Make sudo pass -Wmissing-prototypes

configure

@@ -32298,7 +32298,7 @@ printf "%s\n" "#define os_init $OS_INIT" >>confdefs.h
 
 if test -n "$GCC"; then
     if test X"$enable_warnings" = X"yes" -o X"$with_devel" = X"yes"; then
-				CFLAGS="${CFLAGS} -Wall -Wsign-compare -Wpointer-arith -Wno-unknown-pragmas"
+				CFLAGS="${CFLAGS} -Wall -Wsign-compare -Wpointer-arith -Wno-unknown-pragmas -Wmissing-prototypes"
 	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -Wshadow" >&5
 printf %s "checking whether C compiler accepts -Wshadow... " >&6; }
 if test ${ax_cv_check_cflags___Wshadow+y}

configure.ac

@@ -4995,7 +4995,7 @@ if test -n "$GCC"; then
 	dnl
 	dnl Default warnings for development use.
 	dnl
-	CFLAGS="${CFLAGS} -Wall -Wsign-compare -Wpointer-arith -Wno-unknown-pragmas"
+	CFLAGS="${CFLAGS} -Wall -Wsign-compare -Wpointer-arith -Wno-unknown-pragmas -Wmissing-prototypes"
 	AX_CHECK_COMPILE_FLAG([-Wshadow], [CFLAGS="$CFLAGS -Wshadow"])
 	dnl
 	dnl The fallthrough attribute is supported by gcc 7.0 and clang 10.

include/sudo_iolog.h

@@ -146,7 +146,7 @@ bool iolog_swapids(bool restore);
 bool iolog_mkdirs(char *path);
 
 /* iolog_filter.c */
-void *iolog_pwfilt_alloc();
+void *iolog_pwfilt_alloc(void);
 bool iolog_pwfilt_add(void *handle, const char *pattern);
 void iolog_pwfilt_free(void *handle);
 bool iolog_pwfilt_remove(void *handle, const char *pattern);

include/sudo_util.h

@@ -299,6 +299,8 @@ sudo_dso_public int sudo_strtobool_v1(const char *str);
 /* strtonum.c */
 /* Not versioned for historical reasons. */
 sudo_dso_public long long sudo_strtonum(const char *, long long, long long, const char **);
+/* Not currently exported. */
+long long sudo_strtonumx(const char *str, long long minval, long long maxval, char **endp, const char **errstrp);
 
 /* strtoid.c */
 sudo_dso_public id_t sudo_strtoid_v1(const char *str, const char *sep, char **endp, const char **errstr);

lib/iolog/host_port.c

@@ -30,6 +30,7 @@
 #include "sudo_debug.h"
 #include "sudo_gettext.h"
 #include "sudo_util.h"
+#include "sudo_iolog.h"
 
 /*
  * Parse a string in the form host[:port] where host can also be

lib/iolog/regress/fuzz/fuzz_iolog_json.c

@@ -36,6 +36,8 @@
 
 #include "iolog_json.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 static FILE *
 open_data(const uint8_t *data, size_t size)
 {

lib/iolog/regress/fuzz/fuzz_iolog_legacy.c

@@ -34,6 +34,8 @@
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 static FILE *
 open_data(const uint8_t *data, size_t size)
 {

lib/iolog/regress/fuzz/fuzz_iolog_timing.c

@@ -41,6 +41,8 @@
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 static int
 fuzz_conversation(int num_msgs, const struct sudo_conv_message msgs[],
     struct sudo_conv_reply replies[], struct sudo_conv_callback *callback)

lib/iolog/regress/iolog_json/check_iolog_json.c

@@ -34,7 +34,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-bool
+static bool
 json_print_object(struct json_container *json, struct json_object *object)
 {
     struct json_item *item;

lib/iolog/regress/iolog_timing/check_iolog_timing.c

@@ -49,7 +49,7 @@ static struct parse_delay_test {
 /*
  * Test iolog_parse_delay()
  */
-void
+static void
 test_parse_delay(int *ntests, int *nerrors)
 {
     unsigned int i;
@@ -106,7 +106,7 @@ static struct adjust_delay_test {
 /*
  * Test iolog_adjust_delay()
  */
-void
+static void
 test_adjust_delay(int *ntests, int *nerrors)
 {
     unsigned int i;

lib/util/regress/fuzz/fuzz_sudo_conf.c

@@ -33,6 +33,8 @@
 #include "sudo_plugin.h"
 #include "sudo_util.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 static int
 fuzz_conversation(int num_msgs, const struct sudo_conv_message msgs[],
     struct sudo_conv_reply replies[], struct sudo_conv_callback *callback)

lib/util/regress/glob/globtest.c

@@ -183,7 +183,8 @@ main(int argc, char **argv)
 	return errors;
 }
 
-int test_glob(struct gl_entry *entry)
+static int
+test_glob(struct gl_entry *entry)
 {
 	glob_t gl;
 	char **ap;

lib/util/regress/mktemp/mktemp_test.c

@@ -50,7 +50,7 @@ sudo_dso_public int main(int argc, char *argv[]);
  * reasonable expansion of the template and matches the fd.  Returns true
  * if all the X's were replaced with non-X's
  */
-int
+static int
 check(int fd, char const *kind, char const *path, char const *prefix,
     size_t plen, char const *suffix, size_t slen, int tlen)
 {
@@ -86,7 +86,7 @@ check(int fd, char const *kind, char const *path, char const *prefix,
 	return 1;
 }
 
-void
+static void
 try_mkdtemp(char *p, char const *prefix, int len)
 {
 	size_t plen = strlen(prefix);
@@ -105,7 +105,7 @@ try_mkdtemp(char *p, char const *prefix, int len)
 	sudo_fatalx("mkdtemp: exceeded MAX_TRIES");
 }
 
-void
+static void
 try_mkstemps(char *p, char const *prefix, int len, char const *suffix)
 {
 	size_t plen = strlen(prefix);

lib/util/strtoid.c

@@ -39,9 +39,6 @@
 #include "sudo_gettext.h"
 #include "sudo_util.h"
 
-/* strtoid.c (not exported) */
-long long sudo_strtonumx(const char *str, long long minval, long long maxval, char **ep, const char **errstrp);
-
 /*
  * Make sure that the ID ends with a valid separator char.
  */

logsrvd/logsrvd.c

@@ -311,7 +311,7 @@ get_free_buf(size_t len, struct connection_closure *closure)
     debug_return_ptr(buf);
 }
 
