Imported Upstream version 1.7.2p7

[debian/sudo] / configure.in

diff --git a/configure.in b/configure.in
index 4449b006ac99b324554a3af5f78eecd964881503..2790530e2d634919f9b95a83b8a8f528d6a47b0e 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1,18 +1,19 @@
 dnl
 dnl Process this file with GNU autoconf to produce a configure script.
 dnl
 dnl Process this file with GNU autoconf to produce a configure script.

-dnl $Sudo: configure.in,v 1.413.2.47 2008/02/19 18:27:32 millert Exp $

 dnl
 dnl

-dnl Copyright (c) 1994-1996,1998-2007 Todd C. Miller <Todd.Miller@courtesan.com>
+dnl Copyright (c) 1994-1996,1998-2010 Todd C. Miller <Todd.Miller@courtesan.com>

 dnl
 dnl

-AC_INIT([sudo], [1.6.9])
+AC_INIT([sudo], [1.7.2p7], [http://www.sudo.ws/bugs/], [sudo])

 AC_CONFIG_HEADER(config.h pathnames.h)
 dnl
 dnl This won't work before AC_INIT
 dnl
 AC_CONFIG_HEADER(config.h pathnames.h)
 dnl
 dnl This won't work before AC_INIT
 dnl

-AC_MSG_NOTICE([Configuring Sudo version 1.6.9])
+AC_MSG_NOTICE([Configuring Sudo version $PACKAGE_VERSION])

 dnl
 dnl Variables that get substituted in the Makefile and man pages
 dnl
 dnl
 dnl Variables that get substituted in the Makefile and man pages
 dnl

+AC_SUBST(HAVE_BSM_AUDIT)
+AC_SUBST(SHELL)

 AC_SUBST(LIBTOOL)
 AC_SUBST(CFLAGS)
 AC_SUBST(PROGS)
 AC_SUBST(LIBTOOL)
 AC_SUBST(CFLAGS)
 AC_SUBST(PROGS)


@@ -37,13 +38,20 @@ AC_SUBST(SELINUX)
 AC_SUBST(BAMAN)
 AC_SUBST(LCMAN)
 AC_SUBST(SEMAN)
 AC_SUBST(BAMAN)
 AC_SUBST(LCMAN)
 AC_SUBST(SEMAN)

+AC_SUBST(devdir)

 AC_SUBST(mansectsu)
 AC_SUBST(mansectform)
 AC_SUBST(mansrcdir)
 AC_SUBST(mansectsu)
 AC_SUBST(mansectform)
 AC_SUBST(mansrcdir)

+AC_SUBST(NOEXECFILE)

 AC_SUBST(NOEXECDIR)
 AC_SUBST(noexec_file)
 AC_SUBST(INSTALL_NOEXEC)
 AC_SUBST(DONT_LEAK_PATH_INFO)
 AC_SUBST(NOEXECDIR)
 AC_SUBST(noexec_file)
 AC_SUBST(INSTALL_NOEXEC)
 AC_SUBST(DONT_LEAK_PATH_INFO)

+AC_SUBST(BSDAUTH_USAGE)
+AC_SUBST(SELINUX_USAGE)
+AC_SUBST(LDAP)
+AC_SUBST(LOGINCAP_USAGE)
+AC_SUBST(NONUNIX_GROUPS_IMPL)

 dnl
 dnl Variables that get substituted in docs (not overridden by environment)
 dnl
 dnl
 dnl Variables that get substituted in docs (not overridden by environment)
 dnl


@@ -73,6 +81,11 @@ AC_SUBST(tty_tickets)
 AC_SUBST(insults)
 AC_SUBST(root_sudo)
 AC_SUBST(path_info)
 AC_SUBST(insults)
 AC_SUBST(root_sudo)
 AC_SUBST(path_info)

+AC_SUBST(ldap_conf)
+AC_SUBST(ldap_secret)
+AC_SUBST(nsswitch_conf)
+AC_SUBST(netsvc_conf)
+AC_SUBST(secure_path)

 dnl
 dnl Initial values for above
 dnl
 dnl
 dnl Initial values for above
 dnl


@@ -101,7 +114,9 @@ tty_tickets=off
 insults=off
 root_sudo=on
 path_info=on
 insults=off
 root_sudo=on
 path_info=on

+secure_path="not set"

 INSTALL_NOEXEC=
 INSTALL_NOEXEC=

+devdir='$(srcdir)'

 dnl
 dnl Initial values for Makefile variables listed above
 dnl May be overridden by environment variables..
 dnl
 dnl Initial values for Makefile variables listed above
 dnl May be overridden by environment variables..


@@ -113,6 +128,7 @@ PROGS="sudo visudo"
 : ${SUDOERS_UID='0'}
 : ${SUDOERS_GID='0'}
 DEV="#"
 : ${SUDOERS_UID='0'}
 : ${SUDOERS_GID='0'}
 DEV="#"

+LDAP="#"

 SELINUX="#"
 BAMAN='.\" '
 LCMAN='.\" '
 SELINUX="#"
 BAMAN='.\" '
 LCMAN='.\" '


@@ -148,14 +164,14 @@ dnl
 dnl Deprecated --with options (these all warn or generate an error)
 dnl
 
 dnl Deprecated --with options (these all warn or generate an error)
 dnl
 

-AC_ARG_WITH(otp-only, [  --with-otp-only         deprecated],
+AC_ARG_WITH(otp-only, [AS_HELP_STRING([--with-otp-only], [deprecated])],

 [case $with_otp_only in
     yes)       with_passwd="no"
                AC_MSG_NOTICE([--with-otp-only option deprecated, treating as --without-passwd])
                ;;
 esac])
 
 [case $with_otp_only in
     yes)       with_passwd="no"
                AC_MSG_NOTICE([--with-otp-only option deprecated, treating as --without-passwd])
                ;;
 esac])
 

-AC_ARG_WITH(alertmail, [  --with-alertmail        deprecated],
+AC_ARG_WITH(alertmail, [AS_HELP_STRING([--with-alertmail], [deprecated])],

 [case $with_alertmail in
     *)         with_mailto="$with_alertmail"
                AC_MSG_NOTICE([--with-alertmail option deprecated, treating as --mailto])
 [case $with_alertmail in
     *)         with_mailto="$with_alertmail"
                AC_MSG_NOTICE([--with-alertmail option deprecated, treating as --mailto])


@@ -166,7 +182,7 @@ dnl
 dnl Options for --with
 dnl
 
 dnl Options for --with
 dnl
 

-AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
+AC_ARG_WITH(CC, [AS_HELP_STRING([--with-CC], [C compiler to use])],

 [case $with_CC in
     yes)       AC_MSG_ERROR(["must give --with-CC an argument."])
                ;;
 [case $with_CC in
     yes)       AC_MSG_ERROR(["must give --with-CC an argument."])
                ;;


@@ -176,21 +192,35 @@ AC_ARG_WITH(CC, [  --with-CC               C compiler to use],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(rpath, [  --with-rpath            pass -R flag in addition to -L for lib paths],
+AC_ARG_WITH(rpath, [AS_HELP_STRING([--with-rpath], [pass -R flag in addition to -L for lib paths])],

 [case $with_rpath in
     yes|no)    ;;
     *)         AC_MSG_ERROR(["--with-rpath does not take an argument."])
                ;;
 esac])
 
 [case $with_rpath in
     yes|no)    ;;
     *)         AC_MSG_ERROR(["--with-rpath does not take an argument."])
                ;;
 esac])
 

-AC_ARG_WITH(blibpath, [  --with-blibpath[=PATH]    pass -blibpath flag to ld for additional lib paths],
+AC_ARG_WITH(blibpath, [AS_HELP_STRING([--with-blibpath[=PATH]], [pass -blibpath flag to ld for additional lib paths])],

 [case $with_blibpath in
     yes|no)    ;;
     *)         AC_MSG_NOTICE([will pass -blibpath:${with_blibpath} to the loader.])
                ;;
 esac])
 
 [case $with_blibpath in
     yes|no)    ;;
     *)         AC_MSG_NOTICE([will pass -blibpath:${with_blibpath} to the loader.])
                ;;
 esac])
 

-AC_ARG_WITH(incpath, [  --with-incpath          additional places to look for include files],
+dnl
+dnl Handle BSM auditing support.
+dnl
+AC_ARG_WITH(bsm-audit, [AS_HELP_STRING([--with-bsm-audit], [enable BSM audit support])],
+[case $with_bsm_audit in
+    yes)       AC_DEFINE(HAVE_BSM_AUDIT)
+               SUDO_LIBS="${SUDO_LIBS} -lbsm"
+               SUDO_OBJS="${SUDO_OBJS} bsm_audit.o"
+               ;;
+    no)                ;;
+    *)         AC_MSG_ERROR(["--with-bsm-audit does not take an argument."])
+               ;;
+esac])
+
+AC_ARG_WITH(incpath, [AS_HELP_STRING([--with-incpath], [additional places to look for include files])],

 [case $with_incpath in
     yes)       AC_MSG_ERROR(["must give --with-incpath an argument."])
                ;;
 [case $with_incpath in
     yes)       AC_MSG_ERROR(["must give --with-incpath an argument."])
                ;;


@@ -203,7 +233,7 @@ AC_ARG_WITH(incpath, [  --with-incpath          additional places to look for in
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(libpath, [  --with-libpath          additional places to look for libraries],
+AC_ARG_WITH(libpath, [AS_HELP_STRING([--with-libpath], [additional places to look for libraries])],

 [case $with_libpath in
     yes)       AC_MSG_ERROR(["must give --with-libpath an argument."])
                ;;
 [case $with_libpath in
     yes)       AC_MSG_ERROR(["must give --with-libpath an argument."])
                ;;


@@ -213,7 +243,7 @@ AC_ARG_WITH(libpath, [  --with-libpath          additional places to look for li
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(libraries, [  --with-libraries        additional libraries to link with],
+AC_ARG_WITH(libraries, [AS_HELP_STRING([--with-libraries], [additional libraries to link with])],

 [case $with_libraries in
     yes)       AC_MSG_ERROR(["must give --with-libraries an argument."])
                ;;
 [case $with_libraries in
     yes)       AC_MSG_ERROR(["must give --with-libraries an argument."])
                ;;


@@ -223,19 +253,20 @@ AC_ARG_WITH(libraries, [  --with-libraries        additional libraries to link w
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(devel, [  --with-devel            add development options],
+AC_ARG_WITH(devel, [AS_HELP_STRING([--with-devel], [add development options])],

 [case $with_devel in
     yes)       AC_MSG_NOTICE([Setting up for development: -Wall, flex, yacc])
                PROGS="${PROGS} testsudoers"
                OSDEFS="${OSDEFS} -DSUDO_DEVEL"
                DEV=""
 [case $with_devel in
     yes)       AC_MSG_NOTICE([Setting up for development: -Wall, flex, yacc])
                PROGS="${PROGS} testsudoers"
                OSDEFS="${OSDEFS} -DSUDO_DEVEL"
                DEV=""

+               devdir=.

                ;;
     no)                ;;
     *)         AC_MSG_WARN([Ignoring unknown argument to --with-devel: $with_devel])
                ;;
 esac])
 
                ;;
     no)                ;;
     *)         AC_MSG_WARN([Ignoring unknown argument to --with-devel: $with_devel])
                ;;
 esac])
 

-AC_ARG_WITH(efence, [  --with-efence           link with -lefence for malloc() debugging],
+AC_ARG_WITH(efence, [AS_HELP_STRING([--with-efence], [link with -lefence for malloc() debugging])],

 [case $with_efence in
     yes)       AC_MSG_NOTICE([Sudo will link with -lefence (Electric Fence)])
                LIBS="${LIBS} -lefence"
 [case $with_efence in
     yes)       AC_MSG_NOTICE([Sudo will link with -lefence (Electric Fence)])
                LIBS="${LIBS} -lefence"


@@ -248,7 +279,7 @@ AC_ARG_WITH(efence, [  --with-efence           link with -lefence for malloc() d
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(csops, [  --with-csops            add CSOps standard options],
+AC_ARG_WITH(csops, [AS_HELP_STRING([--with-csops], [add CSOps standard options])],

 [case $with_csops in
     yes)       AC_MSG_NOTICE([Adding CSOps standard options])
                CHECKSIA=false
 [case $with_csops in
     yes)       AC_MSG_NOTICE([Adding CSOps standard options])
                CHECKSIA=false


@@ -265,7 +296,7 @@ AC_ARG_WITH(csops, [  --with-csops            add CSOps standard options],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(passwd, [  --without-passwd        don't use passwd/shadow file for authentication],
+AC_ARG_WITH(passwd, [AS_HELP_STRING([--without-passwd], [don't use passwd/shadow file for authentication])],

 [case $with_passwd in
     yes|no)    AC_MSG_CHECKING(whether to use shadow/passwd file authentication)
                AC_MSG_RESULT($with_passwd)
 [case $with_passwd in
     yes|no)    AC_MSG_CHECKING(whether to use shadow/passwd file authentication)
                AC_MSG_RESULT($with_passwd)


