and the \fItranscript\fR flag is also set, \fBsudo\fR will compress
+the transcript logs using \fBzlib\fR.  This flag is \fIon\fR by default
+when \fBsudo\fR is compiled with \fBzlib\fR support.
 .IP "env_editor" 16
 .IX Item "env_editor"
 If set, \fBvisudo\fR will use the value of the \s-1EDITOR\s0 or \s-1VISUAL\s0
@@ -752,17 +749,17 @@ This flag is \fIon\fR by default.
 .IP "fast_glob" 16
 .IX Item "fast_glob"
 Normally, \fBsudo\fR uses the \fIglob\fR\|(3) function to do shell-style
-globbing when matching pathnames.  However, since it accesses the
+globbing when matching path names.  However, since it accesses the
 file system, \fIglob\fR\|(3) can take a long time to complete for some
 patterns, especially when the pattern references a network file
 system that is mounted on demand (automounted).  The \fIfast_glob\fR
 option causes \fBsudo\fR to use the \fIfnmatch\fR\|(3) function, which does
 not access the file system to do its matching.  The disadvantage
-of \fIfast_glob\fR is that it is unable to match relative pathnames
+of \fIfast_glob\fR is that it is unable to match relative path names
 such as \fI./ls\fR or \fI../bin/ls\fR.  This flag is \fIoff\fR by default.
 .IP "fqdn" 16
 .IX Item "fqdn"
-Set this flag if you want to put fully qualified hostnames in the
+Set this flag if you want to put fully qualified host names in the
 \&\fIsudoers\fR file.  I.e., instead of myhost you would use myhost.mydomain.edu.
 You may still use the short form if you wish (and even mix the two).
 Beware that turning on \fIfqdn\fR requires \fBsudo\fR to make \s-1DNS\s0 lookups
@@ -771,7 +768,7 @@ if the machine is not plugged into the network).  Also note that
 you must use the host's official name as \s-1DNS\s0 knows it.  That is,
 you may not use a host alias (\f(CW\*(C`CNAME\*(C'\fR entry) due to performance
 issues and the fact that there is no way to get all aliases from
-\&\s-1DNS\s0.  If your machine's hostname (as returned by the \f(CW\*(C`hostname\*(C'\fR
+\&\s-1DNS\s0.  If your machine's host name (as returned by the \f(CW\*(C`hostname\*(C'\fR
 command) is already fully qualified you shouldn't need to set
 \&\fIfqdn\fR.  This flag is \fI@fqdn@\fR by default.
 .IP "ignore_dot" 16
@@ -795,7 +792,7 @@ If set, \fBsudo\fR will insult users when they enter an incorrect
 password.  This flag is \fI@insults@\fR by default.
 .IP "log_host" 16
 .IX Item "log_host"
-If set, the hostname will be logged in the (non-syslog) \fBsudo\fR log file.
+If set, the host name will be logged in the (non-syslog) \fBsudo\fR log file.
 This flag is \fIoff\fR by default.
 .IP "log_year" 16
 .IX Item "log_year"
@@ -939,11 +936,12 @@ is only effective on systems with either the \fIsetreuid()\fR or \fIsetresuid()\
 function.  This flag is \fIoff\fR by default.
 .IP "targetpw" 16
 .IX Item "targetpw"
-If set, \fBsudo\fR will prompt for the password of the user specified by
-the \fB\-u\fR option (defaults to \f(CW\*(C`root\*(C'\fR) instead of the password of the
-invoking user.  Note that this precludes the use of a uid not listed
-in the passwd database as an argument to the \fB\-u\fR option.
-This flag is \fIoff\fR by default.
+If set, \fBsudo\fR will prompt for the password of the user specified
+by the \fB\-u\fR option (defaults to \f(CW\*(C`root\*(C'\fR) instead of the password
+of the invoking user.  In addition, the timestamp file name will
+include the target user's name.  Note that this flag precludes the
+use of a uid not listed in the passwd database as an argument to
+the \fB\-u\fR option.  This flag is \fIoff\fR by default.