-bool
+static bool
 fmt_server_message(struct connection_closure *closure, ServerMessage *msg)
 {
     struct connection_buffer *buf = NULL;

logsrvd/logsrvd_relay.c

@@ -295,7 +295,7 @@ bad:
  * Returns 0 on success, -1 on error, setting errno.
  * If there is no next relay, errno is set to ENOENT.
  */
-int
+static int
 connect_relay_next(struct connection_closure *closure)
 {
     struct relay_closure *relay_closure = closure->relay_closure;

logsrvd/regress/fuzz/fuzz_logsrvd_conf.c

@@ -44,6 +44,8 @@
 
 #include "logsrvd.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 /*
  * Stub version that always succeeds for small inputs and fails for large.
  * We want to fuzz our parser, not libc's regular expression code.

logsrvd/sendlog.c

@@ -232,7 +232,7 @@ connect_server(struct peer_info *server, const char *port)
 /*
  * Get a buffer from the free list if possible, else allocate a new one.
  */
-struct connection_buffer *
+static struct connection_buffer *
 get_free_buf(size_t len, struct client_closure *closure)
 {
     struct connection_buffer *buf;

plugins/python/pyhelpers.c

@@ -67,13 +67,6 @@ struct PythonContext py_ctx = {
 };
 
 
-int
-py_is_sudo_log_available(void)
-{
-    debug_decl(py_is_sudo_log_available, PYTHON_DEBUG_INTERNAL);
-    debug_return_int(py_ctx.sudo_log != &_sudo_printf_default);
-}
-
 char *
 py_join_str_list(PyObject *py_str_list, const char *separator)
 {
@@ -104,7 +97,7 @@ cleanup:
     debug_return_str(result);
 }
 
-char *
+static char *
 py_create_traceback_string(PyObject *py_traceback)
 {
     debug_decl(py_create_traceback_string, PYTHON_DEBUG_INTERNAL);

plugins/python/python_plugin_approval.c

@@ -38,6 +38,7 @@ struct ApprovalPluginContext
 // This also verifies compile time that the name matches the sudo plugin API.
 #define CALLBACK_PYNAME(func_name) ((void)CALLBACK_PLUGINFUNC(func_name), #func_name)
 
+sudo_dso_public struct approval_plugin *python_approval_clone(void);
 
 static int
 python_plugin_approval_open(struct ApprovalPluginContext *approval_ctx,
@@ -133,7 +134,7 @@ python_plugin_approval_check(struct ApprovalPluginContext *approval_ctx,
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_approval_show_version(struct ApprovalPluginContext *approval_ctx, int verbose)
 {
     debug_decl(python_plugin_approval_show_version, PYTHON_DEBUG_CALLBACKS);
@@ -175,7 +176,7 @@ static struct approval_plugin *extra_approval_plugins[] = {
     &python_approval7
 };
 
-sudo_dso_public struct approval_plugin *
+struct approval_plugin *
 python_approval_clone(void)
 {
     static size_t counter = 0;

plugins/python/python_plugin_approval_multi.inc

@@ -11,7 +11,7 @@ extern struct approval_plugin APPROVAL_SYMBOL_NAME(python_approval);
 static struct ApprovalPluginContext PLUGIN_CTX = { { NULL }, &APPROVAL_SYMBOL_NAME(python_approval) };
 
 
-int
+static int
 CALLBACK_CFUNC(open)(unsigned int version, sudo_conv_t conversation,
     sudo_printf_t sudo_printf, char * const settings[],
     char * const user_info[], int submit_optind,
@@ -23,13 +23,13 @@ CALLBACK_CFUNC(open)(unsigned int version, sudo_conv_t conversation,
         submit_envp, plugin_options, errstr);
 }
 
-void
+static void
 CALLBACK_CFUNC(close)(void)
 {
     python_plugin_approval_close(&PLUGIN_CTX);
 }
 
-int
+static int
 CALLBACK_CFUNC(check)(char * const command_info[], char * const run_argv[],
     char * const run_envp[], const char **errstr)
 {
@@ -37,7 +37,7 @@ CALLBACK_CFUNC(check)(char * const command_info[], char * const run_argv[],
         run_envp, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(show_version)(int verbose)
 {
     return python_plugin_approval_show_version(&PLUGIN_CTX, verbose);

plugins/python/python_plugin_audit.c

@@ -44,6 +44,7 @@ struct AuditPluginContext
             (void **)&CALLBACK_PLUGINFUNC(function_name)); \
     } while(0)
 
+sudo_dso_public struct audit_plugin *python_audit_clone(void);
 
 static int
 _call_plugin_open(struct AuditPluginContext *audit_ctx, int submit_optind, char * const submit_argv[])
@@ -126,7 +127,7 @@ python_plugin_audit_close(struct AuditPluginContext *audit_ctx, int status_type,
     debug_return;
 }
 
-int
+static int
 python_plugin_audit_accept(struct AuditPluginContext *audit_ctx,
     const char *plugin_name, unsigned int plugin_type,
     char * const command_info[], char * const run_argv[],
@@ -164,7 +165,7 @@ cleanup:
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_audit_reject(struct AuditPluginContext *audit_ctx,
     const char *plugin_name, unsigned int plugin_type,
     const char *audit_msg, char * const command_info[], const char **errstr)
@@ -194,7 +195,7 @@ cleanup:
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_audit_error(struct AuditPluginContext *audit_ctx,
     const char *plugin_name, unsigned int plugin_type,
     const char *audit_msg, char * const command_info[], const char **errstr)
@@ -221,7 +222,7 @@ cleanup:
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_audit_show_version(struct AuditPluginContext *audit_ctx, int verbose)
 {
     debug_decl(python_plugin_audit_show_version, PYTHON_DEBUG_CALLBACKS);
@@ -263,7 +264,7 @@ static struct audit_plugin *extra_audit_plugins[] = {
     &python_audit7
 };
 
-sudo_dso_public struct audit_plugin *
+struct audit_plugin *
 python_audit_clone(void)
 {
     static size_t counter = 0;

plugins/python/python_plugin_audit_multi.inc

@@ -29,7 +29,7 @@ CALLBACK_CFUNC(close)(int status_type, int status)
     python_plugin_audit_close(&PLUGIN_CTX, status_type, status);
 }
 