@@ -276,7 +307,7 @@ AC_ARG_WITH(passwd, [  --without-passwd        don't use passwd/shadow file for
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(skey, [  --with-skey[=DIR]         enable S/Key support ],
+AC_ARG_WITH(skey, [AS_HELP_STRING([--with-skey[=DIR]], [enable S/Key support ])],

 [case $with_skey in
     no)                with_skey=""
                ;;
 [case $with_skey in
     no)                with_skey=""
                ;;


@@ -287,7 +318,7 @@ AC_ARG_WITH(skey, [  --with-skey[=DIR]         enable S/Key support ],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(opie, [  --with-opie[=DIR]         enable OPIE support ],
+AC_ARG_WITH(opie, [AS_HELP_STRING([--with-opie[=DIR]], [enable OPIE support ])],

 [case $with_opie in
     no)                with_opie=""
                ;;
 [case $with_opie in
     no)                with_opie=""
                ;;


@@ -298,7 +329,7 @@ AC_ARG_WITH(opie, [  --with-opie[=DIR]         enable OPIE support ],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(long-otp-prompt, [  --with-long-otp-prompt  use a two line OTP (skey/opie) prompt],
+AC_ARG_WITH(long-otp-prompt, [AS_HELP_STRING([--with-long-otp-prompt], [use a two line OTP (skey/opie) prompt])],

 [case $with_long_otp_prompt in
     yes)       AC_DEFINE(LONG_OTP_PROMPT)
                AC_MSG_CHECKING(whether to use a two line prompt for OTP authentication)
 [case $with_long_otp_prompt in
     yes)       AC_DEFINE(LONG_OTP_PROMPT)
                AC_MSG_CHECKING(whether to use a two line prompt for OTP authentication)


@@ -311,7 +342,7 @@ AC_ARG_WITH(long-otp-prompt, [  --with-long-otp-prompt  use a two line OTP (skey
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(SecurID, [  --with-SecurID[[=DIR]]    enable SecurID support],
+AC_ARG_WITH(SecurID, [AS_HELP_STRING([--with-SecurID[[=DIR]]], [enable SecurID support])],

 [case $with_SecurID in
     no)                with_SecurID="";;
     *)         AC_DEFINE(HAVE_SECURID)
 [case $with_SecurID in
     no)                with_SecurID="";;
     *)         AC_DEFINE(HAVE_SECURID)


@@ -321,7 +352,7 @@ AC_ARG_WITH(SecurID, [  --with-SecurID[[=DIR]]    enable SecurID support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(fwtk, [  --with-fwtk[[=DIR]]       enable FWTK AuthSRV support],
+AC_ARG_WITH(fwtk, [AS_HELP_STRING([--with-fwtk[[=DIR]]], [enable FWTK AuthSRV support])],

 [case $with_fwtk in
     no)                with_fwtk="";;
     *)         AC_DEFINE(HAVE_FWTK)
 [case $with_fwtk in
     no)                with_fwtk="";;
     *)         AC_DEFINE(HAVE_FWTK)


@@ -331,7 +362,7 @@ AC_ARG_WITH(fwtk, [  --with-fwtk[[=DIR]]       enable FWTK AuthSRV support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(kerb4, [  --with-kerb4[[=DIR]]      enable Kerberos IV support],
+AC_ARG_WITH(kerb4, [AS_HELP_STRING([--with-kerb4[[=DIR]]], [enable Kerberos IV support])],

 [case $with_kerb4 in
     no)                with_kerb4="";;
     *)         AC_MSG_CHECKING(whether to try kerberos IV authentication)
 [case $with_kerb4 in
     no)                with_kerb4="";;
     *)         AC_MSG_CHECKING(whether to try kerberos IV authentication)


@@ -340,7 +371,7 @@ AC_ARG_WITH(kerb4, [  --with-kerb4[[=DIR]]      enable Kerberos IV support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(kerb5, [  --with-kerb5[[=DIR]]      enable Kerberos V support],
+AC_ARG_WITH(kerb5, [AS_HELP_STRING([--with-kerb5[[=DIR]]], [enable Kerberos V support])],

 [case $with_kerb5 in
     no)                with_kerb5="";;
     *)         AC_MSG_CHECKING(whether to try Kerberos V authentication)
 [case $with_kerb5 in
     no)                with_kerb5="";;
     *)         AC_MSG_CHECKING(whether to try Kerberos V authentication)


@@ -349,7 +380,7 @@ AC_ARG_WITH(kerb5, [  --with-kerb5[[=DIR]]      enable Kerberos V support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(aixauth, [  --with-aixauth          enable AIX general authentication support],
+AC_ARG_WITH(aixauth, [AS_HELP_STRING([--with-aixauth], [enable AIX general authentication support])],

 [case $with_aixauth in
     yes)       AUTH_EXCL="$AUTH_EXCL AIX_AUTH";;
     no)                ;;
 [case $with_aixauth in
     yes)       AUTH_EXCL="$AUTH_EXCL AIX_AUTH";;
     no)                ;;


@@ -357,7 +388,7 @@ AC_ARG_WITH(aixauth, [  --with-aixauth          enable AIX general authenticatio
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(pam, [  --with-pam              enable PAM support],
+AC_ARG_WITH(pam, [AS_HELP_STRING([--with-pam], [enable PAM support])],

 [case $with_pam in
     yes)       AUTH_EXCL="$AUTH_EXCL PAM";;
     no)                ;;
 [case $with_pam in
     yes)       AUTH_EXCL="$AUTH_EXCL PAM";;
     no)                ;;


@@ -365,7 +396,7 @@ AC_ARG_WITH(pam, [  --with-pam              enable PAM support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
+AC_ARG_WITH(AFS, [AS_HELP_STRING([--with-AFS], [enable AFS support])],

 [case $with_AFS in
     yes)       AC_DEFINE(HAVE_AFS)
                AC_MSG_CHECKING(whether to try AFS (kerberos) authentication)
 [case $with_AFS in
     yes)       AC_DEFINE(HAVE_AFS)
                AC_MSG_CHECKING(whether to try AFS (kerberos) authentication)


@@ -377,7 +408,7 @@ AC_ARG_WITH(AFS, [  --with-AFS              enable AFS support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(DCE, [  --with-DCE              enable DCE support],
+AC_ARG_WITH(DCE, [AS_HELP_STRING([--with-DCE], [enable DCE support])],

 [case $with_DCE in
     yes)       AC_DEFINE(HAVE_DCE)
                AC_MSG_CHECKING(whether to try DCE (kerberos) authentication)
 [case $with_DCE in
     yes)       AC_DEFINE(HAVE_DCE)
                AC_MSG_CHECKING(whether to try DCE (kerberos) authentication)


@@ -389,14 +420,14 @@ AC_ARG_WITH(DCE, [  --with-DCE              enable DCE support],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(logincap, [  --with-logincap         enable BSD login class support],
+AC_ARG_WITH(logincap, [AS_HELP_STRING([--with-logincap], [enable BSD login class support])],

 [case $with_logincap in
     yes|no)    ;;
     *)         AC_MSG_ERROR(["--with-logincap does not take an argument."])
                ;;
 esac])
 
 [case $with_logincap in
     yes|no)    ;;
     *)         AC_MSG_ERROR(["--with-logincap does not take an argument."])
                ;;
 esac])
 

-AC_ARG_WITH(bsdauth, [  --with-bsdauth          enable BSD authentication support],
+AC_ARG_WITH(bsdauth, [AS_HELP_STRING([--with-bsdauth], [enable BSD authentication support])],

 [case $with_bsdauth in
     yes)       AUTH_EXCL="$AUTH_EXCL BSD_AUTH";;
     no)                ;;
 [case $with_bsdauth in
     yes)       AUTH_EXCL="$AUTH_EXCL BSD_AUTH";;
     no)                ;;


@@ -404,7 +435,7 @@ AC_ARG_WITH(bsdauth, [  --with-bsdauth          enable BSD authentication suppor
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(project, [  --with-project          enable Solaris project support],
+AC_ARG_WITH(project, [AS_HELP_STRING([--with-project], [enable Solaris project support])],

 [case $with_project in
     yes|no)    ;;
     no)        ;;
 [case $with_project in
     yes|no)    ;;
     no)        ;;


@@ -413,7 +444,7 @@ AC_ARG_WITH(project, [  --with-project          enable Solaris project support],
 esac])
 
 AC_MSG_CHECKING(whether to lecture users the first time they run sudo)
 esac])
 
 AC_MSG_CHECKING(whether to lecture users the first time they run sudo)

-AC_ARG_WITH(lecture, [  --without-lecture       don't print lecture for first-time sudoer],
+AC_ARG_WITH(lecture, [AS_HELP_STRING([--without-lecture], [don't print lecture for first-time sudoer])],

 [case $with_lecture in
     yes|short|always)  lecture=once
                ;;
 [case $with_lecture in
     yes|short|always)  lecture=once
                ;;


@@ -430,7 +461,7 @@ else
 fi
 
 AC_MSG_CHECKING(whether sudo should log via syslog or to a file by default)
 fi
 
 AC_MSG_CHECKING(whether sudo should log via syslog or to a file by default)

-AC_ARG_WITH(logging, [  --with-logging          log via syslog, file, or both],
+AC_ARG_WITH(logging, [AS_HELP_STRING([--with-logging], [log via syslog, file, or both])],

 [case $with_logging in
     yes)       AC_MSG_ERROR(["must give --with-logging an argument."])
                ;;
 [case $with_logging in
     yes)       AC_MSG_ERROR(["must give --with-logging an argument."])
                ;;


@@ -450,7 +481,7 @@ AC_ARG_WITH(logging, [  --with-logging          log via syslog, file, or both],
 esac], [AC_DEFINE(LOGGING, SLOG_SYSLOG) AC_MSG_RESULT(syslog)])
 
 AC_MSG_CHECKING(which syslog facility sudo should log with)
 esac], [AC_DEFINE(LOGGING, SLOG_SYSLOG) AC_MSG_RESULT(syslog)])
 
 AC_MSG_CHECKING(which syslog facility sudo should log with)

-AC_ARG_WITH(logfac, [  --with-logfac           syslog facility to log with (default is "local2")],
+AC_ARG_WITH(logfac, [AS_HELP_STRING([--with-logfac], [syslog facility to log with (default is "local2")])],

 [case $with_logfac in
     yes)       AC_MSG_ERROR(["must give --with-logfac an argument."])
                ;;
 [case $with_logfac in
     yes)       AC_MSG_ERROR(["must give --with-logfac an argument."])
                ;;


@@ -465,7 +496,7 @@ AC_DEFINE_UNQUOTED(LOGFAC, "$logfac", [The syslog facility sudo will use.])
 AC_MSG_RESULT($logfac)
 
 AC_MSG_CHECKING(at which syslog priority to log commands)
 AC_MSG_RESULT($logfac)
 
 AC_MSG_CHECKING(at which syslog priority to log commands)

-AC_ARG_WITH(goodpri, [  --with-goodpri          syslog priority for commands (def is "notice")],
+AC_ARG_WITH(goodpri, [AS_HELP_STRING([--with-goodpri], [syslog priority for commands (def is "notice")])],

 [case $with_goodpri in
     yes)       AC_MSG_ERROR(["must give --with-goodpri an argument."])
                ;;
 [case $with_goodpri in
     yes)       AC_MSG_ERROR(["must give --with-goodpri an argument."])
                ;;


@@ -481,7 +512,7 @@ AC_DEFINE_UNQUOTED(PRI_SUCCESS, "$goodpri", [The syslog priority sudo will use f
 AC_MSG_RESULT($goodpri)
 
 AC_MSG_CHECKING(at which syslog priority to log failures)
 AC_MSG_RESULT($goodpri)
 
 AC_MSG_CHECKING(at which syslog priority to log failures)

-AC_ARG_WITH(badpri, [  --with-badpri           syslog priority for failures (def is "alert")],
+AC_ARG_WITH(badpri, [AS_HELP_STRING([--with-badpri], [syslog priority for failures (def is "alert")])],

 [case $with_badpri in
     yes)       AC_MSG_ERROR(["must give --with-badpri an argument."])
                ;;
 [case $with_badpri in
     yes)       AC_MSG_ERROR(["must give --with-badpri an argument."])
                ;;


@@ -496,7 +527,7 @@ esac])
 AC_DEFINE_UNQUOTED(PRI_FAILURE, "$badpri", [The syslog priority sudo will use for unsuccessful attempts/errors.])
 AC_MSG_RESULT($badpri)
 
 AC_DEFINE_UNQUOTED(PRI_FAILURE, "$badpri", [The syslog priority sudo will use for unsuccessful attempts/errors.])
 AC_MSG_RESULT($badpri)
 

-AC_ARG_WITH(logpath, [  --with-logpath          path to the sudo log file],
+AC_ARG_WITH(logpath, [AS_HELP_STRING([--with-logpath], [path to the sudo log file])],