 .IP "transcript" 16
 .IX Item "transcript"
 If set, \fBsudo\fR will log a transcript of the command being run,
@@ -1014,12 +1012,15 @@ effect on the syslog log file, only the file log.  The default is
 .IP "passwd_timeout" 16
 .IX Item "passwd_timeout"
 Number of minutes before the \fBsudo\fR password prompt times out.
-The default is \f(CW\*(C`@password_timeout@\*(C'\fR; set this to \f(CW0\fR for no password timeout.
+The timeout may include a fractional component if minute granularity
+is insufficient, for example \f(CW2.5\fR.  The default is \f(CW\*(C`@password_timeout@\*(C'\fR;
+set this to \f(CW0\fR for no password timeout.
 .IP "timestamp_timeout" 16
 .IX Item "timestamp_timeout"
 Number of minutes that can elapse before \fBsudo\fR will ask for a
-passwd again.  The default is \f(CW\*(C`@timeout@\*(C'\fR.  Set this to \f(CW0\fR to always
-prompt for a password.
+passwd again.  The timeout may include a fractional component if
+minute granularity is insufficient, for example \f(CW2.5\fR.  The default
+is \f(CW\*(C`@timeout@\*(C'\fR.  Set this to \f(CW0\fR to always prompt for a password.
 If set to a value less than \f(CW0\fR the user's timestamp will never
 expire.  This can be used to allow users to create or delete their
 own timestamps via \f(CW\*(C`sudo \-v\*(C'\fR and \f(CW\*(C`sudo \-k\*(C'\fR respectively.
@@ -1048,7 +1049,7 @@ on your system.
 .IP "mailsub" 16
 .IX Item "mailsub"
 Subject of the mail sent to the \fImailto\fR user. The escape \f(CW%h\fR
-will expand to the hostname of the machine.
+will expand to the host name of the machine.
 Default is \f(CW\*(C`@mailsub@\*(C'\fR.
 .IP "noexec_file" 16
 .IX Item "noexec_file"
@@ -1065,13 +1066,13 @@ The following percent (`\f(CW\*(C`%\*(C'\fR') escapes are supported:
 .ie n .IP "%H" 4
 .el .IP "\f(CW%H\fR" 4
 .IX Item "%H"
-expanded to the local hostname including the domain name
-(on if the machine's hostname is fully qualified or the \fIfqdn\fR
+expanded to the local host name including the domain name
+(on if the machine's host name is fully qualified or the \fIfqdn\fR
 option is set)
 .ie n .IP "%h" 4
 .el .IP "\f(CW%h\fR" 4
 .IX Item "%h"
-expanded to the local hostname without the domain name
+expanded to the local host name without the domain name
 .ie n .IP "%p" 4
 .el .IP "\f(CW%p\fR" 4
 .IX Item "%p"
@@ -1468,7 +1469,7 @@ groups).
 .PP
 The user \fBpete\fR is allowed to change anyone's password except for
 root on the \fI\s-1HPPA\s0\fR machines.  Note that this assumes \fIpasswd\fR\|(1)
-does not take multiple usernames on the command line.
+does not take multiple user names on the command line.
 .PP
 .Vb 1
 \& bob            SPARC = (OP) ALL : SGI = (OP) ALL
@@ -1651,8 +1652,8 @@ imperative that \fIsudoers\fR be free of syntax errors since \fBsudo\fR
 will not run with a syntactically incorrect \fIsudoers\fR file.
 .PP
 When using netgroups of machines (as opposed to users), if you
-store fully qualified hostnames in the netgroup (as is usually the
-case), you either need to have the machine's hostname be fully qualified
+store fully qualified host name in the netgroup (as is usually the
+case), you either need to have the machine's host name be fully qualified
 as returned by the \f(CW\*(C`hostname\*(C'\fR command or use the \fIfqdn\fR option in
 \&\fIsudoers\fR.
 .SH "BUGS"
diff --git a/sudoers.pod b/sudoers.pod
index b38ed6567..d23396993 100644
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -112,20 +112,20 @@ The definitions of what constitutes a valid I<alias> member follow.
  User_List ::= User |
 	       User ',' User_List
 