-int
+static int
 CALLBACK_CFUNC(accept)(const char *plugin_name, unsigned int plugin_type,
     char * const command_info[], char * const run_argv[],
     char * const run_envp[], const char **errstr)
@@ -38,7 +38,7 @@ CALLBACK_CFUNC(accept)(const char *plugin_name, unsigned int plugin_type,
         command_info, run_argv, run_envp, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(reject)(const char *plugin_name, unsigned int plugin_type,
     const char *audit_msg, char * const command_info[], const char **errstr)
 {
@@ -46,7 +46,7 @@ CALLBACK_CFUNC(reject)(const char *plugin_name, unsigned int plugin_type,
         audit_msg, command_info, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(error)(const char *plugin_name, unsigned int plugin_type,
     const char *audit_msg, char * const command_info[], const char **errstr)
 {
@@ -54,7 +54,7 @@ CALLBACK_CFUNC(error)(const char *plugin_name, unsigned int plugin_type,
         audit_msg, command_info, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(show_version)(int verbose)
 {
     return python_plugin_audit_show_version(&PLUGIN_CTX, verbose);

plugins/python/python_plugin_common.c

@@ -42,7 +42,7 @@ static size_t python_inittab_copy_len = 0;
 # define Py_FinalizeEx()	(Py_Finalize(), 0)
 #endif
 
-const char *
+static const char *
 _lookup_value(char * const keyvalues[], const char *key)
 {
     debug_decl(_lookup_value, PYTHON_DEBUG_INTERNAL);
@@ -190,7 +190,7 @@ _restore_inittab(void)
     debug_return;
 }
 
-void
+static void
 python_plugin_handle_plugin_error_exception(PyObject **py_result, struct PluginContext *plugin_ctx)
 {
     debug_decl(python_plugin_handle_plugin_error_exception, PYTHON_DEBUG_INTERNAL);
@@ -396,7 +396,7 @@ _python_plugin_register_plugin_in_py_ctx(void)
     debug_return_int(SUDO_RC_OK);
 }
 
-int
+static int
 _python_plugin_set_path(struct PluginContext *plugin_ctx, const char *path)
 {
     if (path == NULL) {

plugins/python/python_plugin_group.c

@@ -36,7 +36,7 @@ extern struct sudoers_group_plugin group_plugin;
 #define CALLBACK_PYNAME(func_name) ((void)CALLBACK_PLUGINFUNC(func_name), #func_name)
 
 
-int
+static int
 python_plugin_group_init(int version, sudo_printf_t sudo_printf, char *const plugin_options[])
 {
     debug_decl(python_plugin_group_init, PYTHON_DEBUG_CALLBACKS);
@@ -79,7 +79,7 @@ python_plugin_group_init(int version, sudo_printf_t sudo_printf, char *const plu
     debug_return_int(rc);
 }
 
-void
+static void
 python_plugin_group_cleanup(void)
 {
     debug_decl(python_plugin_group_cleanup, PYTHON_DEBUG_CALLBACKS);
@@ -87,7 +87,7 @@ python_plugin_group_cleanup(void)
     python_plugin_deinit(&plugin_ctx);
 }
 
-int
+static int
 python_plugin_group_query(const char *user, const char *group, const struct passwd *pwd)
 {
     debug_decl(python_plugin_group_query, PYTHON_DEBUG_CALLBACKS);

plugins/python/python_plugin_io.c

@@ -44,6 +44,7 @@ struct IOPluginContext
             (void **)&CALLBACK_PLUGINFUNC(function_name)); \
     } while(0)
 
+sudo_dso_public struct io_plugin *python_io_clone(void);
 
 static int
 _call_plugin_open(struct IOPluginContext *io_ctx, int argc, char * const argv[], char * const command_info[])
@@ -75,7 +76,7 @@ _call_plugin_open(struct IOPluginContext *io_ctx, int argc, char * const argv[],
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_open(struct IOPluginContext *io_ctx,
     unsigned int version, sudo_conv_t conversation,
     sudo_printf_t sudo_printf, char * const settings[],
@@ -125,7 +126,7 @@ python_plugin_io_open(struct IOPluginContext *io_ctx,
     debug_return_int(rc);
 }
 
-void
+static void
 python_plugin_io_close(struct IOPluginContext *io_ctx, int exit_status, int error)
 {
     debug_decl(python_plugin_io_close, PYTHON_DEBUG_CALLBACKS);
@@ -134,7 +135,7 @@ python_plugin_io_close(struct IOPluginContext *io_ctx, int exit_status, int erro
     debug_return;
 }
 
-int
+static int
 python_plugin_io_show_version(struct IOPluginContext *io_ctx, int verbose)
 {
     debug_decl(python_plugin_io_show_version, PYTHON_DEBUG_CALLBACKS);
@@ -145,7 +146,7 @@ python_plugin_io_show_version(struct IOPluginContext *io_ctx, int verbose)
                                                 verbose, PY_IO_PLUGIN_VERSION, "io"));
 }
 
-int
+static int
 python_plugin_io_log_ttyin(struct IOPluginContext *io_ctx, const char *buf, unsigned int len, const char **errstr)
 {
     debug_decl(python_plugin_io_log_ttyin, PYTHON_DEBUG_CALLBACKS);
@@ -157,7 +158,7 @@ python_plugin_io_log_ttyin(struct IOPluginContext *io_ctx, const char *buf, unsi
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_log_ttyout(struct IOPluginContext *io_ctx, const char *buf, unsigned int len, const char **errstr)
 {
     debug_decl(python_plugin_io_log_ttyout, PYTHON_DEBUG_CALLBACKS);
@@ -169,7 +170,7 @@ python_plugin_io_log_ttyout(struct IOPluginContext *io_ctx, const char *buf, uns
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_log_stdin(struct IOPluginContext *io_ctx, const char *buf, unsigned int len, const char **errstr)
 {
     debug_decl(python_plugin_io_log_stdin, PYTHON_DEBUG_CALLBACKS);
@@ -181,7 +182,7 @@ python_plugin_io_log_stdin(struct IOPluginContext *io_ctx, const char *buf, unsi
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_log_stdout(struct IOPluginContext *io_ctx, const char *buf, unsigned int len, const char **errstr)
 {
     debug_decl(python_plugin_io_log_stdout, PYTHON_DEBUG_CALLBACKS);
@@ -193,7 +194,7 @@ python_plugin_io_log_stdout(struct IOPluginContext *io_ctx, const char *buf, uns
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_log_stderr(struct IOPluginContext *io_ctx, const char *buf, unsigned int len, const char **errstr)
 {
     debug_decl(python_plugin_io_log_stderr, PYTHON_DEBUG_CALLBACKS);
@@ -205,7 +206,7 @@ python_plugin_io_log_stderr(struct IOPluginContext *io_ctx, const char *buf, uns
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_change_winsize(struct IOPluginContext *io_ctx, unsigned int line, unsigned int cols, const char **errstr)
 {
     debug_decl(python_plugin_io_change_winsize, PYTHON_DEBUG_CALLBACKS);
@@ -217,7 +218,7 @@ python_plugin_io_change_winsize(struct IOPluginContext *io_ctx, unsigned int lin
     debug_return_int(rc);
 }
 