 [case $with_logpath in
     yes)       AC_MSG_ERROR(["must give --with-logpath an argument."])
                ;;
 [case $with_logpath in
     yes)       AC_MSG_ERROR(["must give --with-logpath an argument."])
                ;;


@@ -505,7 +536,7 @@ AC_ARG_WITH(logpath, [  --with-logpath          path to the sudo log file],
 esac])
 
 AC_MSG_CHECKING(how long a line in the log file should be)
 esac])
 
 AC_MSG_CHECKING(how long a line in the log file should be)

-AC_ARG_WITH(loglen, [  --with-loglen           maximum length of a log file line (default is 80)],
+AC_ARG_WITH(loglen, [AS_HELP_STRING([--with-loglen], [maximum length of a log file line (default is 80)])],

 [case $with_loglen in
     yes)       AC_MSG_ERROR(["must give --with-loglen an argument."])
                ;;
 [case $with_loglen in
     yes)       AC_MSG_ERROR(["must give --with-loglen an argument."])
                ;;


@@ -520,7 +551,7 @@ AC_DEFINE_UNQUOTED(MAXLOGFILELEN, $loglen, [The max number of chars per log file
 AC_MSG_RESULT($loglen)
 
 AC_MSG_CHECKING(whether sudo should ignore '.' or '' in \$PATH)
 AC_MSG_RESULT($loglen)
 
 AC_MSG_CHECKING(whether sudo should ignore '.' or '' in \$PATH)

-AC_ARG_WITH(ignore-dot, [  --with-ignore-dot       ignore '.' in the PATH],
+AC_ARG_WITH(ignore-dot, [AS_HELP_STRING([--with-ignore-dot], [ignore '.' in the PATH])],

 [case $with_ignore_dot in
     yes)       ignore_dot=on
                ;;
 [case $with_ignore_dot in
     yes)       ignore_dot=on
                ;;


@@ -537,7 +568,7 @@ else
 fi
 
 AC_MSG_CHECKING(whether to send mail when a user is not in sudoers)
 fi
 
 AC_MSG_CHECKING(whether to send mail when a user is not in sudoers)

-AC_ARG_WITH(mail-if-no-user, [  --without-mail-if-no-user do not send mail if user not in sudoers],
+AC_ARG_WITH(mail-if-no-user, [AS_HELP_STRING([--without-mail-if-no-user], [do not send mail if user not in sudoers])],

 [case $with_mail_if_no_user in
     yes)       mail_no_user=on
                ;;
 [case $with_mail_if_no_user in
     yes)       mail_no_user=on
                ;;


@@ -554,7 +585,7 @@ else
 fi
 
 AC_MSG_CHECKING(whether to send mail when user listed but not for this host)
 fi
 
 AC_MSG_CHECKING(whether to send mail when user listed but not for this host)

-AC_ARG_WITH(mail-if-no-host, [  --with-mail-if-no-host  send mail if user in sudoers but not for this host],
+AC_ARG_WITH(mail-if-no-host, [AS_HELP_STRING([--with-mail-if-no-host], [send mail if user in sudoers but not for this host])],

 [case $with_mail_if_no_host in
     yes)       mail_no_host=on
                ;;
 [case $with_mail_if_no_host in
     yes)       mail_no_host=on
                ;;


@@ -571,7 +602,7 @@ else
 fi
 
 AC_MSG_CHECKING(whether to send mail when a user tries a disallowed command)
 fi
 
 AC_MSG_CHECKING(whether to send mail when a user tries a disallowed command)

-AC_ARG_WITH(mail-if-noperms, [  --with-mail-if-noperms  send mail if user not allowed to run command],
+AC_ARG_WITH(mail-if-noperms, [AS_HELP_STRING([--with-mail-if-noperms], [send mail if user not allowed to run command])],

 [case $with_mail_if_noperms in
     yes)       mail_noperms=on
                ;;
 [case $with_mail_if_noperms in
     yes)       mail_noperms=on
                ;;


@@ -588,7 +619,7 @@ else
 fi
 
 AC_MSG_CHECKING(who should get the mail that sudo sends)
 fi
 
 AC_MSG_CHECKING(who should get the mail that sudo sends)

-AC_ARG_WITH(mailto, [  --with-mailto           who should get sudo mail (default is "root")],
+AC_ARG_WITH(mailto, [AS_HELP_STRING([--with-mailto], [who should get sudo mail (default is "root")])],

 [case $with_mailto in
     yes)       AC_MSG_ERROR(["must give --with-mailto an argument."])
                ;;
 [case $with_mailto in
     yes)       AC_MSG_ERROR(["must give --with-mailto an argument."])
                ;;


@@ -600,7 +631,7 @@ esac])
 AC_DEFINE_UNQUOTED(MAILTO, "$mailto", [The user or email address that sudo mail is sent to.])
 AC_MSG_RESULT([$mailto])
 
 AC_DEFINE_UNQUOTED(MAILTO, "$mailto", [The user or email address that sudo mail is sent to.])
 AC_MSG_RESULT([$mailto])
 

-AC_ARG_WITH(mailsubject, [  --with-mailsubject      subject of sudo mail],
+AC_ARG_WITH(mailsubject, [AS_HELP_STRING([--with-mailsubject], [subject of sudo mail])],

 [case $with_mailsubject in
     yes)       AC_MSG_ERROR(["must give --with-mailsubject an argument."])
                ;;
 [case $with_mailsubject in
     yes)       AC_MSG_ERROR(["must give --with-mailsubject an argument."])
                ;;


@@ -614,7 +645,7 @@ esac])
 AC_DEFINE_UNQUOTED(MAILSUBJECT, "$mailsub", [The subject of the mail sent by sudo to the MAILTO user/address.])
 
 AC_MSG_CHECKING(for bad password prompt)
 AC_DEFINE_UNQUOTED(MAILSUBJECT, "$mailsub", [The subject of the mail sent by sudo to the MAILTO user/address.])
 
 AC_MSG_CHECKING(for bad password prompt)

-AC_ARG_WITH(passprompt, [  --with-passprompt       default password prompt],
+AC_ARG_WITH(passprompt, [AS_HELP_STRING([--with-passprompt], [default password prompt])],

 [case $with_passprompt in
     yes)       AC_MSG_ERROR(["must give --with-passprompt an argument."])
                ;;
 [case $with_passprompt in
     yes)       AC_MSG_ERROR(["must give --with-passprompt an argument."])
                ;;


@@ -626,7 +657,7 @@ AC_MSG_RESULT($passprompt)
 AC_DEFINE_UNQUOTED(PASSPROMPT, "$passprompt", [The default password prompt.])
 
 AC_MSG_CHECKING(for bad password message)
 AC_DEFINE_UNQUOTED(PASSPROMPT, "$passprompt", [The default password prompt.])
 
 AC_MSG_CHECKING(for bad password message)

-AC_ARG_WITH(badpass-message, [  --with-badpass-message  message the user sees when the password is wrong],
+AC_ARG_WITH(badpass-message, [AS_HELP_STRING([--with-badpass-message], [message the user sees when the password is wrong])],

 [case $with_badpass_message in
     yes)       AC_MSG_ERROR(["Must give --with-badpass-message an argument."])
                ;;
 [case $with_badpass_message in
     yes)       AC_MSG_ERROR(["Must give --with-badpass-message an argument."])
                ;;


@@ -639,7 +670,7 @@ AC_DEFINE_UNQUOTED(INCORRECT_PASSWORD, "$badpass_message", [The message given wh
 AC_MSG_RESULT([$badpass_message])
 
 AC_MSG_CHECKING(whether to expect fully qualified hosts in sudoers)
 AC_MSG_RESULT([$badpass_message])
 
 AC_MSG_CHECKING(whether to expect fully qualified hosts in sudoers)

-AC_ARG_WITH(fqdn, [  --with-fqdn             expect fully qualified hosts in sudoers],
+AC_ARG_WITH(fqdn, [AS_HELP_STRING([--with-fqdn], [expect fully qualified hosts in sudoers])],

 [case $with_fqdn in
     yes)       fqdn=on
                ;;
 [case $with_fqdn in
     yes)       fqdn=on
                ;;


@@ -655,7 +686,7 @@ else
     AC_MSG_RESULT(no)
 fi
 
     AC_MSG_RESULT(no)
 fi
 

-AC_ARG_WITH(timedir, [  --with-timedir          path to the sudo timestamp dir],
+AC_ARG_WITH(timedir, [AS_HELP_STRING([--with-timedir], [path to the sudo timestamp dir])],

 [case $with_timedir in
     yes)       AC_MSG_ERROR(["must give --with-timedir an argument."])
                ;;
 [case $with_timedir in
     yes)       AC_MSG_ERROR(["must give --with-timedir an argument."])
                ;;


@@ -663,8 +694,8 @@ AC_ARG_WITH(timedir, [  --with-timedir          path to the sudo timestamp dir],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(sendmail, [  --with-sendmail=path    set path to sendmail
-  --without-sendmail      do not send mail at all],
+AC_ARG_WITH(sendmail, [AS_HELP_STRING([--with-sendmail], [set path to sendmail])
+AS_HELP_STRING([--without-sendmail], [do not send mail at all])],

 [case $with_sendmail in
     yes)       with_sendmail=""
                ;;
 [case $with_sendmail in
     yes)       with_sendmail=""
                ;;


@@ -673,7 +704,7 @@ AC_ARG_WITH(sendmail, [  --with-sendmail=path    set path to sendmail
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(sudoers-mode, [  --with-sudoers-mode     mode of sudoers file (defaults to 0440)],
+AC_ARG_WITH(sudoers-mode, [AS_HELP_STRING([--with-sudoers-mode], [mode of sudoers file (defaults to 0440)])],

 [case $with_sudoers_mode in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-mode an argument."])
                ;;
 [case $with_sudoers_mode in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-mode an argument."])
                ;;


@@ -687,7 +718,7 @@ AC_ARG_WITH(sudoers-mode, [  --with-sudoers-mode     mode of sudoers file (defau
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(sudoers-uid, [  --with-sudoers-uid      uid that owns sudoers file (defaults to 0)],
+AC_ARG_WITH(sudoers-uid, [AS_HELP_STRING([--with-sudoers-uid], [uid that owns sudoers file (defaults to 0)])],

 [case $with_sudoers_uid in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-uid an argument."])
                ;;
 [case $with_sudoers_uid in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-uid an argument."])
                ;;


@@ -699,7 +730,7 @@ AC_ARG_WITH(sudoers-uid, [  --with-sudoers-uid      uid that owns sudoers file (
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(sudoers-gid, [  --with-sudoers-gid      gid that owns sudoers file (defaults to 0)],
+AC_ARG_WITH(sudoers-gid, [AS_HELP_STRING([--with-sudoers-gid], [gid that owns sudoers file (defaults to 0)])],

 [case $with_sudoers_gid in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-gid an argument."])
                ;;
 [case $with_sudoers_gid in
     yes)       AC_MSG_ERROR(["must give --with-sudoers-gid an argument."])
                ;;


@@ -712,8 +743,8 @@ AC_ARG_WITH(sudoers-gid, [  --with-sudoers-gid      gid that owns sudoers file (
 esac])
 
 AC_MSG_CHECKING(for umask programs should be run with)
 esac])
 
 AC_MSG_CHECKING(for umask programs should be run with)

-AC_ARG_WITH(umask, [  --with-umask            umask with which the prog should run (default is 022)
-  --without-umask         Preserves the umask of the user invoking sudo.],
+AC_ARG_WITH(umask, [AS_HELP_STRING([--with-umask], [umask with which the prog should run (default is 022)])
+AS_HELP_STRING([--without-umask], [Preserves the umask of the user invoking sudo.])],

 [case $with_umask in
     yes)       AC_MSG_ERROR(["must give --with-umask an argument."])
                ;;
 [case $with_umask in
     yes)       AC_MSG_ERROR(["must give --with-umask an argument."])
                ;;


@@ -732,7 +763,7 @@ else
 fi
 
 AC_MSG_CHECKING(for default user to run commands as)
 fi
 
 AC_MSG_CHECKING(for default user to run commands as)

-AC_ARG_WITH(runas-default, [  --with-runas-default    User to run commands as (default is "root")],
+AC_ARG_WITH(runas-default, [AS_HELP_STRING([--with-runas-default], [User to run commands as (default is "root")])],

 [case $with_runas_default in
     yes)       AC_MSG_ERROR(["must give --with-runas-default an argument."])
                ;;
 [case $with_runas_default in
     yes)       AC_MSG_ERROR(["must give --with-runas-default an argument."])
                ;;


@@ -744,7 +775,7 @@ esac])
 AC_DEFINE_UNQUOTED(RUNAS_DEFAULT, "$runas_default", [The user sudo should run commands as by default.])
 AC_MSG_RESULT([$runas_default])
 