- User ::= '!'* username |
+ User ::= '!'* user name |
 	  '!'* '#'uid |
 	  '!'* '%'group |
 	  '!'* '+'netgroup |
 	  '!'* '%:'nonunix_group |
 	  '!'* User_Alias
 
-A C<User_List> is made up of one or more usernames, uids (prefixed
+A C<User_List> is made up of one or more user names, uids (prefixed
 with '#'), system groups (prefixed with '%'), netgroups (prefixed
 with '+') and C<User_Alias>es.  Each list item may be prefixed with
 zero or more '!' operators.  An odd number of '!' operators negate
 the value of the item; an even number just cancel each other out.
 
-A C<username>, C<group>, C<netgroup> and C<nonunix_groups> may
+A C<user name>, C<group>, C<netgroup> or C<nonunix_group> may
 be enclosed in double quotes to avoid the need for escaping special
 characters.  Alternately, special characters may be specified in
 escaped hex mode, e.g. \x20 for space.
@@ -155,7 +155,7 @@ use a backslash (\) to escape spaces and the '@' symbol.
  Runas_List ::= Runas_Member |
 		Runas_Member ',' Runas_List
 
- Runas_Member ::= '!'* username |
+ Runas_Member ::= '!'* user name |
 	          '!'* '#'uid |
 	          '!'* '%'group |
 	          '!'* +netgroup |
@@ -163,21 +163,21 @@ use a backslash (\) to escape spaces and the '@' symbol.
 
 A C<Runas_List> is similar to a C<User_List> except that instead
 of C<User_Alias>es it can contain C<Runas_Alias>es.  Note that
-usernames and groups are matched as strings.  In other words, two
+user names and groups are matched as strings.  In other words, two
 users (groups) with the same uid (gid) are considered to be distinct.
-If you wish to match all usernames with the same uid (e.g.E<nbsp>root
+If you wish to match all user names with the same uid (e.g.E<nbsp>root
 and toor), you can use a uid instead (#0 in the example given).
 
  Host_List ::= Host |
 	       Host ',' Host_List
 
- Host ::= '!'* hostname |
+ Host ::= '!'* host name |
 	  '!'* ip_addr |
 	  '!'* network(/netmask)? |
 	  '!'* '+'netgroup |
 	  '!'* Host_Alias
 
-A C<Host_List> is made up of one or more hostnames, IP addresses,
+A C<Host_List> is made up of one or more host names, IP addresses,
 network numbers, netgroups (prefixed with '+') and other aliases.
 Again, the value of an item may be negated with the '!' operator.
 If you do not specify a netmask along with the network number,
@@ -186,10 +186,10 @@ if the network number corresponds to one of the hosts's network
 interfaces, the corresponding netmask will be used.  The netmask
 may be specified either in standard IP address notation
 (e.g.E<nbsp>255.255.255.0 or ffff:ffff:ffff:ffff::),
-or CIDR notation (number of bits, e.g.E<nbsp>24 or 64).  A hostname may
+or CIDR notation (number of bits, e.g.E<nbsp>24 or 64).  A host name may
 include shell-style wildcards (see the L<Wildcards> section below),
-but unless the C<hostname> command on your machine returns the fully
-qualified hostname, you'll need to use the I<fqdn> option for
+but unless the C<host name> command on your machine returns the fully
+qualified host name, you'll need to use the I<fqdn> option for
 wildcards to be useful.
 
  Cmnd_List ::= Cmnd |
@@ -211,7 +211,7 @@ file name allows the user to run the command with any arguments he/she
 wishes.  However, you may also specify command line arguments (including
 wildcards).  Alternately, you can specify C<""> to indicate that the command
 may only be run B<without> command line arguments.  A directory is a
-fully qualified pathname ending in a '/'.  When you specify a directory
+fully qualified path name ending in a '/'.  When you specify a directory
 in a C<Cmnd_List>, the user will be able to run any file within that directory
 (but not in any subdirectories therein).
 
@@ -411,7 +411,7 @@ I<transcript> in the L<"SUDOERS OPTIONS"> section below.
 =head2 Wildcards
 
 B<sudo> allows shell-style I<wildcards> (aka meta or glob characters)
-to be used in hostnames, pathnames and command line arguments in
+to be used in host names, path names and command line arguments in
 the I<sudoers> file.  Wildcard matching is done via the B<POSIX>
 L<glob(3)> and L<fnmatch(3)> routines.  Note that these are I<not>
 regular expressions.
@@ -451,7 +451,7 @@ escaped.  For example:
 Would match any file name beginning with a letter.
 
 Note that a forward slash ('/') will B<not> be matched by
-wildcards used in the pathname.  When matching the command
+wildcards used in the path name.  When matching the command
 line arguments, however, a slash B<does> get matched by
 wildcards.  This is to make a path like:
 
@@ -500,7 +500,7 @@ themselves include other files.  A hard limit of 128 nested include
 files is enforced to prevent include file loops.
 
 The file name may include the C<%h> escape, signifying the short form
-of the hostname.  I.e., if the machine's hostname is "xerxes", then
+of the host name.  I.e., if the machine's host name is "xerxes", then
 
 C<#include /etc/sudoers.%h>
 
@@ -558,7 +558,7 @@ Whitespace between elements in a list as well as special syntactic
 characters in a I<User Specification> ('=', ':', '(', ')') is optional.
 