-int
+static int
 python_plugin_io_log_suspend(struct IOPluginContext *io_ctx, int signo, const char **errstr)
 {
     debug_decl(python_plugin_io_log_suspend, PYTHON_DEBUG_CALLBACKS);
@@ -258,7 +259,7 @@ static struct io_plugin *extra_io_plugins[] = {
     &python_io7
 };
 
-sudo_dso_public struct io_plugin *
+struct io_plugin *
 python_io_clone(void)
 {
     static size_t counter = 0;

plugins/python/python_plugin_io_multi.inc

@@ -10,7 +10,7 @@
 extern struct io_plugin IO_SYMBOL_NAME(python_io);
 static struct IOPluginContext PLUGIN_CTX = { { NULL }, &IO_SYMBOL_NAME(python_io) };
 
-int
+static int
 CALLBACK_CFUNC(open)(
     unsigned int version, sudo_conv_t conversation,
     sudo_printf_t sudo_printf, char * const settings[],
@@ -22,55 +22,55 @@ CALLBACK_CFUNC(open)(
         sudo_printf, settings, user_info, command_info, argc, argv, user_env, plugin_options, errstr);
 }
 
-void
+static void
 CALLBACK_CFUNC(close)(int exit_status, int error)
 {
     python_plugin_io_close(&PLUGIN_CTX, exit_status, error);
 }
 
-int
+static int
 CALLBACK_CFUNC(show_version)(int verbose)
 {
     return python_plugin_io_show_version(&PLUGIN_CTX, verbose);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_ttyin)(const char *buf, unsigned int len, const char **errstr)
 {
     return python_plugin_io_log_ttyin(&PLUGIN_CTX, buf, len, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_ttyout)(const char *buf, unsigned int len, const char **errstr)
 {
     return python_plugin_io_log_ttyout(&PLUGIN_CTX, buf, len, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_stdin)(const char *buf, unsigned int len, const char **errstr)
 {
     return python_plugin_io_log_stdin(&PLUGIN_CTX, buf, len, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_stdout)(const char *buf, unsigned int len, const char **errstr)
 {
     return python_plugin_io_log_stdout(&PLUGIN_CTX, buf, len, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_stderr)(const char *buf, unsigned int len, const char **errstr)
 {
     return python_plugin_io_log_stderr(&PLUGIN_CTX, buf, len, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(change_winsize)(unsigned int line, unsigned int cols, const char **errstr)
 {
     return python_plugin_io_change_winsize(&PLUGIN_CTX, line, cols, errstr);
 }
 
-int
+static int
 CALLBACK_CFUNC(log_suspend)(int signo, const char **errstr)
 {
     return python_plugin_io_log_suspend(&PLUGIN_CTX, signo, errstr);

plugins/python/python_plugin_policy.c

@@ -203,7 +203,7 @@ python_plugin_policy_version(int verbose)
                                                 verbose, PY_POLICY_PLUGIN_VERSION, "policy"));
 }
 
-int
+static int
 python_plugin_policy_validate(const char **errstr)
 {
     debug_decl(python_plugin_policy_validate, PYTHON_DEBUG_CALLBACKS);
@@ -213,7 +213,7 @@ python_plugin_policy_validate(const char **errstr)
     debug_return_int(rc);
 }
 
-void
+static void
 python_plugin_policy_invalidate(int unlinkit)
 {
     debug_decl(python_plugin_policy_invalidate, PYTHON_DEBUG_CALLBACKS);
@@ -223,7 +223,7 @@ python_plugin_policy_invalidate(int unlinkit)
     debug_return;
 }
 
-int
+static int
 python_plugin_policy_init_session(struct passwd *pwd, char **user_env[], const char **errstr)
 {
     debug_decl(python_plugin_policy_init_session, PYTHON_DEBUG_CALLBACKS);

plugins/python/regress/check_python_examples.c

@@ -49,7 +49,7 @@ static bool verbose;
 static int _init_symbols(void);
 static int _unlink_symbols(void);
 
-void
+static void
 create_plugin_options(const char *module_name, const char *class_name, const char *extra_option)
 {
     char opt_module_path[PATH_MAX + 256];
@@ -65,7 +65,7 @@ create_plugin_options(const char *module_name, const char *class_name, const cha
                                            opt_classname, extra_option, NULL);
 }
 
-void
+static void
 create_io_plugin_options(const char *log_path)
 {
     char opt_logpath[PATH_MAX + 16];
@@ -73,19 +73,19 @@ create_io_plugin_options(const char *log_path)
     create_plugin_options("example_io_plugin", "SudoIOPlugin", opt_logpath);
 }
 
-void
+static void
 create_debugging_plugin_options(void)
 {
     create_plugin_options("example_debugging", "DebugDemoPlugin", NULL);
 }
 
-void
+static void
 create_audit_plugin_options(const char *extra_argument)
 {
     create_plugin_options("example_audit_plugin", "SudoAuditPlugin", extra_argument);
 }
 
-void
+static void
 create_conversation_plugin_options(void)
 {
     char opt_logpath[PATH_MAX + 16];
@@ -93,13 +93,13 @@ create_conversation_plugin_options(void)
     create_plugin_options("example_conversation", "ReasonLoggerIOPlugin", opt_logpath);
 }
 
-void
+static void
 create_policy_plugin_options(void)
 {
     create_plugin_options("example_policy_plugin", "SudoPolicyPlugin", NULL);
 }
 