 AC_DEFINE_UNQUOTED(RUNAS_DEFAULT, "$runas_default", [The user sudo should run commands as by default.])
 AC_MSG_RESULT([$runas_default])
 

-AC_ARG_WITH(exempt, [  --with-exempt=group     no passwd needed for users in this group],
+AC_ARG_WITH(exempt, [AS_HELP_STRING([--with-exempt=group], [no passwd needed for users in this group])],

 [case $with_exempt in
     yes)       AC_MSG_ERROR(["must give --with-exempt an argument."])
                ;;
 [case $with_exempt in
     yes)       AC_MSG_ERROR(["must give --with-exempt an argument."])
                ;;


@@ -757,7 +788,7 @@ AC_ARG_WITH(exempt, [  --with-exempt=group     no passwd needed for users in thi
 esac])
 
 AC_MSG_CHECKING(for editor that visudo should use)
 esac])
 
 AC_MSG_CHECKING(for editor that visudo should use)

-AC_ARG_WITH(editor, [  --with-editor=path      Default editor for visudo (defaults to vi)],
+AC_ARG_WITH(editor, [AS_HELP_STRING([--with-editor=path], [Default editor for visudo (defaults to vi)])],

 [case $with_editor in
     yes)       AC_MSG_ERROR(["must give --with-editor an argument."])
                ;;
 [case $with_editor in
     yes)       AC_MSG_ERROR(["must give --with-editor an argument."])
                ;;


@@ -769,7 +800,7 @@ AC_ARG_WITH(editor, [  --with-editor=path      Default editor for visudo (defaul
 esac], [AC_DEFINE(EDITOR, _PATH_VI) AC_MSG_RESULT(vi)])
 
 AC_MSG_CHECKING(whether to obey EDITOR and VISUAL environment variables)
 esac], [AC_DEFINE(EDITOR, _PATH_VI) AC_MSG_RESULT(vi)])
 
 AC_MSG_CHECKING(whether to obey EDITOR and VISUAL environment variables)

-AC_ARG_WITH(env-editor, [  --with-env-editor       Use the environment variable EDITOR for visudo],
+AC_ARG_WITH(env-editor, [AS_HELP_STRING([--with-env-editor], [Use the environment variable EDITOR for visudo])],

 [case $with_env_editor in
     yes)       env_editor=on
                ;;
 [case $with_env_editor in
     yes)       env_editor=on
                ;;


@@ -786,7 +817,7 @@ else
 fi
 
 AC_MSG_CHECKING(number of tries a user gets to enter their password)
 fi
 
 AC_MSG_CHECKING(number of tries a user gets to enter their password)

-AC_ARG_WITH(passwd-tries, [  --with-passwd-tries     number of tries to enter password (default is 3)],
+AC_ARG_WITH(passwd-tries, [AS_HELP_STRING([--with-passwd-tries], [number of tries to enter password (default is 3)])],

 [case $with_passwd_tries in
     yes)       ;;
     no)                AC_MSG_ERROR(["--without-editor not supported."])
 [case $with_passwd_tries in
     yes)       ;;
     no)                AC_MSG_ERROR(["--without-editor not supported."])


@@ -800,7 +831,7 @@ AC_DEFINE_UNQUOTED(TRIES_FOR_PASSWORD, $passwd_tries, [The number of tries a use
 AC_MSG_RESULT($passwd_tries)
 
 AC_MSG_CHECKING(time in minutes after which sudo will ask for a password again)
 AC_MSG_RESULT($passwd_tries)
 
 AC_MSG_CHECKING(time in minutes after which sudo will ask for a password again)

-AC_ARG_WITH(timeout, [  --with-timeout          minutes before sudo asks for passwd again (def is 5 minutes)],
+AC_ARG_WITH(timeout, [AS_HELP_STRING([--with-timeout], [minutes before sudo asks for passwd again (def is 5 minutes)])],

 [case $with_timeout in
     yes)       ;;
     no)                timeout=0
 [case $with_timeout in
     yes)       ;;
     no)                timeout=0


@@ -814,7 +845,7 @@ AC_DEFINE_UNQUOTED(TIMEOUT, $timeout, [The number of minutes before sudo asks fo
 AC_MSG_RESULT($timeout)
 
 AC_MSG_CHECKING(time in minutes after the password prompt will time out)
 AC_MSG_RESULT($timeout)
 
 AC_MSG_CHECKING(time in minutes after the password prompt will time out)

-AC_ARG_WITH(password-timeout, [  --with-password-timeout passwd prompt timeout in minutes (default is 5 minutes)],
+AC_ARG_WITH(password-timeout, [AS_HELP_STRING([--with-password-timeout], [passwd prompt timeout in minutes (default is 5 minutes)])],

 [case $with_password_timeout in
     yes)       ;;
     no)                password_timeout=0
 [case $with_password_timeout in
     yes)       ;;
     no)                password_timeout=0


@@ -828,7 +859,7 @@ AC_DEFINE_UNQUOTED(PASSWORD_TIMEOUT, $password_timeout, [The passwd prompt timeo
 AC_MSG_RESULT($password_timeout)
 
 AC_MSG_CHECKING(whether to use per-tty ticket files)
 AC_MSG_RESULT($password_timeout)
 
 AC_MSG_CHECKING(whether to use per-tty ticket files)

-AC_ARG_WITH(tty-tickets, [  --with-tty-tickets      use a different ticket file for each tty],
+AC_ARG_WITH(tty-tickets, [AS_HELP_STRING([--with-tty-tickets], [use a different ticket file for each tty])],

 [case $with_tty_tickets in
     yes)       tty_tickets=on
                ;;
 [case $with_tty_tickets in
     yes)       tty_tickets=on
                ;;


@@ -845,7 +876,7 @@ else
 fi
 
 AC_MSG_CHECKING(whether to include insults)
 fi
 
 AC_MSG_CHECKING(whether to include insults)

-AC_ARG_WITH(insults, [  --with-insults          insult the user for entering an incorrect password],
+AC_ARG_WITH(insults, [AS_HELP_STRING([--with-insults], [insult the user for entering an incorrect password])],

 [case $with_insults in
     yes)       insults=on
                with_classic_insults=yes
 [case $with_insults in
     yes)       insults=on
                with_classic_insults=yes


@@ -863,7 +894,7 @@ else
     AC_MSG_RESULT(no)
 fi
 
     AC_MSG_RESULT(no)
 fi
 

-AC_ARG_WITH(all-insults, [  --with-all-insults      include all the sudo insult sets],
+AC_ARG_WITH(all-insults, [AS_HELP_STRING([--with-all-insults], [include all the sudo insult sets])],

 [case $with_all_insults in
     yes)       with_classic_insults=yes
                with_csops_insults=yes
 [case $with_all_insults in
     yes)       with_classic_insults=yes
                with_csops_insults=yes


@@ -875,7 +906,7 @@ AC_ARG_WITH(all-insults, [  --with-all-insults      include all the sudo insult
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(classic-insults, [  --with-classic-insults  include the insults from the "classic" sudo],
+AC_ARG_WITH(classic-insults, [AS_HELP_STRING([--with-classic-insults], [include the insults from the "classic" sudo])],

 [case $with_classic_insults in
     yes)       AC_DEFINE(CLASSIC_INSULTS)
                ;;
 [case $with_classic_insults in
     yes)       AC_DEFINE(CLASSIC_INSULTS)
                ;;


@@ -884,7 +915,7 @@ AC_ARG_WITH(classic-insults, [  --with-classic-insults  include the insults from
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(csops-insults, [  --with-csops-insults    include CSOps insults],
+AC_ARG_WITH(csops-insults, [AS_HELP_STRING([--with-csops-insults], [include CSOps insults])],

 [case $with_csops_insults in
     yes)       AC_DEFINE(CSOPS_INSULTS)
                ;;
 [case $with_csops_insults in
     yes)       AC_DEFINE(CSOPS_INSULTS)
                ;;


@@ -893,7 +924,7 @@ AC_ARG_WITH(csops-insults, [  --with-csops-insults    include CSOps insults],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(hal-insults, [  --with-hal-insults      include 2001-like insults],
+AC_ARG_WITH(hal-insults, [AS_HELP_STRING([--with-hal-insults], [include 2001-like insults])],

 [case $with_hal_insults in
     yes)       AC_DEFINE(HAL_INSULTS)
                ;;
 [case $with_hal_insults in
     yes)       AC_DEFINE(HAL_INSULTS)
                ;;


@@ -902,7 +933,7 @@ AC_ARG_WITH(hal-insults, [  --with-hal-insults      include 2001-like insults],
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(goons-insults, [  --with-goons-insults    include the insults from the "Goon Show"],
+AC_ARG_WITH(goons-insults, [AS_HELP_STRING([--with-goons-insults], [include the insults from the "Goon Show"])],

 [case $with_goons_insults in
     yes)       AC_DEFINE(GOONS_INSULTS)
                ;;
 [case $with_goons_insults in
     yes)       AC_DEFINE(GOONS_INSULTS)
                ;;


@@ -911,20 +942,32 @@ AC_ARG_WITH(goons-insults, [  --with-goons-insults    include the insults from t
                ;;
 esac])
 
                ;;
 esac])
 

-AC_ARG_WITH(ldap, [  --with-ldap[[=DIR]]       enable LDAP support],
+AC_ARG_WITH(nsswitch, [AS_HELP_STRING([--with-nsswitch[[=PATH]]], [path to nsswitch.conf])],
+[case $with_nsswitch in
+    no)                ;;
+    yes)       with_nsswitch="/etc/nsswitch.conf"
+               ;;
+    *)         ;;
+esac])
+
+AC_ARG_WITH(ldap, [AS_HELP_STRING([--with-ldap[[=DIR]]], [enable LDAP support])],

 [case $with_ldap in
 [case $with_ldap in

-    no)                with_ldap="";;
+    no)                ;;

     *)         AC_DEFINE(HAVE_LDAP)
                AC_MSG_CHECKING(whether to use sudoers from LDAP)
                AC_MSG_RESULT(yes)
                ;;
 esac])
     *)         AC_DEFINE(HAVE_LDAP)
                AC_MSG_CHECKING(whether to use sudoers from LDAP)
                AC_MSG_RESULT(yes)
                ;;
 esac])

-AC_ARG_WITH(ldap-conf-file, [  --with-ldap-conf-file   path to LDAP configuration file],
-[AC_DEFINE_UNQUOTED(_PATH_LDAP_CONF, "$with_ldap_conf_file", [Path to the ldap.conf file])])
-AC_ARG_WITH(ldap-secret-file, [  --with-ldap-secret-file path to LDAP secret password file],
-[AC_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "$with_ldap_secret_file", [Path to the ldap.secret file])])

 
 

-AC_ARG_WITH(pc-insults, [  --with-pc-insults       replace politically incorrect insults with less offensive ones],
+AC_ARG_WITH(ldap-conf-file, [AS_HELP_STRING([--with-ldap-conf-file], [path to LDAP configuration file])])
+SUDO_DEFINE_UNQUOTED(_PATH_LDAP_CONF, "${with_ldap_conf_file-/etc/ldap.conf}", [Path to the ldap.conf file])
+ldap_conf=${with_ldap_conf_file-'/etc/ldap.conf'}
+
+AC_ARG_WITH(ldap-secret-file, [AS_HELP_STRING([--with-ldap-secret-file], [path to LDAP secret password file])])
+SUDO_DEFINE_UNQUOTED(_PATH_LDAP_SECRET, "${with_ldap_secret_file-/etc/ldap.secret}", [Path to the ldap.secret file])
+ldap_secret=${with_ldap_secret_file-'/etc/ldap.secret'}
+
+AC_ARG_WITH(pc-insults, [AS_HELP_STRING([--with-pc-insults], [replace politically incorrect insults with less offensive ones])],

 [case $with_pc_insults in
     yes)       AC_DEFINE(PC_INSULTS)
                ;;
 [case $with_pc_insults in
     yes)       AC_DEFINE(PC_INSULTS)
                ;;


@@ -945,20 +988,23 @@ if test "$insults" = "on"; then
 fi
 
 AC_MSG_CHECKING(whether to override the user's path)
 fi
 
 AC_MSG_CHECKING(whether to override the user's path)

-AC_ARG_WITH(secure-path, [  --with-secure-path      override the user's path with a built-in one],
+AC_ARG_WITH(secure-path, [AS_HELP_STRING([--with-secure-path], [override the user's path with a built-in one])],

 [case $with_secure_path in
 [case $with_secure_path in

-    yes)       AC_DEFINE_UNQUOTED(SECURE_PATH, "/bin:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc")
-               AC_MSG_RESULT([:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc])
+    yes)       with_secure_path="/bin:/usr/ucb:/usr/bin:/usr/sbin:/sbin:/usr/etc:/etc"
+               AC_DEFINE_UNQUOTED(SECURE_PATH, "$with_secure_path")
+               AC_MSG_RESULT([$with_secure_path])
+               secure_path="set to $with_secure_path"