 The following characters must be escaped with a backslash ('\') when
-used as part of a word (e.g.E<nbsp>a username or hostname):
+used as part of a word (e.g.E<nbsp>a user name or host name):
 '@', '!', '=', ':', ',', '(', ')', '\'.
 
 =head1 SUDOERS OPTIONS
@@ -622,18 +622,18 @@ This flag is I<on> by default.
 =item fast_glob
 
 Normally, B<sudo> uses the L<glob(3)> function to do shell-style
-globbing when matching pathnames.  However, since it accesses the
+globbing when matching path names.  However, since it accesses the
 file system, L<glob(3)> can take a long time to complete for some
 patterns, especially when the pattern references a network file
 system that is mounted on demand (automounted).  The I<fast_glob>
 option causes B<sudo> to use the L<fnmatch(3)> function, which does
 not access the file system to do its matching.  The disadvantage
-of I<fast_glob> is that it is unable to match relative pathnames
+of I<fast_glob> is that it is unable to match relative path names
 such as F<./ls> or F<../bin/ls>.  This flag is I<off> by default.
 
 =item fqdn
 
-Set this flag if you want to put fully qualified hostnames in the
+Set this flag if you want to put fully qualified host names in the
 I<sudoers> file.  I.e., instead of myhost you would use myhost.mydomain.edu.
 You may still use the short form if you wish (and even mix the two).
 Beware that turning on I<fqdn> requires B<sudo> to make DNS lookups
@@ -642,7 +642,7 @@ if the machine is not plugged into the network).  Also note that
 you must use the host's official name as DNS knows it.  That is,
 you may not use a host alias (C<CNAME> entry) due to performance
 issues and the fact that there is no way to get all aliases from
-DNS.  If your machine's hostname (as returned by the C<hostname>
+DNS.  If your machine's host name (as returned by the C<hostname>
 command) is already fully qualified you shouldn't need to set
 I<fqdn>.  This flag is I<@fqdn@> by default.
 
@@ -670,7 +670,7 @@ password.  This flag is I<@insults@> by default.
 
 =item log_host
 
-If set, the hostname will be logged in the (non-syslog) B<sudo> log file.
+If set, the host name will be logged in the (non-syslog) B<sudo> log file.
 This flag is I<off> by default.
 
 =item log_year
@@ -975,7 +975,7 @@ on your system.
 =item mailsub
 
 Subject of the mail sent to the I<mailto> user. The escape C<%h>
-will expand to the hostname of the machine.
+will expand to the host name of the machine.
 Default is C<@mailsub@>.
 
 =item noexec_file
@@ -995,13 +995,13 @@ The following percent (`C<%>') escapes are supported:
 
 =item C<%H>
 
-expanded to the local hostname including the domain name
-(on if the machine's hostname is fully qualified or the I<fqdn>
+expanded to the local host name including the domain name
+(on if the machine's host name is fully qualified or the I<fqdn>
 option is set)
 
 =item C<%h>
 
-expanded to the local hostname without the domain name
+expanded to the local host name without the domain name
 
 =item C<%p>
 
@@ -1431,7 +1431,7 @@ groups).
 
 The user B<pete> is allowed to change anyone's password except for
 root on the I<HPPA> machines.  Note that this assumes L<passwd(1)>
-does not take multiple usernames on the command line.
+does not take multiple user names on the command line.
 
  bob		SPARC = (OP) ALL : SGI = (OP) ALL
 
@@ -1594,8 +1594,8 @@ imperative that I<sudoers> be free of syntax errors since B<sudo>
 will not run with a syntactically incorrect I<sudoers> file.
 
 When using netgroups of machines (as opposed to users), if you
-store fully qualified hostnames in the netgroup (as is usually the
-case), you either need to have the machine's hostname be fully qualified
+store fully qualified host name in the netgroup (as is usually the
+case), you either need to have the machine's host name be fully qualified
 as returned by the C<hostname> command or use the I<fqdn> option in
 I<sudoers>.
 
diff --git a/sudoreplay.cat b/sudoreplay.cat
index 56dc10a83..f32100b06 100644
--- a/sudoreplay.cat
+++ b/sudoreplay.cat
@@ -61,7 +61,7 @@ OOPPTTIIOONNSS
 
 
 
-1.7.2                    October  6, 2009                       1
+1.7.3b2                 December 19, 2009                       1
 
 
 
@@ -96,9 +96,9 @@ SUDOREPLAY(1m)         MAINTENANCE COMMANDS        SUDOREPLAY(1m)
                            specified without the _/_d_e_v_/ prefix, e.g.  _t_t_y_0_1
                            instead of _/_d_e_v_/_t_t_y_0_1.
 