-int
+static int
 init(void)
 {
     // always start each test from clean state
@@ -134,7 +134,7 @@ init(void)
     return true;
 }
 
-int
+static int
 cleanup(int success)
 {
     if (!success) {
@@ -160,7 +160,7 @@ cleanup(int success)
     return true;
 }
 
-int
+static int
 check_example_io_plugin_version_display(int is_verbose)
 {
     const char *errstr = NULL;
@@ -188,7 +188,7 @@ check_example_io_plugin_version_display(int is_verbose)
     return true;
 }
 
-int
+static int
 check_example_io_plugin_command_log(void)
 {
     const char *errstr = NULL;
@@ -233,7 +233,7 @@ check_example_io_plugin_command_log(void)
 
 typedef struct io_plugin * (io_clone_func)(void);
 
-int
+static int
 check_example_io_plugin_command_log_multiple(void)
 {
     const char *errstr = NULL;
@@ -330,7 +330,7 @@ check_example_io_plugin_command_log_multiple(void)
     return true;
 }
 
-int
+static int
 check_example_io_plugin_failed_to_start_command(void)
 {
     const char *errstr = NULL;
@@ -358,7 +358,7 @@ check_example_io_plugin_failed_to_start_command(void)
     return true;
 }
 
-int
+static int
 check_example_io_plugin_fails_with_python_backtrace(void)
 {
     const char *errstr = NULL;
@@ -377,7 +377,7 @@ check_example_io_plugin_fails_with_python_backtrace(void)
     return true;
 }
 
-int
+static int
 check_io_plugin_reports_error(void)
 {
     const char *errstr = NULL;
@@ -445,7 +445,7 @@ check_io_plugin_reports_error(void)
     return true;
 }
 
-int
+static int
 check_example_group_plugin(void)
 {
     create_plugin_options("example_group_plugin", "SudoGroupPlugin", NULL);
@@ -463,7 +463,7 @@ check_example_group_plugin(void)
     return true;
 }
 
-const char *
+static const char *
 create_debug_config(const char *debug_spec)
 {
     char *result = NULL;
@@ -493,7 +493,7 @@ cleanup:
     return result;
 }
 
-int
+static int
 check_example_group_plugin_is_able_to_debug(void)
 {
     const char *config_path = create_debug_config("py_calls@diag");
@@ -516,7 +516,7 @@ check_example_group_plugin_is_able_to_debug(void)
     return true;
 }
 
-int
+static int
 check_plugin_unload(void)
 {
     // You can call this test to avoid having a lot of subinterpreters
@@ -528,7 +528,7 @@ check_plugin_unload(void)
     return true;
 }
 
-int
+static int
 check_example_debugging(const char *debug_spec)
 {
     const char *errstr = NULL;
@@ -559,7 +559,7 @@ check_example_debugging(const char *debug_spec)
     return true;
 }
 
-int
+static int
 check_loading_fails(const char *name)
 {
     const char *errstr = NULL;
@@ -576,7 +576,7 @@ check_loading_fails(const char *name)
     return true;
 }
 
-int
+static int
 check_loading_fails_with_missing_path(void)
 {
     str_array_free(&data.plugin_options);
@@ -584,7 +584,7 @@ check_loading_fails_with_missing_path(void)
     return check_loading_fails("missing_path");
 }
 
-int
+static int
 check_loading_succeeds_with_missing_classname(void)
 {
     str_array_free(&data.plugin_options);
@@ -605,7 +605,7 @@ check_loading_succeeds_with_missing_classname(void)
     return true;
 }
 
-int
+static int
 check_loading_fails_with_missing_classname(void)
 {
     str_array_free(&data.plugin_options);
@@ -613,14 +613,14 @@ check_loading_fails_with_missing_classname(void)
     return check_loading_fails("missing_classname");
 }
 
-int
+static int
 check_loading_fails_with_wrong_classname(void)
 {
     create_plugin_options("example_debugging", "MispelledPluginName", NULL);
     return check_loading_fails("wrong_classname");
 }
 
-int
+static int
 check_loading_fails_with_wrong_path(void)
 {
     str_array_free(&data.plugin_options);
@@ -628,7 +628,7 @@ check_loading_fails_with_wrong_path(void)
     return check_loading_fails("wrong_path");
 }
 
-int
+static int
 check_loading_fails_plugin_is_not_owned_by_root(void)
 {
     sudo_conf_clear_paths();
@@ -638,7 +638,7 @@ check_loading_fails_plugin_is_not_owned_by_root(void)
     return check_loading_fails("not_owned_by_root");
 }
 
-int
+static int
 check_example_conversation_plugin_reason_log(int simulate_suspend, const char *description)
 {
     const char *errstr = NULL;
@@ -667,7 +667,7 @@ check_example_conversation_plugin_reason_log(int simulate_suspend, const char *d
     return true;
 }
 
-int
+static int
 check_example_conversation_plugin_user_interrupts(void)
 {
     const char *errstr = NULL;
@@ -692,7 +692,7 @@ check_example_conversation_plugin_user_interrupts(void)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_version_display(int is_verbose)
 {
     const char *errstr = NULL;
@@ -721,7 +721,7 @@ check_example_policy_plugin_version_display(int is_verbose)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_accepted_execution(void)
 {
     const char *errstr = NULL;
@@ -773,7 +773,7 @@ check_example_policy_plugin_accepted_execution(void)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_failed_execution(void)
 {
     const char *errstr = NULL;
@@ -811,7 +811,7 @@ check_example_policy_plugin_failed_execution(void)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_denied_execution(void)
 {
     const char *errstr = NULL;
@@ -846,7 +846,7 @@ check_example_policy_plugin_denied_execution(void)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_list(void)
 {
     const char *errstr = NULL;
@@ -904,7 +904,7 @@ check_example_policy_plugin_list(void)
     return true;
 }
 
-int
+static int
 check_example_policy_plugin_validate_invalidate(void)
 {
     const char *errstr = NULL;
@@ -935,7 +935,7 @@ check_example_policy_plugin_validate_invalidate(void)
     return true;
 }
 
-int
+static int
 check_policy_plugin_callbacks_are_optional(void)
 {
     const char *errstr = NULL;
@@ -961,7 +961,7 @@ check_policy_plugin_callbacks_are_optional(void)
     return true;
 }
 