                ;;
     no)                AC_MSG_RESULT(no)
                ;;
     *)         AC_DEFINE_UNQUOTED(SECURE_PATH, "$with_secure_path")
                AC_MSG_RESULT([$with_secure_path])
                ;;
     no)                AC_MSG_RESULT(no)
                ;;
     *)         AC_DEFINE_UNQUOTED(SECURE_PATH, "$with_secure_path")
                AC_MSG_RESULT([$with_secure_path])

+               secure_path="set to F<$with_secure_path>"

                ;;
 esac], AC_MSG_RESULT(no))
 
 AC_MSG_CHECKING(whether to get ip addresses from the network interfaces)
                ;;
 esac], AC_MSG_RESULT(no))
 
 AC_MSG_CHECKING(whether to get ip addresses from the network interfaces)

-AC_ARG_WITH(interfaces, [  --without-interfaces    don't try to read the ip addr of ether interfaces],
+AC_ARG_WITH(interfaces, [AS_HELP_STRING([--without-interfaces], [don't try to read the ip addr of ether interfaces])],

 [case $with_interfaces in
     yes)       AC_MSG_RESULT(yes)
                ;;
 [case $with_interfaces in
     yes)       AC_MSG_RESULT(yes)
                ;;


@@ -970,7 +1016,7 @@ AC_ARG_WITH(interfaces, [  --without-interfaces    don't try to read the ip addr
 esac], AC_MSG_RESULT(yes))
 
 AC_MSG_CHECKING(whether stow should be used)
 esac], AC_MSG_RESULT(yes))
 
 AC_MSG_CHECKING(whether stow should be used)

-AC_ARG_WITH(stow, [  --with-stow             properly handle GNU stow packaging],
+AC_ARG_WITH(stow, [AS_HELP_STRING([--with-stow], [properly handle GNU stow packaging])],

 [case $with_stow in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(USE_STOW)
 [case $with_stow in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(USE_STOW)


@@ -981,14 +1027,50 @@ AC_ARG_WITH(stow, [  --with-stow             properly handle GNU stow packaging]
                ;;
 esac], AC_MSG_RESULT(no))
 
                ;;
 esac], AC_MSG_RESULT(no))
 

+AC_MSG_CHECKING(whether to use an askpass helper)
+AC_ARG_WITH(askpass, [AS_HELP_STRING([--with-askpass=PATH], [Fully qualified pathname of askpass helper])],
+[case $with_askpass in
+    yes)       AC_MSG_ERROR(["--with-askpass takes a path as an argument."])
+               ;;
+    no)                ;;
+    *)         AC_DEFINE_UNQUOTED(_PATH_SUDO_ASKPASS, "$with_askpass", [The fully qualified pathname of askpass])
+               ;;
+esac], AC_MSG_RESULT(no))
+
+dnl
+dnl If enabled, set LIBVAS_SO, LIBVAS_RPATH and USING_NONUNIX_GROUPS
+dnl
+AC_ARG_WITH(libvas, [AS_HELP_STRING([--with-libvas=NAME], [Name of the libvas shared library (default=libvas.so)])],
+[case $with_libvas in
+    yes)       with_libvas=libvas.so
+               ;;
+    no)                ;;
+    *)         AC_DEFINE_UNQUOTED([LIBVAS_SO], ["$with_libvas"], [The name of libvas.so])
+               ;;
+esac
+if test X"$with_libvas" != X"no"; then
+    AC_DEFINE_UNQUOTED([LIBVAS_SO], ["$with_libvas"], [The name of libvas.so])
+    AC_DEFINE(USING_NONUNIX_GROUPS)
+    NONUNIX_GROUPS_IMPL="vasgroups.o"
+    AC_ARG_WITH([libvas-rpath],
+       [AS_HELP_STRING([--with-libvas-rpath=PATH],
+                      [Path to look for libvas in [default=/opt/quest/lib]])],
+       [LIBVAS_RPATH=$withval],
+       [LIBVAS_RPATH=/opt/quest/lib])
+    dnl
+    dnl Some platforms require libdl for dlopen()
+    dnl
+    AC_CHECK_LIB([dl], [main])
+fi
+])
+

 dnl
 dnl Options for --enable
 dnl
 
 AC_MSG_CHECKING(whether to do user authentication by default)
 AC_ARG_ENABLE(authentication,
 dnl
 dnl Options for --enable
 dnl
 
 AC_MSG_CHECKING(whether to do user authentication by default)
 AC_ARG_ENABLE(authentication,

-[  --disable-authentication
-                          Do not require authentication by default],
+[AS_HELP_STRING([--disable-authentication], [Do not require authentication by default])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                ;;
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                ;;


@@ -1003,7 +1085,7 @@ AC_ARG_ENABLE(authentication,
 
 AC_MSG_CHECKING(whether to disable running the mailer as root)
 AC_ARG_ENABLE(root-mailer,
 
 AC_MSG_CHECKING(whether to disable running the mailer as root)
 AC_ARG_ENABLE(root-mailer,

-[  --disable-root-mailer   Don't run the mailer as root, run as the user],
+[AS_HELP_STRING([--disable-root-mailer], [Don't run the mailer as root, run as the user])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;


@@ -1017,7 +1099,7 @@ AC_ARG_ENABLE(root-mailer,
 ], AC_MSG_RESULT(no))
 
 AC_ARG_ENABLE(setreuid,
 ], AC_MSG_RESULT(no))
 
 AC_ARG_ENABLE(setreuid,

-[  --disable-setreuid      Don't try to use the setreuid() function],
+[AS_HELP_STRING([--disable-setreuid], [Don't try to use the setreuid() function])],

 [ case "$enableval" in
     no)                SKIP_SETREUID=yes
                ;;
 [ case "$enableval" in
     no)                SKIP_SETREUID=yes
                ;;


@@ -1026,7 +1108,7 @@ AC_ARG_ENABLE(setreuid,
 ])
 
 AC_ARG_ENABLE(setresuid,
 ])
 
 AC_ARG_ENABLE(setresuid,

-[  --disable-setresuid     Don't try to use the setresuid() function],
+[AS_HELP_STRING([--disable-setresuid], [Don't try to use the setresuid() function])],

 [ case "$enableval" in
     no)                SKIP_SETRESUID=yes
                ;;
 [ case "$enableval" in
     no)                SKIP_SETRESUID=yes
                ;;


@@ -1036,7 +1118,7 @@ AC_ARG_ENABLE(setresuid,
 
 AC_MSG_CHECKING(whether to disable shadow password support)
 AC_ARG_ENABLE(shadow,
 
 AC_MSG_CHECKING(whether to disable shadow password support)
 AC_ARG_ENABLE(shadow,

-[  --disable-shadow        Never use shadow passwords],
+[AS_HELP_STRING([--disable-shadow], [Never use shadow passwords])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;


@@ -1051,7 +1133,7 @@ AC_ARG_ENABLE(shadow,
 
 AC_MSG_CHECKING(whether root should be allowed to use sudo)
 AC_ARG_ENABLE(root-sudo,
 
 AC_MSG_CHECKING(whether root should be allowed to use sudo)
 AC_ARG_ENABLE(root-sudo,

-[  --disable-root-sudo     Don't allow root to run sudo],
+[AS_HELP_STRING([--disable-root-sudo], [Don't allow root to run sudo])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                ;;
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                ;;


@@ -1066,7 +1148,7 @@ AC_ARG_ENABLE(root-sudo,
 
 AC_MSG_CHECKING(whether to log the hostname in the log file)
 AC_ARG_ENABLE(log-host,
 
 AC_MSG_CHECKING(whether to log the hostname in the log file)
 AC_ARG_ENABLE(log-host,

-[  --enable-log-host       Log the hostname in the log file],
+[AS_HELP_STRING([--enable-log-host], [Log the hostname in the log file])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(HOST_IN_LOG)
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(HOST_IN_LOG)


@@ -1081,7 +1163,7 @@ AC_ARG_ENABLE(log-host,
 
 AC_MSG_CHECKING(whether to invoke a shell if sudo is given no arguments)
 AC_ARG_ENABLE(noargs-shell,
 
 AC_MSG_CHECKING(whether to invoke a shell if sudo is given no arguments)
 AC_ARG_ENABLE(noargs-shell,

-[  --enable-noargs-shell   If sudo is given no arguments run a shell],
+[AS_HELP_STRING([--enable-noargs-shell], [If sudo is given no arguments run a shell])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(SHELL_IF_NO_ARGS)
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(SHELL_IF_NO_ARGS)


@@ -1096,8 +1178,7 @@ AC_ARG_ENABLE(noargs-shell,
 
 AC_MSG_CHECKING(whether to set \$HOME to target user in shell mode)
 AC_ARG_ENABLE(shell-sets-home,
 
 AC_MSG_CHECKING(whether to set \$HOME to target user in shell mode)
 AC_ARG_ENABLE(shell-sets-home,

-[  --enable-shell-sets-home
-                          set $HOME to target user in shell mode],
+[AS_HELP_STRING([--enable-shell-sets-home], [Set $HOME to target user in shell mode])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(SHELL_SETS_HOME)
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(yes)
                AC_DEFINE(SHELL_SETS_HOME)


@@ -1112,7 +1193,7 @@ AC_ARG_ENABLE(shell-sets-home,
 
 AC_MSG_CHECKING(whether to disable 'command not found' messages)
 AC_ARG_ENABLE(path_info,
 
 AC_MSG_CHECKING(whether to disable 'command not found' messages)
 AC_ARG_ENABLE(path_info,

-[  --disable-path-info     Print 'command not allowed' not 'command not found'],
+[AS_HELP_STRING([--disable-path-info], [Print 'command not allowed' not 'command not found'])],

 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;
 [ case "$enableval" in
     yes)       AC_MSG_RESULT(no)
                ;;


@@ -1126,9 +1207,25 @@ AC_ARG_ENABLE(path_info,
   esac
 ], AC_MSG_RESULT(no))
 
   esac
 ], AC_MSG_RESULT(no))
 

-AC_ARG_WITH(selinux, [  --with-selinux          enable SELinux support],
+AC_MSG_CHECKING(whether to enable environment debugging)
+AC_ARG_ENABLE(env_debug,
+[AS_HELP_STRING([--enable-env-debug], [Whether to enable environment debugging.])],
+[ case "$enableval" in
+    yes)       AC_MSG_RESULT(yes)
+               AC_DEFINE(ENV_DEBUG)
+               ;;
+    no)                AC_MSG_RESULT(no)
+               ;;
+    *)         AC_MSG_RESULT(no)
+               AC_MSG_WARN([Ignoring unknown argument to --enable-env-debug: $enableval])
+               ;;
+  esac
+], AC_MSG_RESULT(no))
+
+AC_ARG_WITH(selinux, [AS_HELP_STRING([--with-selinux], [enable SELinux support])],

 [case $with_selinux in
 [case $with_selinux in

-    yes)       AC_DEFINE(HAVE_SELINUX)
+    yes)       SELINUX_USAGE="[[-r role]] [[-t type]] "
+               AC_DEFINE(HAVE_SELINUX)

                SUDO_LIBS="${SUDO_LIBS} -lselinux"
                SUDO_OBJS="${SUDO_OBJS} selinux.o"
                PROGS="${PROGS} sesh"
                SUDO_LIBS="${SUDO_LIBS} -lselinux"
                SUDO_OBJS="${SUDO_OBJS} selinux.o"
                PROGS="${PROGS} sesh"


@@ -1140,6 +1237,13 @@ AC_ARG_WITH(selinux, [  --with-selinux          enable SELinux support],
                ;;
 esac])
 
                ;;
 esac])
 

+dnl
+dnl gss_krb5_ccache_name() may not work on Heimdal so we don't use it by default
+dnl
+AC_ARG_ENABLE(gss_krb5_ccache_name,
+[AS_HELP_STRING([--enable-gss-krb5-ccache-name], [Use GSS-API to set the Kerberos V cred cache name])],
+[check_gss_krb5_ccache_name=$enableval], [check_gss_krb5_ccache_name=no])
+

 dnl
 dnl If we don't have egrep we can't do anything...
 dnl
 dnl
 dnl If we don't have egrep we can't do anything...
 dnl


@@ -1165,8 +1269,8 @@ dnl
 dnl Libtool magic; enable shared libs and disable static libs
 dnl
 AC_CANONICAL_HOST
 dnl Libtool magic; enable shared libs and disable static libs
 dnl
 AC_CANONICAL_HOST

-AC_CANONICAL_TARGET([])

 AC_DISABLE_STATIC
 AC_DISABLE_STATIC

+AC_LIBTOOL_DLOPEN

 AC_PROG_LIBTOOL
 
 dnl
 AC_PROG_LIBTOOL
 
 dnl


@@ -1178,7 +1282,7 @@ else
     eval _shrext="$shrext_cmds"
 fi
 AC_MSG_CHECKING(path to sudo_noexec.so)
     eval _shrext="$shrext_cmds"
 fi
 AC_MSG_CHECKING(path to sudo_noexec.so)