-                   user _u_s_e_r_n_a_m_e
+                   user _u_s_e_r _n_a_m_e
                            Evaluates to true if the ID matches a command run
-                           by _u_s_e_r_n_a_m_e.
+                           by _u_s_e_r _n_a_m_e.
 
                    Predicates may be abbreviated to the shortest unique string
                    (currently all predicates may be shortened to a single
@@ -127,7 +127,7 @@ SUDOREPLAY(1m)         MAINTENANCE COMMANDS        SUDOREPLAY(1m)
 
 
 
-1.7.2                    October  6, 2009                       2
+1.7.3b2                 December 19, 2009                       2
 
 
 
@@ -193,7 +193,7 @@ SUDOREPLAY(1m)         MAINTENANCE COMMANDS        SUDOREPLAY(1m)
 
 
 
-1.7.2                    October  6, 2009                       3
+1.7.3b2                 December 19, 2009                       3
 
 
 
@@ -259,7 +259,7 @@ SSUUPPPPOORRTT
 
 
 
-1.7.2                    October  6, 2009                       4
+1.7.3b2                 December 19, 2009                       4
 
 
 
@@ -325,6 +325,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7.2                    October  6, 2009                       5
+1.7.3b2                 December 19, 2009                       5
 
 
diff --git a/sudoreplay.man.in b/sudoreplay.man.in
index 6ff18363d..40ba8ddfc 100644
--- a/sudoreplay.man.in
+++ b/sudoreplay.man.in
@@ -140,7 +140,7 @@
 .\" ========================================================================
 .\"
 .IX Title "SUDOREPLAY @mansectsu@"
-.TH SUDOREPLAY @mansectsu@ "October  6, 2009" "1.7.2" "MAINTENANCE COMMANDS"
+.TH SUDOREPLAY @mansectsu@ "December 19, 2009" "1.7.3b2" "MAINTENANCE COMMANDS"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -222,9 +222,9 @@ date and time formats.
 Evaluates to true if the command was run on the specified terminal
 device.  The \fItty\fR should be specified without the \fI/dev/\fR prefix,
 e.g.  \fItty01\fR instead of \fI/dev/tty01\fR.
-.IP "user \fIusername\fR" 8
-.IX Item "user username"
-Evaluates to true if the \s-1ID\s0 matches a command run by \fIusername\fR.
+.IP "user \fIuser name\fR" 8
+.IX Item "user user name"
+Evaluates to true if the \s-1ID\s0 matches a command run by \fIuser name\fR.
 .RE
 .RS 12
 .Sp
diff --git a/sudoreplay.pod b/sudoreplay.pod
index 42c12187b..fb3bef399 100644
--- a/sudoreplay.pod
+++ b/sudoreplay.pod
@@ -119,9 +119,9 @@ Evaluates to true if the command was run on the specified terminal
 device.  The I<tty> should be specified without the F</dev/> prefix,
 e.g.  F<tty01> instead of F</dev/tty01>.
 
-=item user I<username>
+=item user I<user name>
 
-Evaluates to true if the ID matches a command run by I<username>.
+Evaluates to true if the ID matches a command run by I<user name>.
 
 =back
 
diff --git a/visudo.cat b/visudo.cat
index 51c822e7a..74deba8c6 100644
--- a/visudo.cat
+++ b/visudo.cat
@@ -61,7 +61,7 @@ OOPPTTIIOONNSS
 
 
 
-1.7.2                     June 11, 2009                         1
+1.7.3b2                 December 19, 2009                       1
 
 
 
@@ -76,7 +76,7 @@ VISUDO(1m)             MAINTENANCE COMMANDS            VISUDO(1m)
        -s          Enable ssttrriicctt checking of the _s_u_d_o_e_r_s file.  If an alias is
                    used before it is defined, vviissuuddoo will consider this a
                    parse error.  Note that it is not possible to differentiate
-                   between an alias and a hostname or username that consists
+                   between an alias and a host name or user name that consists
                    solely of uppercase letters, digits, and the underscore
                    ('_') character.
 