-int
+static int
 check_policy_plugin_reports_error(void)
 {
     const char *errstr = NULL;
@@ -1024,7 +1024,7 @@ check_policy_plugin_reports_error(void)
     return true;
 }
 
-int
+static int
 check_io_plugin_callbacks_are_optional(void)
 {
     const char *errstr = NULL;
@@ -1051,7 +1051,7 @@ check_io_plugin_callbacks_are_optional(void)
     return true;
 }
 
-int
+static int
 check_python_plugins_do_not_affect_each_other(void)
 {
     const char *errstr = NULL;
@@ -1078,7 +1078,7 @@ check_python_plugins_do_not_affect_each_other(void)
     return true;
 }
 
-int
+static int
 check_example_audit_plugin_receives_accept(void)
 {
     create_audit_plugin_options("");
@@ -1117,7 +1117,7 @@ check_example_audit_plugin_receives_accept(void)
     return true;
 }
 
-int
+static int
 check_example_audit_plugin_receives_reject(void)
 {
     create_audit_plugin_options(NULL);
@@ -1147,7 +1147,7 @@ check_example_audit_plugin_receives_reject(void)
     return true;
 }
 
-int
+static int
 check_example_audit_plugin_receives_error(void)
 {
     create_audit_plugin_options("");
@@ -1179,7 +1179,7 @@ check_example_audit_plugin_receives_error(void)
 
 typedef struct audit_plugin * (audit_clone_func)(void);
 
-int
+static int
 check_example_audit_plugin_workflow_multiple(void)
 {
     // verify multiple python audit plugins are available
@@ -1247,7 +1247,7 @@ check_example_audit_plugin_workflow_multiple(void)
     return true;
 }
 
-int
+static int
 check_example_audit_plugin_version_display(void)
 {
     create_audit_plugin_options(NULL);
@@ -1275,7 +1275,7 @@ check_example_audit_plugin_version_display(void)
     return true;
 }
 
-int
+static int
 check_audit_plugin_callbacks_are_optional(void)
 {
     const char *errstr = NULL;
@@ -1300,7 +1300,7 @@ check_audit_plugin_callbacks_are_optional(void)
     return true;
 }
 
-int
+static int
 check_audit_plugin_reports_error(void)
 {
     const char *errstr = NULL;

plugins/python/sudo_python_module.c

@@ -293,13 +293,13 @@ _call_conversation_callback(PyObject *py_callback, int signo)
     debug_return_int(rc);
 }
 
-int
+static int
 python_sudo_conversation_suspend_cb(int signo, struct py_conv_callback_closure *closure)
 {
     return _call_conversation_callback(closure->py_on_suspend, signo);
 }
 
-int
+static int
 python_sudo_conversation_resume_cb(int signo, struct py_conv_callback_closure *closure)
 {
     return _call_conversation_callback(closure->py_on_resume, signo);
@@ -467,7 +467,7 @@ cleanup:
 }
 
 CPYCHECKER_STEALS_REFERENCE_TO_ARG(3)
-void
+static void
 sudo_module_register_enum(PyObject *py_module, const char *enum_name, PyObject *py_constants_dict)
 {
     // pseudo code:

plugins/sudoers/audit.c

@@ -432,7 +432,7 @@ sudoers_audit_error(const char *plugin_name, unsigned int plugin_type,
     debug_return_int(ret);
 }
 
-void
+static void
 sudoers_audit_close(int status_type, int status)
 {
     log_server_exit(status_type, status);

plugins/sudoers/getdate.c

@@ -854,6 +854,8 @@ difftm(struct tm *a, struct tm *b)
 	  + (a->tm_sec - b->tm_sec));
 }
 
+time_t get_date(char *p);
+
 time_t
 get_date(char *p)
 {

plugins/sudoers/getdate.y

@@ -826,6 +826,8 @@ difftm(struct tm *a, struct tm *b)
 	  + (a->tm_sec - b->tm_sec));
 }
 
+time_t get_date(char *p);
+
 time_t
 get_date(char *p)
 {

plugins/sudoers/gram.c

@@ -4092,10 +4092,10 @@ found:
 #endif /* NO_LEAKS */
 }
 
-void
+#ifdef NO_LEAKS
+static void
 parser_leak_free(void)
 {
-#ifdef NO_LEAKS
     struct parser_leak_entry *entry;
     void *next;
     debug_decl(parser_leak_run, SUDOERS_DEBUG_PARSER);
@@ -4177,8 +4177,8 @@ parser_leak_free(void)
     }
 
     debug_return;
-#endif /* NO_LEAKS */
 }
+#endif /* NO_LEAKS */
 
 void
 parser_leak_init(void)

plugins/sudoers/gram.y

@@ -1914,10 +1914,10 @@ found:
 #endif /* NO_LEAKS */
 }
 
-void
+#ifdef NO_LEAKS
+static void
 parser_leak_free(void)
 {
-#ifdef NO_LEAKS
     struct parser_leak_entry *entry;
     void *next;
     debug_decl(parser_leak_run, SUDOERS_DEBUG_PARSER);
@@ -1999,8 +1999,8 @@ parser_leak_free(void)
     }
 
     debug_return;
-#endif /* NO_LEAKS */
 }
+#endif /* NO_LEAKS */
 
 void
 parser_leak_init(void)

plugins/sudoers/iolog.c

@@ -288,7 +288,7 @@ bad:
  * Pull out I/O log related data from user_info and command_info arrays.
  * Returns true if I/O logging is enabled, false if not and -1 on error.
  */
-int
+static int
 iolog_deserialize_info(struct log_details *details, char * const user_info[],
     char * const command_info[], char * const argv[], char * const user_env[])
 {

plugins/sudoers/log_client.c

@@ -755,7 +755,7 @@ done:
  * Appends the wire format message to the closure's write queue.
  * Returns true on success, false on failure.
  */
-bool
+static bool
 fmt_client_hello(struct client_closure *closure)
 {
     ClientMessage client_msg = CLIENT_MESSAGE__INIT;

plugins/sudoers/regress/fuzz/fuzz_policy.c

@@ -39,7 +39,9 @@
 #endif
 
 #include "sudoers.h"
+#include "sudo_iolog.h"
 #include "interfaces.h"
+#include "check.h"
 
 extern char **environ;
 extern sudo_dso_public struct policy_plugin sudoers_policy;
@@ -49,6 +51,8 @@ char *audit_msg;
 
 static int pass;
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 static FILE *
 open_data(const uint8_t *data, size_t size)
 {
@@ -161,7 +165,7 @@ fuzz_printf(int msg_type, const char *fmt, ...)
     return 0;
 }
 