-AC_ARG_WITH(noexec, [  --with-noexec[=PATH]      fully qualified pathname of sudo_noexec.so],
+AC_ARG_WITH(noexec, [AS_HELP_STRING([--with-noexec[=PATH]], [fully qualified pathname of sudo_noexec.so])],

 [case $with_noexec in
     yes)       with_noexec="$libexecdir/sudo_noexec$_shrext"
                ;;
 [case $with_noexec in
     yes)       with_noexec="$libexecdir/sudo_noexec$_shrext"
                ;;


@@ -1186,6 +1290,7 @@ AC_ARG_WITH(noexec, [  --with-noexec[=PATH]      fully qualified pathname of sud
     *)         ;;
 esac], [with_noexec="$libexecdir/sudo_noexec$_shrext"])
 AC_MSG_RESULT($with_noexec)
     *)         ;;
 esac], [with_noexec="$libexecdir/sudo_noexec$_shrext"])
 AC_MSG_RESULT($with_noexec)

+NOEXECFILE="sudo_noexec$_shrext"

 NOEXECDIR="`echo $with_noexec|sed 's:^\(.*\)/[[^/]]*:\1:'`"
 
 dnl
 NOEXECDIR="`echo $with_noexec|sed 's:^\(.*\)/[[^/]]*:\1:'`"
 
 dnl


@@ -1285,6 +1390,22 @@ case "$host" in
                if test X"$with_aixauth" = X""; then
                    AC_CHECK_FUNCS(authenticate, [AUTH_EXCL_DEF="AIX_AUTH"])
                fi
                if test X"$with_aixauth" = X""; then
                    AC_CHECK_FUNCS(authenticate, [AUTH_EXCL_DEF="AIX_AUTH"])
                fi

+
+               # AIX analog of nsswitch.conf, enabled by default
+               AC_ARG_WITH(netsvc, [AS_HELP_STRING([--with-netsvc[[=PATH]]], [path to netsvc.conf])],
+               [case $with_netsvc in
+                   no)         ;;
+                   yes)        with_netsvc="/etc/netsvc.conf"
+                               ;;
+                   *)          ;;
+               esac])
+               if test -z "$with_nsswitch" -a -z "$with_netsvc"; then
+                   with_netsvc="/etc/netsvc.conf"
+               fi
+
+               # AIX-specific functions
+               AC_CHECK_FUNCS(getuserattr)
+               SUDO_OBJS="$SUDO_OBJS aix.o"

                ;;
     *-*-hiuxmpp*)
                : ${mansectsu='1m'}
                ;;
     *-*-hiuxmpp*)
                : ${mansectsu='1m'}


@@ -1298,6 +1419,23 @@ case "$host" in
                : ${mansectsu='1m'}
                : ${mansectform='4'}
 
                : ${mansectsu='1m'}
                : ${mansectform='4'}
 

+               # HP-UX bundled compiler can't generate shared objects
+               if test "x$ac_cv_prog_cc_c89" = "xno"; then
+                   with_noexec=no
+               fi
+
+               # Use the +DAportable flag if it is supported
+               _CFLAGS="$CFLAGS"
+               CFLAGS="$CFLAGS +DAportable"
+               AC_CACHE_CHECK([whether $CC understands +DAportable],
+                   [sudo_cv_var_daportable],
+                   [AC_TRY_LINK([], [], [sudo_cv_var_daportable=yes],
+                                [sudo_cv_var_daportable=no])]
+               )
+               if test X"$sudo_cv_var_daportable" != X"yes"; then
+                   CFLAGS="$_CFLAGS"
+               fi
+

                case "$host" in
                        *-*-hpux[1-8].*)
                            AC_DEFINE(BROKEN_SYSLOG)
                case "$host" in
                        *-*-hpux[1-8].*)
                            AC_DEFINE(BROKEN_SYSLOG)


@@ -1340,7 +1478,7 @@ case "$host" in
                : ${CHECKSIA='true'}
                AC_MSG_CHECKING(whether to disable sia support on Digital UNIX)
                AC_ARG_ENABLE(sia,
                : ${CHECKSIA='true'}
                AC_MSG_CHECKING(whether to disable sia support on Digital UNIX)
                AC_ARG_ENABLE(sia,

-               [  --disable-sia           Disable SIA on Digital UNIX],
+               [AS_HELP_STRING([--disable-sia], [Disable SIA on Digital UNIX])],

                [ case "$enableval" in
                    yes)        AC_MSG_RESULT(no)
                                CHECKSIA=true
                [ case "$enableval" in
                    yes)        AC_MSG_RESULT(no)
                                CHECKSIA=true


@@ -1633,6 +1771,7 @@ dnl
 dnl Program checks
 dnl
 AC_PROG_YACC
 dnl Program checks
 dnl
 AC_PROG_YACC

+AC_PATH_PROG([FLEX], [flex], [flex])

 SUDO_PROG_MV
 SUDO_PROG_BSHELL
 if test -z "$with_sendmail"; then
 SUDO_PROG_MV
 SUDO_PROG_BSHELL
 if test -z "$with_sendmail"; then


@@ -1648,7 +1787,6 @@ AC_HEADER_STDC
 AC_HEADER_DIRENT
 AC_HEADER_TIME
 AC_CHECK_HEADERS(malloc.h paths.h utime.h netgroup.h sys/sockio.h sys/bsdtypes.h sys/select.h)
 AC_HEADER_DIRENT
 AC_HEADER_TIME
 AC_CHECK_HEADERS(malloc.h paths.h utime.h netgroup.h sys/sockio.h sys/bsdtypes.h sys/select.h)

-AC_CHECK_HEADERS([err.h], [], [AC_LIBOBJ(err)])

 dnl ultrix termio/termios are broken
 if test "$OS" != "ultrix"; then
     AC_SYS_POSIX_TERMIOS
 dnl ultrix termio/termios are broken
 if test "$OS" != "ultrix"; then
     AC_SYS_POSIX_TERMIOS


@@ -1659,7 +1797,7 @@ if test "$OS" != "ultrix"; then
     fi
 fi
 if test ${with_logincap-'no'} != "no"; then
     fi
 fi
 if test ${with_logincap-'no'} != "no"; then

-    AC_CHECK_HEADERS(login_cap.h, [LCMAN=""
+    AC_CHECK_HEADERS(login_cap.h, [LOGINCAP_USAGE='[[-c class|-]] '; LCMAN=""

        case "$OS" in
            freebsd|netbsd)     SUDO_LIBS="${SUDO_LIBS} -lutil"
            ;;
        case "$OS" in
            freebsd|netbsd)     SUDO_LIBS="${SUDO_LIBS} -lutil"
            ;;


@@ -1675,7 +1813,8 @@ dnl typedef checks
 dnl
 AC_TYPE_MODE_T
 AC_TYPE_UID_T
 dnl
 AC_TYPE_MODE_T
 AC_TYPE_UID_T

-AC_CHECK_TYPES([sig_atomic_t], , [AC_DEFINE(sig_atomic_t, int)], [#include <sys/types.h>
+AC_CHECK_TYPE([__signed char], [], [AC_CHECK_TYPE([signed char], [AC_DEFINE(__signed, signed)], [AC_DEFINE(__signed, [])])])
+AC_CHECK_TYPE([sig_atomic_t], [], [AC_DEFINE(sig_atomic_t, int)], [#include <sys/types.h>

 #include <signal.h>])
 AC_CHECK_TYPES([sigaction_t], [AC_DEFINE(HAVE_SIGACTION_T)], [], [#include <sys/types.h>
 #include <signal.h>])
 #include <signal.h>])
 AC_CHECK_TYPES([sigaction_t], [AC_DEFINE(HAVE_SIGACTION_T)], [], [#include <sys/types.h>
 #include <signal.h>])


@@ -1690,7 +1829,6 @@ SUDO_TYPE_SIZE_T
 SUDO_TYPE_SSIZE_T
 SUDO_TYPE_DEV_T
 SUDO_TYPE_INO_T
 SUDO_TYPE_SSIZE_T
 SUDO_TYPE_DEV_T
 SUDO_TYPE_INO_T

-SUDO_FULL_VOID

 SUDO_UID_T_LEN
 SUDO_TYPE_LONG_LONG
 SUDO_SOCK_SA_LEN
 SUDO_UID_T_LEN
 SUDO_TYPE_LONG_LONG
 SUDO_SOCK_SA_LEN


@@ -1707,7 +1845,9 @@ dnl
 AC_FUNC_GETGROUPS
 AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
               strftime setrlimit initgroups getgroups fstat gettimeofday \
 AC_FUNC_GETGROUPS
 AC_CHECK_FUNCS(strchr strrchr memchr memcpy memset sysconf tzset \
               strftime setrlimit initgroups getgroups fstat gettimeofday \

-              setlocale getaddrinfo)
+              setlocale getaddrinfo setsid setenv setrlimit64)
+AC_CHECK_FUNCS(unsetenv, SUDO_FUNC_UNSETENV_VOID)
+SUDO_FUNC_PUTENV_CONST

 if test -z "$SKIP_SETRESUID"; then
     AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
 fi
 if test -z "$SKIP_SETRESUID"; then
     AC_CHECK_FUNCS(setresuid, [SKIP_SETREUID=yes])
 fi


@@ -1730,7 +1870,6 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <glob.h>]], [[int i = GLOB_BRACE |
 AC_CHECK_FUNCS(lockf flock, [break])
 AC_CHECK_FUNCS(waitpid wait3, [break])
 AC_CHECK_FUNCS(innetgr _innetgr, [AC_CHECK_FUNCS(getdomainname) [break]])
 AC_CHECK_FUNCS(lockf flock, [break])
 AC_CHECK_FUNCS(waitpid wait3, [break])
 AC_CHECK_FUNCS(innetgr _innetgr, [AC_CHECK_FUNCS(getdomainname) [break]])

-AC_CHECK_FUNCS(lsearch, [], [AC_CHECK_LIB([compat], [lsearch], [AC_CHECK_HEADER([search.h], [AC_DEFINE(HAVE_LSEARCH)] [LIBS="${LIBS} -lcompat"], [AC_LIBOBJ(lsearch)], -)], [AC_LIBOBJ(lsearch)])])

 AC_CHECK_FUNCS(utimes, [AC_CHECK_FUNCS(futimes futimesat, [break])], [AC_CHECK_FUNCS(futime) AC_LIBOBJ(utimes)])
 SUDO_FUNC_FNMATCH([AC_DEFINE(HAVE_FNMATCH)], [AC_LIBOBJ(fnmatch)])
 SUDO_FUNC_ISBLANK
 AC_CHECK_FUNCS(utimes, [AC_CHECK_FUNCS(futimes futimesat, [break])], [AC_CHECK_FUNCS(futime) AC_LIBOBJ(utimes)])
 SUDO_FUNC_FNMATCH([AC_DEFINE(HAVE_FNMATCH)], [AC_LIBOBJ(fnmatch)])
 SUDO_FUNC_ISBLANK


@@ -1762,7 +1901,7 @@ dnl
 dnl Check for the dirfd function/macro.  If not found, look for dd_fd in DIR.
 dnl
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>
 dnl Check for the dirfd function/macro.  If not found, look for dd_fd in DIR.
 dnl
 AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <sys/types.h>

-#include <$ac_header_dirent>]], [[DIR d; (void)dirfd(&d);]])], [AC_DEFINE(HAVE_DIRFD)], [AC_TRY_LINK([#include <sys/types.h>
+#include <$ac_header_dirent>]], [[DIR *d; (void)dirfd(d);]])], [AC_DEFINE(HAVE_DIRFD)], [AC_TRY_LINK([#include <sys/types.h>

 #include <$ac_header_dirent>], [DIR d; memset(&d, 0, sizeof(d)); return(d.dd_fd);], [AC_DEFINE(HAVE_DD_FD)])])
 dnl
 dnl If NEED_SNPRINTF is set, add snprintf.c to LIBOBJS
 #include <$ac_header_dirent>], [DIR d; memset(&d, 0, sizeof(d)); return(d.dd_fd);], [AC_DEFINE(HAVE_DD_FD)])])
 dnl
 dnl If NEED_SNPRINTF is set, add snprintf.c to LIBOBJS


@@ -1789,13 +1928,6 @@ dnl If syslog(3) not in libc, check -lsocket, -lnsl and -linet
 dnl
 AC_CHECK_FUNC(syslog, , [AC_CHECK_LIB(socket, syslog, [NET_LIBS="${NET_LIBS} -lsocket"; LIBS="${LIBS} -lsocket"], AC_CHECK_LIB(nsl, syslog, [NET_LIBS="${NET_LIBS} -lnsl"; LIBS="${LIBS} -lnsl"], AC_CHECK_LIB(inet, syslog, [NET_LIBS="${NET_LIBS} -linet"; LIBS="${LIBS} -linet"])))])
 dnl
 dnl
 AC_CHECK_FUNC(syslog, , [AC_CHECK_LIB(socket, syslog, [NET_LIBS="${NET_LIBS} -lsocket"; LIBS="${LIBS} -lsocket"], AC_CHECK_LIB(nsl, syslog, [NET_LIBS="${NET_LIBS} -lnsl"; LIBS="${LIBS} -lnsl"], AC_CHECK_LIB(inet, syslog, [NET_LIBS="${NET_LIBS} -linet"; LIBS="${LIBS} -linet"])))])
 dnl