@@ -108,7 +108,7 @@ DDIIAAGGNNOOSSTTIICCSS
 
        Warning: {User,Runas,Host,Cmnd}_Alias referenced but not defined
            Either you are trying to use an undeclare
-           {User,Runas,Host,Cmnd}_Alias or you have a user or hostname listed
+           {User,Runas,Host,Cmnd}_Alias or you have a user or host name listed
            that consists solely of uppercase letters, digits, and the
            underscore ('_') character.  In the latter case, you can ignore the
            warnings (ssuuddoo will not complain).  In --ss (strict) mode these are
@@ -127,7 +127,7 @@ AAUUTTHHOORR
 
 
 
-1.7.2                     June 11, 2009                         2
+1.7.3b2                 December 19, 2009                       2
 
 
 
@@ -193,6 +193,6 @@ DDIISSCCLLAAIIMMEERR
 
 
 
-1.7.2                     June 11, 2009                         3
+1.7.3b2                 December 19, 2009                       3
 
 
diff --git a/visudo.man.in b/visudo.man.in
index 1463ce3a1..509020ccc 100644
--- a/visudo.man.in
+++ b/visudo.man.in
@@ -19,18 +19,10 @@
 .\" Materiel Command, USAF, under agreement number F39502-99-1-0512.
 .\" 
 .\" $Sudo$
-.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
+.\" Automatically generated by Pod::Man 2.22 (Pod::Simple 3.07)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
-.de Sh \" Subsection heading
-.br
-.if t .Sp
-.ne 5
-.PP
-\fB\\$1\fR
-.PP
-..
 .de Sp \" Vertical space (when we can't use .PP)
 .if t .sp .5v
 .if n .sp
@@ -74,7 +66,7 @@
 .el       .ds Aq '
 .\"
 .\" If the F register is turned on, we'll generate index entries on stderr for
-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
 .\" entries marked with X<> in POD.  Of course, you'll have to process the
 .\" output yourself in some meaningful fashion.
 .ie \nF \{\
@@ -153,7 +145,7 @@
 .\" ========================================================================
 .\"
 .IX Title "VISUDO @mansectsu@"
-.TH VISUDO @mansectsu@ "June 11, 2009" "1.7.2" "MAINTENANCE COMMANDS"
+.TH VISUDO @mansectsu@ "December 19, 2009" "1.7.3b2" "MAINTENANCE COMMANDS"
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -223,7 +215,7 @@ the \fB\-c\fR option.
 Enable \fBstrict\fR checking of the \fIsudoers\fR file.  If an alias is
 used before it is defined, \fBvisudo\fR will consider this a parse
 error.  Note that it is not possible to differentiate between an
-alias and a hostname or username that consists solely of uppercase
+alias and a host name or user name that consists solely of uppercase
 letters, digits, and the underscore ('_') character.
 .IP "\-V" 12
 .IX Item "-V"
@@ -266,7 +258,7 @@ Your userid does not appear in the system passwd file.
 .IP "Warning: {User,Runas,Host,Cmnd}_Alias referenced but not defined" 4
 .IX Item "Warning: {User,Runas,Host,Cmnd}_Alias referenced but not defined"
 Either you are trying to use an undeclare {User,Runas,Host,Cmnd}_Alias
-or you have a user or hostname listed that consists solely of
+or you have a user or host name listed that consists solely of
 uppercase letters, digits, and the underscore ('_') character.  In
 the latter case, you can ignore the warnings (\fBsudo\fR will not
 complain).  In \fB\-s\fR (strict) mode these are errors, not warnings.
diff --git a/visudo.pod b/visudo.pod
index 2f82746e2..37953718f 100644
--- a/visudo.pod
+++ b/visudo.pod
@@ -96,7 +96,7 @@ the B<-c> option.
 Enable B<strict> checking of the I<sudoers> file.  If an alias is
 used before it is defined, B<visudo> will consider this a parse
 error.  Note that it is not possible to differentiate between an
-alias and a hostname or username that consists solely of uppercase
+alias and a host name or user name that consists solely of uppercase
 letters, digits, and the underscore ('_') character.
 
 =item -V
@@ -156,7 +156,7 @@ Your userid does not appear in the system passwd file.
 =item Warning: {User,Runas,Host,Cmnd}_Alias referenced but not defined
 
 Either you are trying to use an undeclare {User,Runas,Host,Cmnd}_Alias
-or you have a user or hostname listed that consists solely of
+or you have a user or host name listed that consists solely of
 uppercase letters, digits, and the underscore ('_') character.  In
 the latter case, you can ignore the warnings (B<sudo> will not
 complain).  In B<-s> (strict) mode these are errors, not warnings.