-int
+static int
 fuzz_hook_stub(struct sudo_hook *hook)
 {
     return 0;
@@ -820,7 +824,7 @@ expand_iolog_path(const char *inpath, char *path, size_t pathlen,
 
 /* STUB */
 bool
-iolog_nextid(char *iolog_dir, char sessid[7])
+iolog_nextid(const char *iolog_dir, char sessid[7])
 {
     strlcpy(sessid, "000001", 7);
     return true;

plugins/sudoers/regress/fuzz/fuzz_stubs.c

@@ -41,6 +41,8 @@
 #include "sudoers.h"
 #include "interfaces.h"
 
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
 struct interface_list *
 get_interfaces(void)
 {

plugins/sudoers/regress/fuzz/fuzz_sudoers.c

@@ -43,6 +43,7 @@
 
 static int fuzz_conversation(int num_msgs, const struct sudo_conv_message msgs[], struct sudo_conv_reply replies[], struct sudo_conv_callback *callback);
 static int fuzz_printf(int msg_type, const char *fmt, ...);
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
 /* Required to link with parser. */
 struct sudo_user sudo_user;

plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c

@@ -29,6 +29,7 @@
 #include "sudoers.h"
 
 static int fuzz_printf(int msg_type, const char *fmt, ...);
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
 /* Required to link with parser. */
 struct sudo_user sudo_user;

plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c

@@ -155,7 +155,7 @@ validate_iolog_info(const char *log_dir, bool legacy)
     return true;
 }
 
-bool
+static bool
 validate_timing(FILE *fp, int recno, int type, unsigned int p1, unsigned int p2)
 {
     struct timing_closure timing;
@@ -206,7 +206,7 @@ validate_timing(FILE *fp, int recno, int type, unsigned int p1, unsigned int p2)
 /*
  * Test sudoers I/O log plugin endpoints.
  */
-void
+static void
 test_endpoints(int *ntests, int *nerrors, const char *iolog_dir, char *envp[])
 {
     int rc, cmnd_argc = 1;

plugins/sudoers/stubs.c

@@ -35,6 +35,7 @@
 #include <arpa/inet.h>
 
 #include "sudoers.h"
+#include "cvtsudoers.h"
 #include "interfaces.h"
 
 /* STUB */

plugins/sudoers/timestamp.c

@@ -591,7 +591,7 @@ done:
 /*
  * Write a TS_LOCKEXCL record at the beginning of the time stamp file.
  */
-bool
+static bool
 timestamp_lock_write(struct ts_cookie *cookie)
 {
     struct timestamp_entry entry;

plugins/sudoers/timestr.c

@@ -26,9 +26,7 @@
 
 #include <time.h>
 
-#include "sudo_compat.h"
-#include "sudo_debug.h"
-#include "parse.h"
+#include "sudoers.h"
 
 /*
  * Return a static buffer with the current date + time.

plugins/sudoers/tsgetgrpw.h

@@ -40,3 +40,6 @@ void testsudoers_endpwent(void);
 struct passwd *testsudoers_getpwent(void);
 struct passwd *testsudoers_getpwnam(const char *);
 struct passwd *testsudoers_getpwuid(uid_t);
+
+int testsudoers_getgrouplist2_v1(const char *name, GETGROUPS_T basegid,
+    GETGROUPS_T **groupsp, int *ngroupsp);

plugins/sudoers/unesc_str.c

@@ -21,8 +21,12 @@
  * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
  */
 
+#include <config.h>
+
 #include <string.h>
 
+#include "sudoers.h"
+
 /*
  * Remove backslash escape chars.
  */

src/copy_file.c

@@ -30,6 +30,7 @@
 #include <errno.h>
 
 #include "sudo.h"
+#include "sudo_edit.h"
 
 /*
  * Extend the given fd to the specified size in bytes.

src/exec_ptrace.c

@@ -1318,13 +1318,6 @@ exec_ptrace_subcmds_supported(void)
     return seccomp_trap_supported == true;
 }
 #else
-/* STUB */
-bool
-have_seccomp_action(const char *action)
-{
-    return false;
-}
-
 /* STUB */
 bool
 exec_ptrace_stopped(pid_t pid, int status, void *intercept)

src/load_plugins.c

@@ -205,7 +205,7 @@ plugin_exists(struct plugin_container_list *plugins, const char *symbol_name)
 
 typedef struct generic_plugin * (plugin_clone_func)(void);
 
-struct generic_plugin *
+static struct generic_plugin *
 sudo_plugin_try_to_clone(void *so_handle, const char *symbol_name)
 {
     debug_decl(sudo_plugin_try_to_clone, SUDO_DEBUG_PLUGIN);
@@ -436,7 +436,7 @@ sudo_init_event_alloc(void)
  * Load the specified symbol from the sudoers plugin.
  * Used to provide a default plugin when none are specified in sudo.conf.
  */
-bool
+static bool
 sudo_load_sudoers_plugin(const char *symbol_name, bool optional)
 {
     struct plugin_info *info;

src/net_ifs.c

@@ -67,11 +67,7 @@ struct rtentry;
 
 #define DEFAULT_TEXT_DOMAIN	"sudo"
 
-#include "sudo_compat.h"
-#include "sudo_conf.h"
-#include "sudo_debug.h"
-#include "sudo_fatal.h"
-#include "sudo_gettext.h"
+#include "sudo.h"
 
 /* Minix apparently lacks IFF_LOOPBACK */
 #ifndef IFF_LOOPBACK

src/sudo.h

@@ -335,7 +335,7 @@ void parse_preserved_fds(struct preserved_fd_list *pfds, const char *fdstr);
 int tcsetpgrp_nobg(int fd, pid_t pgrp_id);
 
 /* limits.c */
-void disable_coredump();
+void disable_coredump(void);
 void restore_limits(void);
 void restore_nproc(void);
 void set_policy_rlimits(void);

src/sudo_intercept.c

@@ -408,39 +408,50 @@ sudo_shl_get_next(const char *symbol, short type)
 }
 # endif /* HAVE_SHL_LOAD */
 