-dnl Bison and DCE use alloca(3), if not in libc, use the sudo one (from gcc)
-dnl (gcc includes its own alloca(3) but other compilers may not)
-dnl
-if test "$with_DCE" = "yes" -o "$ac_cv_prog_YACC" = "bison -y"; then
-    AC_FUNC_ALLOCA
-fi
-dnl

 dnl Check for getprogname() or __progname
 dnl
 AC_CHECK_FUNCS(getprogname, , [
 dnl Check for getprogname() or __progname
 dnl
 AC_CHECK_FUNCS(getprogname, , [


@@ -1810,6 +1942,19 @@ AC_CHECK_FUNCS(getprogname, , [
     AC_MSG_RESULT($sudo_cv___progname)
 ])
 
     AC_MSG_RESULT($sudo_cv___progname)
 ])
 

+dnl
+dnl nsswitch.conf and its equivalents
+dnl
+netsvc_conf='/etc/netsvc.conf'
+nsswitch_conf='/etc/nsswitch.conf'
+if test ${with_netsvc-"no"} != "no"; then
+    SUDO_DEFINE_UNQUOTED(_PATH_NETSVC_CONF, "${with_netsvc-/etc/netsvc.conf}")
+    netsvc_conf=${with_netsvc-/etc/netsvc.conf}
+elif test ${with_nsswitch-"yes"} != "no"; then
+    SUDO_DEFINE_UNQUOTED(_PATH_NSSWITCH_CONF, "${with_nsswitch-/etc/nsswitch.conf}")
+    nsswitch_conf=${with_nsswitch-/etc/nsswitch.conf}
+fi
+

 dnl
 dnl Mutually exclusive auth checks come first, followed by
 dnl non-exclusive ones.  Note: passwd must be last of all!
 dnl
 dnl Mutually exclusive auth checks come first, followed by
 dnl non-exclusive ones.  Note: passwd must be last of all!


@@ -1836,10 +1981,15 @@ dnl and we do the actual tests here.
 dnl
 if test ${with_pam-"no"} != "no"; then
     dnl
 dnl
 if test ${with_pam-"no"} != "no"; then
     dnl

-    dnl Linux may need this
+    dnl Some platforms need libdl for dlopen

     dnl
     dnl

-    AC_CHECK_LIB([dl], [main], [SUDO_LIBS="${SUDO_LIBS} -lpam -ldl"], [SUDO_LIBS="${SUDO_LIBS} -lpam"])
-    ac_cv_lib_dl=ac_cv_lib_dl_main
+    case "$LIBS" in
+       *-ldl*) SUDO_LIBS="${SUDO_LIBS} -lpam"
+               ;;
+       *)      AC_CHECK_LIB([dl], [main], [SUDO_LIBS="${SUDO_LIBS} -lpam -ldl"], [SUDO_LIBS="${SUDO_LIBS} -lpam"])
+               ac_cv_lib_dl=ac_cv_lib_dl_main
+               ;;
+    esac

 
     dnl
     dnl Some PAM implementations (MacOS X for example) put the PAM headers
 
     dnl
     dnl Some PAM implementations (MacOS X for example) put the PAM headers


@@ -1852,12 +2002,12 @@ if test ${with_pam-"no"} != "no"; then
        AUTH_EXCL=PAM
        AC_MSG_CHECKING(whether to use PAM session support)
        AC_ARG_ENABLE(pam_session,
        AUTH_EXCL=PAM
        AC_MSG_CHECKING(whether to use PAM session support)
        AC_ARG_ENABLE(pam_session,

-       [  --disable-pam-session   Disable PAM session support],
+       [AS_HELP_STRING([--disable-pam-session], [Disable PAM session support])],

            [ case "$enableval" in
                yes)    AC_MSG_RESULT(yes)
                        ;;
                no)             AC_MSG_RESULT(no)
            [ case "$enableval" in
                yes)    AC_MSG_RESULT(yes)
                        ;;
                no)             AC_MSG_RESULT(no)

-                           AC_DEFINE(NO_PAM_SESSION)
+                           AC_DEFINE([NO_PAM_SESSION], [], [PAM session support disabled])

                            ;;
                *)              AC_MSG_RESULT(no)
                            AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])
                            ;;
                *)              AC_MSG_RESULT(no)
                            AC_MSG_WARN([Ignoring unknown argument to --enable-pam-session: $enableval])


@@ -1865,8 +2015,13 @@ if test ${with_pam-"no"} != "no"; then
            esac], AC_MSG_RESULT(yes))
        case $host in
            *-*-linux*|*-*-solaris*)
            esac], AC_MSG_RESULT(yes))
        case $host in
            *-*-linux*|*-*-solaris*)

-                   AC_CHECK_FUNCS(dgettext, [],
-                       [AC_CHECK_LIB(intl, dgettext, [LIBS="${LIBS} -lintl"]
+                   # dgettext() may be defined to dgettext_libintl in the
+                   # header file, so first check that it links w/ additional
+                   # libs, then try with -lintl
+                   AC_LINK_IFELSE([AC_LANG_PROGRAM(
+                   [[#include <libintl.h>]], [(void)dgettext((char *)0, (char *)0);])],
+                   [AC_DEFINE(HAVE_DGETTEXT)],
+                   [AC_CHECK_LIB(intl, dgettext, [LIBS="${LIBS} -lintl"]

                        [AC_DEFINE(HAVE_DGETTEXT)])])
                    ;;
        esac
                        [AC_DEFINE(HAVE_DGETTEXT)])])
                    ;;
        esac


@@ -1894,6 +2049,7 @@ dnl
 if test ${with_bsdauth-'no'} != "no"; then
     AC_CHECK_HEADER(bsd_auth.h, AC_DEFINE(HAVE_BSD_AUTH_H)
        [AUTH_OBJS="$AUTH_OBJS bsdauth.o"]
 if test ${with_bsdauth-'no'} != "no"; then
     AC_CHECK_HEADER(bsd_auth.h, AC_DEFINE(HAVE_BSD_AUTH_H)
        [AUTH_OBJS="$AUTH_OBJS bsdauth.o"]

+       [BSDAUTH_USAGE='[[-a auth_type]] ']

        [AUTH_EXCL=BSD_AUTH; BAMAN=""],
        [AC_MSG_ERROR([BSD authentication was specified but bsd_auth.h could not be found])])
 fi
        [AUTH_EXCL=BSD_AUTH; BAMAN=""],
        [AC_MSG_ERROR([BSD authentication was specified but bsd_auth.h could not be found])])
 fi


@@ -2086,17 +2242,32 @@ if test ${with_kerb5-'no'} != "no" -a -z "$KRB5CONFIG"; then
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <krb5.h>]], [[const char *tmp = heimdal_version;]])], [
            AC_MSG_RESULT(yes)
            AC_DEFINE(HAVE_HEIMDAL)
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include <krb5.h>]], [[const char *tmp = heimdal_version;]])], [
            AC_MSG_RESULT(yes)
            AC_DEFINE(HAVE_HEIMDAL)

+           # XXX - need to check whether -lcrypo is needed!

            SUDO_LIBS="${SUDO_LIBS} -lkrb5 -lcrypto -ldes -lcom_err -lasn1"
            AC_CHECK_LIB(roken, main, [SUDO_LIBS="${SUDO_LIBS} -lroken"])
        ], [
            AC_MSG_RESULT(no)
            SUDO_LIBS="${SUDO_LIBS} -lkrb5 -lk5crypto -lcom_err"
            SUDO_LIBS="${SUDO_LIBS} -lkrb5 -lcrypto -ldes -lcom_err -lasn1"
            AC_CHECK_LIB(roken, main, [SUDO_LIBS="${SUDO_LIBS} -lroken"])
        ], [
            AC_MSG_RESULT(no)
            SUDO_LIBS="${SUDO_LIBS} -lkrb5 -lk5crypto -lcom_err"

-           AC_CHECK_LIB(krb5support, main, [SUDO_LIBS="${SUDO_LIBS} -lkrb5support,"])
+           AC_CHECK_LIB(krb5support, main, [SUDO_LIBS="${SUDO_LIBS} -lkrb5support"])

     ])
     AUTH_OBJS="$AUTH_OBJS kerb5.o"
     _LIBS="$LIBS"
     LIBS="${LIBS} ${SUDO_LIBS}"
     AC_CHECK_FUNCS(krb5_verify_user krb5_init_secure_context)
     ])
     AUTH_OBJS="$AUTH_OBJS kerb5.o"
     _LIBS="$LIBS"
     LIBS="${LIBS} ${SUDO_LIBS}"
     AC_CHECK_FUNCS(krb5_verify_user krb5_init_secure_context)

+    AC_CHECK_FUNCS(krb5_get_init_creds_opt_alloc, [
+       AC_CACHE_CHECK([whether krb5_get_init_creds_opt_free takes a context],
+           sudo_cv_krb5_get_init_creds_opt_free_two_args, [
+               AC_TRY_COMPILE([#include <krb5.h>],
+                   [krb5_get_init_creds_opt_free(NULL, NULL);],
+                   [sudo_cv_krb5_get_init_creds_opt_free_two_args=yes],
+                   [sudo_cv_krb5_get_init_creds_opt_free_two_args=no]
+               )
+           ]
+       )
+    ])
+    if test X"$sudo_cv_krb5_get_init_creds_opt_free_two_args" = X"yes"; then
+       AC_DEFINE(HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_TWO_ARGS)
+    fi

     LIBS="$_LIBS"
 fi
 
     LIBS="$_LIBS"
 fi
 


@@ -2285,6 +2456,7 @@ if test ${with_ldap-'no'} != "no"; then
        with_ldap=yes
     fi
     SUDO_OBJS="${SUDO_OBJS} ldap.o"
        with_ldap=yes
     fi
     SUDO_OBJS="${SUDO_OBJS} ldap.o"

+    LDAP=""

 
     AC_MSG_CHECKING([for LDAP libraries])
     LDAP_LIBS=""
 
     AC_MSG_CHECKING([for LDAP libraries])
     LDAP_LIBS=""


@@ -2318,14 +2490,57 @@ if test ${with_ldap-'no'} != "no"; then
     AC_MSG_RESULT([yes])
     AC_DEFINE(HAVE_LBER_H)])
 
     AC_MSG_RESULT([yes])
     AC_DEFINE(HAVE_LBER_H)])
 

-    AC_CHECK_FUNCS(ldap_initialize ldap_start_tls_s ldapssl_init ldapssl_set_strength)
+    AC_CHECK_HEADERS([sasl/sasl.h] [sasl.h], [AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s)], [break])

     AC_CHECK_HEADERS([ldap_ssl.h] [mps/ldap_ssl.h], [break], [], [#include <ldap.h>])
     AC_CHECK_HEADERS([ldap_ssl.h] [mps/ldap_ssl.h], [break], [], [#include <ldap.h>])

+    AC_CHECK_FUNCS(ldap_initialize ldap_start_tls_s ldapssl_init ldapssl_set_strength ldap_search_ext_s ldap_unbind_ext_s ldap_str2dn ldap_create ldap_sasl_bind_s ldap_ssl_client_init ldap_start_tls_s_np)
+
+    if test X"$check_gss_krb5_ccache_name" = X"yes"; then
+       AC_CHECK_LIB(gssapi, gss_krb5_ccache_name,
+           AC_DEFINE(HAVE_GSS_KRB5_CCACHE_NAME)
+           [LDAP_LIBS="${LDAP_LIBS} -lgssapi"],
+           AC_CHECK_LIB(gssapi_krb5, gss_krb5_ccache_name,
+               AC_DEFINE(HAVE_GSS_KRB5_CCACHE_NAME)
+               [LDAP_LIBS="${LDAP_LIBS} -lgssapi_krb5"])
+       )

 
 

-    SUDO_LIBS="${SUDO_LIBS}${LDAP_LIBS}"
+       # gssapi headers may be separate or part of Kerberos V
+       found=no
+       O_CPPFLAGS="$CPPFLAGS"
+       for dir in "" "kerberosV" "krb5" "kerberos5" "kerberosv5"; do
+           test X"$dir" != X"" && CPPFLAGS="$O_CPPFLAGS -I/usr/include/${dir}"
+           AC_PREPROC_IFELSE([#include <gssapi/gssapi.h>], [found="gssapi/gssapi.h"; break], [AC_PREPROC_IFELSE([#include <gssapi.h>], [found="gssapi.h"; break])])
+       done
+       if test X"$found" != X"no"; then
+           AC_CHECK_HEADERS([$found])
+           if test X"$found" = X"gssapi/gssapi.h"; then
+               AC_CHECK_HEADERS([gssapi/gssapi_krb5.h])
+           fi
+       else
+           CPPFLAGS="$O_CPPFLAGS"
+           AC_MSG_WARN([Unable to locate gssapi.h, you will have to edit the Makefile and add -I/path/to/gssapi/includes to CPPFLAGS])
+       fi
+    fi
+
+    SUDO_LIBS="${SUDO_LIBS} ${LDAP_LIBS}"