-sudo_dso_public int
+sudo_dso_public int system(const char *cmnd);
+sudo_dso_public int execve(const char *cmnd, char * const argv[], char * const envp[]);
+sudo_dso_public int execv(const char *cmnd, char * const argv[]);
+#ifdef HAVE_EXECVPE
+sudo_dso_public int execvpe(const char *cmnd, char * const argv[], char * const envp[]);
+#endif
+sudo_dso_public int execvp(const char *cmnd, char * const argv[]);
+sudo_dso_public int execl(const char *name, const char *arg, ...);
+sudo_dso_public int execle(const char *name, const char *arg, ...);
+sudo_dso_public int execlp(const char *name, const char *arg, ...);
+
+int
 system(const char *cmnd)
 {
     return system_wrapper(cmnd);
 }
 
-sudo_dso_public int
+int
 execve(const char *cmnd, char * const argv[], char * const envp[])
 {
     return exec_wrapper(cmnd, argv, envp, false);
 }
 
-sudo_dso_public int
+int
 execv(const char *cmnd, char * const argv[])
 {
     return execve(cmnd, argv, environ);
 }
 
 #ifdef HAVE_EXECVPE
-sudo_dso_public int
+int
 execvpe(const char *cmnd, char * const argv[], char * const envp[])
 {
     return exec_wrapper(cmnd, argv, envp, true);
 }
 #endif
 
-sudo_dso_public int
+int
 execvp(const char *cmnd, char * const argv[])
 {
     return exec_wrapper(cmnd, argv, environ, true);
 }
 
-sudo_dso_public int
+int
 execl(const char *name, const char *arg, ...)
 {
     va_list ap;
@@ -452,7 +463,7 @@ execl(const char *name, const char *arg, ...)
     return -1;
 }
 
-sudo_dso_public int
+int
 execle(const char *name, const char *arg, ...)
 {
     va_list ap;
@@ -464,7 +475,7 @@ execle(const char *name, const char *arg, ...)
     return -1;
 }
 
-sudo_dso_public int
+int
 execlp(const char *name, const char *arg, ...)
 {
     va_list ap;

src/sudo_intercept_common.c

@@ -127,7 +127,7 @@ done:
 /*
  * Receive InterceptResponse from sudo over fd.
  */
-InterceptResponse *
+static InterceptResponse *
 recv_intercept_response(int fd)
 {
     InterceptResponse *res = NULL;
@@ -358,7 +358,7 @@ intercept_connect(void)
     int sock = -1;
     int on = 1;
     struct sockaddr_in sin;
-    debug_decl(command_allowed, SUDO_DEBUG_EXEC);
+    debug_decl(intercept_connect, SUDO_DEBUG_EXEC);
 
     if (intercept_port == 0) {
 	sudo_warnx(U_("intercept port not set"));
@@ -390,6 +390,9 @@ done:
     debug_return_int(sock);
 }
 
+/* Called from sudo_intercept.c */
+bool command_allowed(const char *cmnd, char * const argv[], char * const envp[], char **ncmndp, char ***nargvp, char ***nenvpp);
+
 bool
 command_allowed(const char *cmnd, char * const argv[],
     char * const envp[], char **ncmndp, char ***nargvp, char ***nenvpp)

src/sudo_noexec.c

@@ -88,32 +88,32 @@ typedef struct interpose_s {
 }
 
 #define EXEC_REPL1(fn, t1)			\
-sudo_dso_public int				\
-FN_NAME(fn)(t1 a1)				\
+sudo_dso_public int FN_NAME(fn)(t1 a1);		\
+int FN_NAME(fn)(t1 a1)				\
 EXEC_REPL_BODY					\
 INTERPOSE(fn)
 
 #define EXEC_REPL2(fn, t1, t2)			\
-sudo_dso_public int				\
-FN_NAME(fn)(t1 a1, t2 a2)			\
+sudo_dso_public int FN_NAME(fn)(t1 a1, t2 a2);	\
+int FN_NAME(fn)(t1 a1, t2 a2)			\
 EXEC_REPL_BODY					\
 INTERPOSE(fn)
 
 #define EXEC_REPL3(fn, t1, t2, t3)		\
-sudo_dso_public int				\
-FN_NAME(fn)(t1 a1, t2 a2, t3 a3)		\
+sudo_dso_public int FN_NAME(fn)(t1 a1, t2 a2, t3 a3); \
+int FN_NAME(fn)(t1 a1, t2 a2, t3 a3)		\
 EXEC_REPL_BODY					\
 INTERPOSE(fn)
 
 #define EXEC_REPL6(fn, t1, t2, t3, t4, t5, t6)	\
-sudo_dso_public int				\
-FN_NAME(fn)(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6)	\
+sudo_dso_public int FN_NAME(fn)(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6); \
+int FN_NAME(fn)(t1 a1, t2 a2, t3 a3, t4 a4, t5 a5, t6 a6) \
 EXEC_REPL_BODY					\
 INTERPOSE(fn)
 
 #define EXEC_REPL_VA(fn, t1, t2)		\
-sudo_dso_public int				\
-FN_NAME(fn)(t1 a1, t2 a2, ...)			\
+sudo_dso_public int FN_NAME(fn)(t1 a1, t2 a2, ...); \
+int FN_NAME(fn)(t1 a1, t2 a2, ...)		\
 EXEC_REPL_BODY					\
 INTERPOSE(fn)
 
@@ -159,8 +159,8 @@ EXEC_REPL6(posix_spawnp, pid_t *, const char *, const posix_spawn_file_actions_t
  */
 EXEC_REPL1(system, const char *)
 
-sudo_dso_public FILE *
-FN_NAME(popen)(const char *c, const char *t)
+sudo_dso_public FILE *FN_NAME(popen)(const char *c, const char *t);
+FILE *FN_NAME(popen)(const char *c, const char *t)
 {
     errno = EACCES;
     return NULL;
@@ -174,8 +174,8 @@ INTERPOSE(popen)
  */
 typedef int (*sudo_fn_wordexp_t)(const char *, wordexp_t *, int);
 
-sudo_dso_public int
-FN_NAME(wordexp)(const char *words, wordexp_t *we, int flags)
+sudo_dso_public int FN_NAME(wordexp)(const char *words, wordexp_t *we, int flags);
+int FN_NAME(wordexp)(const char *words, wordexp_t *we, int flags)
 {
 #if defined(HAVE___INTERPOSE)
     return wordexp(words, we, flags | WRDE_NOCMD);