     LIBS="$_LIBS"
     LDFLAGS="$_LDFLAGS"
     LIBS="$_LIBS"
     LDFLAGS="$_LDFLAGS"

-    # XXX - OpenLDAP has deprecated ldap_get_values()
-    CPPFLAGS="${CPPFLAGS} -DLDAP_DEPRECATED"
+fi
+
+dnl
+dnl Add LIBVAS_RPATH to LDFLAGS
+dnl GNU ld accepts -R/path/ as an alias for -rpath /path/
+dnl
+if test X"$LIBVAS_RPATH" != X""; then
+    if test -n "$blibpath"; then
+       blibpath_add="${blibpath_add}:$LIBVAS_RPATH"
+    else
+       case "$host" in
+           *-*-hpux*)  LDFLAGS="$LDFLAGS -Wl,+b,$LIBVAS_RPATH"
+                       ;;
+           *)          LDFLAGS="$LDFLAGS -Wl,-R$LIBVAS_RPATH"
+                       ;;
+       esac
+    fi

 fi
 
 dnl
 fi
 
 dnl


@@ -2385,8 +2600,7 @@ dnl
 test "$exec_prefix" = "NONE" && exec_prefix='$(prefix)'
 
 dnl
 test "$exec_prefix" = "NONE" && exec_prefix='$(prefix)'
 
 dnl

-dnl Defer setting _PATH_SUDO_NOEXEC and _PATH_SUDO_SESH
-dnl until after exec_prefix is set
+dnl Defer setting _PATH_SUDO_NOEXEC until after exec_prefix is set

 dnl XXX - this is gross!
 dnl
 if test X"$with_noexec" != X"no" -o X"$with_selinux" != X"no"; then
 dnl XXX - this is gross!
 dnl
 if test X"$with_noexec" != X"no" -o X"$with_selinux" != X"no"; then


@@ -2415,7 +2629,7 @@ fi
 dnl
 dnl Substitute into the Makefile and man pages
 dnl
 dnl
 dnl Substitute into the Makefile and man pages
 dnl

-AC_CONFIG_FILES([Makefile sudo.man visudo.man sudoers.man])
+AC_CONFIG_FILES([Makefile sudo.man visudo.man sudoers.man sudoers.ldap.man sudo_usage.h])

 AC_OUTPUT
 
 dnl
 AC_OUTPUT
 
 dnl


@@ -2437,12 +2651,14 @@ AH_TEMPLATE(CLASSIC_INSULTS, [Define to 1 if you want the insults from the "clas
 AH_TEMPLATE(CSOPS_INSULTS, [Define to 1 if you want insults culled from the twisted minds of CSOps.])
 AH_TEMPLATE(DONT_LEAK_PATH_INFO, [Define to 1 if you want sudo to display "command not allowed" instead of "command not found" when a command cannot be found.])
 AH_TEMPLATE(ENV_EDITOR, [Define to 1 if you want visudo to honor the EDITOR and VISUAL env variables.])
 AH_TEMPLATE(CSOPS_INSULTS, [Define to 1 if you want insults culled from the twisted minds of CSOps.])
 AH_TEMPLATE(DONT_LEAK_PATH_INFO, [Define to 1 if you want sudo to display "command not allowed" instead of "command not found" when a command cannot be found.])
 AH_TEMPLATE(ENV_EDITOR, [Define to 1 if you want visudo to honor the EDITOR and VISUAL env variables.])

+AH_TEMPLATE(ENV_DEBUG, [Whether to enable environment debugging.])

 AH_TEMPLATE(FQDN, [Define to 1 if you want to require fully qualified hosts in sudoers.])
 AH_TEMPLATE(GOONS_INSULTS, [Define to 1 if you want insults from the "Goon Show".])
 AH_TEMPLATE(HAL_INSULTS, [Define to 1 if you want 2001-like insults.])
 AH_TEMPLATE(HAVE_AFS, [Define to 1 if you use AFS.])
 AH_TEMPLATE(HAVE_AIXAUTH, [Define to 1 if you use AIX general authentication.])
 AH_TEMPLATE(HAVE_BSD_AUTH_H, [Define to 1 if you use BSD authentication.])
 AH_TEMPLATE(FQDN, [Define to 1 if you want to require fully qualified hosts in sudoers.])
 AH_TEMPLATE(GOONS_INSULTS, [Define to 1 if you want insults from the "Goon Show".])
 AH_TEMPLATE(HAL_INSULTS, [Define to 1 if you want 2001-like insults.])
 AH_TEMPLATE(HAVE_AFS, [Define to 1 if you use AFS.])
 AH_TEMPLATE(HAVE_AIXAUTH, [Define to 1 if you use AIX general authentication.])
 AH_TEMPLATE(HAVE_BSD_AUTH_H, [Define to 1 if you use BSD authentication.])

+AH_TEMPLATE(HAVE_BSM_AUDIT, [Define to 1 to enable BSM auditing.])

 AH_TEMPLATE(HAVE_DCE, [Define to 1 if you use OSF DCE.])
 AH_TEMPLATE(HAVE_DD_FD, [Define to 1 if your `DIR' contains dd_fd.])
 AH_TEMPLATE(HAVE_DIRFD, [Define to 1 if you have the `dirfd' function or macro.])
 AH_TEMPLATE(HAVE_DCE, [Define to 1 if you use OSF DCE.])
 AH_TEMPLATE(HAVE_DD_FD, [Define to 1 if your `DIR' contains dd_fd.])
 AH_TEMPLATE(HAVE_DIRFD, [Define to 1 if you have the `dirfd' function or macro.])


@@ -2457,12 +2673,17 @@ AH_TEMPLATE(HAVE_GETPRPWNAM, [Define to 1 if you have the `getprpwnam' function.
 AH_TEMPLATE(HAVE_GETPWANAM, [Define to 1 if you have the `getpwanam' function. (SunOS 4.x shadow passwords)])
 AH_TEMPLATE(HAVE_GETSPNAM, [Define to 1 if you have the `getspnam' function (SVR4-style shadow passwords)])
 AH_TEMPLATE(HAVE_GETSPWUID, [Define to 1 if you have the `getspwuid' function. (HP-UX <= 9.X shadow passwords)])
 AH_TEMPLATE(HAVE_GETPWANAM, [Define to 1 if you have the `getpwanam' function. (SunOS 4.x shadow passwords)])
 AH_TEMPLATE(HAVE_GETSPNAM, [Define to 1 if you have the `getspnam' function (SVR4-style shadow passwords)])
 AH_TEMPLATE(HAVE_GETSPWUID, [Define to 1 if you have the `getspwuid' function. (HP-UX <= 9.X shadow passwords)])

+AH_TEMPLATE(HAVE_GSS_KRB5_CCACHE_NAME, [Define to 1 if you have the `gss_krb5_ccache_name' function.])

 AH_TEMPLATE(HAVE_HEIMDAL, [Define to 1 if your Kerberos is Heimdal.])
 AH_TEMPLATE(HAVE_IN6_ADDR, [Define to 1 if <netinet/in.h> contains struct in6_addr.])
 AH_TEMPLATE(HAVE_ISCOMSEC, [Define to 1 if you have the `iscomsec' function. (HP-UX >= 10.x check for shadow enabled)])
 AH_TEMPLATE(HAVE_ISSECURE, [Define to 1 if you have the `issecure' function. (SunOS 4.x check for shadow enabled)])
 AH_TEMPLATE(HAVE_KERB4, [Define to 1 if you use Kerberos IV.])
 AH_TEMPLATE(HAVE_KERB5, [Define to 1 if you use Kerberos V.])
 AH_TEMPLATE(HAVE_HEIMDAL, [Define to 1 if your Kerberos is Heimdal.])
 AH_TEMPLATE(HAVE_IN6_ADDR, [Define to 1 if <netinet/in.h> contains struct in6_addr.])
 AH_TEMPLATE(HAVE_ISCOMSEC, [Define to 1 if you have the `iscomsec' function. (HP-UX >= 10.x check for shadow enabled)])
 AH_TEMPLATE(HAVE_ISSECURE, [Define to 1 if you have the `issecure' function. (SunOS 4.x check for shadow enabled)])
 AH_TEMPLATE(HAVE_KERB4, [Define to 1 if you use Kerberos IV.])
 AH_TEMPLATE(HAVE_KERB5, [Define to 1 if you use Kerberos V.])

+AH_TEMPLATE(HAVE_KRB5_GET_INIT_CREDS_OPT_ALLOC, [Define to 1 if you have the `krb5_get_init_creds_opt_alloc' function.])
+AH_TEMPLATE(HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_TWO_ARGS, [Define to 1 if your `krb5_get_init_creds_opt_free' function takes two arguments.])
+AH_TEMPLATE(HAVE_KRB5_INIT_SECURE_CONTEXT, [Define to 1 if you have the `krb5_init_secure_context' function.])
+AH_TEMPLATE(HAVE_KRB5_VERIFY_USER, [Define to 1 if you have the `krb5_verify_user' function.])

 AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if your LDAP needs <lber.h>. (OpenLDAP does not)])
 AH_TEMPLATE(HAVE_LDAP, [Define to 1 if you use LDAP for sudoers.])
 AH_TEMPLATE(HAVE_OPIE, [Define to 1 if you use NRL OPIE.])
 AH_TEMPLATE(HAVE_LBER_H, [Define to 1 if your LDAP needs <lber.h>. (OpenLDAP does not)])
 AH_TEMPLATE(HAVE_LDAP, [Define to 1 if you use LDAP for sudoers.])
 AH_TEMPLATE(HAVE_OPIE, [Define to 1 if you use NRL OPIE.])


@@ -2470,7 +2691,6 @@ AH_TEMPLATE(HAVE_PAM, [Define to 1 if you use PAM authentication.])
 AH_TEMPLATE(HAVE_PROJECT_H, [Define to 1 if you have the <project.h> header file.])
 AH_TEMPLATE(HAVE_SECURID, [Define to 1 if you use SecurID for authentication.])
 AH_TEMPLATE(HAVE_SELINUX, [Define to 1 to enable SELinux RBAC support.])
 AH_TEMPLATE(HAVE_PROJECT_H, [Define to 1 if you have the <project.h> header file.])
 AH_TEMPLATE(HAVE_SECURID, [Define to 1 if you use SecurID for authentication.])
 AH_TEMPLATE(HAVE_SELINUX, [Define to 1 to enable SELinux RBAC support.])

-AH_TEMPLATE(HAVE_SIA, [Define to 1 if you use SIA authentication.])

 AH_TEMPLATE(HAVE_SIGACTION_T, [Define to 1 if <signal.h> has the sigaction_t typedef.])
 AH_TEMPLATE(HAVE_SKEY, [Define to 1 if you use S/Key.])
 AH_TEMPLATE(HAVE_SKEYACCESS, [Define to 1 if your S/Key library has skeyaccess().])
 AH_TEMPLATE(HAVE_SIGACTION_T, [Define to 1 if <signal.h> has the sigaction_t typedef.])
 AH_TEMPLATE(HAVE_SKEY, [Define to 1 if you use S/Key.])
 AH_TEMPLATE(HAVE_SKEYACCESS, [Define to 1 if your S/Key library has skeyaccess().])


@@ -2502,6 +2722,8 @@ AH_TEMPLATE(USE_STOW, [Define to 1 if you use GNU stow packaging.])
 AH_TEMPLATE(USE_TTY_TICKETS, [Define to 1 if you want a different ticket file for each tty.])
 AH_TEMPLATE(WITHOUT_PASSWD, [Define to avoid using the passwd/shadow file for authentication.])
 AH_TEMPLATE(sig_atomic_t, [Define to `int' if <signal.h> does not define.])
 AH_TEMPLATE(USE_TTY_TICKETS, [Define to 1 if you want a different ticket file for each tty.])
 AH_TEMPLATE(WITHOUT_PASSWD, [Define to avoid using the passwd/shadow file for authentication.])
 AH_TEMPLATE(sig_atomic_t, [Define to `int' if <signal.h> does not define.])

+AH_TEMPLATE(__signed, [Define to `signed' or nothing if compiler does not support a signed type qualifier.])
+AH_TEMPLATE(USING_NONUNIX_GROUPS, [Define to 1 if using a non-Unix group lookup implementation.])

 
 dnl
 dnl Bits to copy verbatim into config.h.in
 
 dnl
 dnl Bits to copy verbatim into config.h.in