Merge sudo 1.9.13p1 from tip.SUDO_1_9_13p1

12 files changed, 97 insertions, 47 deletions

diff --git a/NEWS b/NEWS
index 6390fcd46..f5c7eb06c 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,22 @@
+What's new in Sudo 1.9.13p1
+
+ * Fixed a typo in the configure script that resulted in a line
+   like "]: command not found" in the output.  GitHub issue #238.
+
+ * Corrected the order of the C23 [[noreturn]] attribute in function
+   prototypes.  This fixes a build error with GCC 13.  GitHub issue
+   #239.
+
+ * The "check" make target misbehaved when there was more than
+   one version of the UTF-8 C locale in the output of "locale -a".
+   GitHub issue #241.
+
+ * Removed a dependency on the AC_SYS_YEAR2038 macro in configure.ac.
+   This was added in autoconf 2.72 but sudo's configure.ac only
+   required autoconf 2.70.
+
+ * Relaxed the autoconf version requirement to version 2.69.
+
 What's new in Sudo 1.9.13
 
  * Fixed a bug running relative commands via sudo when "log_subcmds"
diff --git a/configure b/configure
index c7c643bec..87995fca3 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.72a for sudo 1.9.13.
+# Generated by GNU Autoconf 2.72a for sudo 1.9.13p1.
 #
 # Report bugs to <https://bugzilla.sudo.ws/>.
 #
@@ -614,8 +614,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='sudo'
 PACKAGE_TARNAME='sudo'
-PACKAGE_VERSION='1.9.13'
-PACKAGE_STRING='sudo 1.9.13'
+PACKAGE_VERSION='1.9.13p1'
+PACKAGE_STRING='sudo 1.9.13p1'
 PACKAGE_BUGREPORT='https://bugzilla.sudo.ws/'
 PACKAGE_URL=''
 
@@ -1636,7 +1636,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-'configure' configures sudo 1.9.13 to adapt to many kinds of systems.
+'configure' configures sudo 1.9.13p1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1702,7 +1702,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sudo 1.9.13:";;
+     short | recursive ) echo "Configuration of sudo 1.9.13p1:";;
    esac
   cat <<\_ACEOF
 
@@ -1993,7 +1993,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sudo configure 1.9.13
+sudo configure 1.9.13p1
 generated by GNU Autoconf 2.72a
 
 Copyright (C) 2023 Free Software Foundation, Inc.
@@ -2671,7 +2671,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sudo $as_me 1.9.13, which was
+It was created by sudo $as_me 1.9.13p1, which was
 generated by GNU Autoconf 2.72a.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -18851,6 +18851,7 @@ then :
 
 fi
 
+
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5
 printf %s "checking for an ANSI C-conforming const... " >&6; }
 if test ${ac_cv_c_const+y}
@@ -22264,7 +22265,8 @@ fi
 
 else case e in #(
   e)
-																					     ;;
+																						:
+	     ;;
 esac
 fi
 
@@ -24525,7 +24527,8 @@ fi
 
 if test X"$with_noexec" != X"no"
 then :
-  # Check for non-standard exec functions
+
+    # Check for non-standard exec functions
     ac_fn_c_check_func "$LINENO" "exect" "ac_cv_func_exect"
 if test "x$ac_cv_func_exect" = xyes
 then :
@@ -24564,7 +24567,7 @@ fi
 
 
 fi
-]
+
 fi
 
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
@@ -36024,7 +36027,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sudo $as_me 1.9.13, which was
+This file was extended by sudo $as_me 1.9.13p1, which was
 generated by GNU Autoconf 2.72a.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -36092,7 +36095,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-sudo config.status 1.9.13
+sudo config.status 1.9.13p1
 configured by $0, generated by GNU Autoconf 2.72a,
   with options \\"\$ac_cs_config\\"
 
diff --git a/configure.ac b/configure.ac
index 174c5775d..8d510370c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -17,8 +17,8 @@ dnl WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 dnl ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 dnl OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 dnl
-AC_PREREQ([2.70])
-AC_INIT([sudo], [1.9.13], [https://bugzilla.sudo.ws/], [sudo])
+AC_PREREQ([2.69])
+AC_INIT([sudo], [1.9.13p1], [https://bugzilla.sudo.ws/], [sudo])
 AC_CONFIG_HEADERS([config.h pathnames.h])
 AC_CONFIG_SRCDIR([src/sudo.c])
 AC_CONFIG_AUX_DIR([scripts])
@@ -2383,7 +2383,9 @@ AS_IF([test -n "$with_libraries"], [
 
 dnl
 dnl C compiler checks (to be done after os checks)
+dnl AC_PROG_CC_STDC is deprecated in autoconf 2.70 and above.
 dnl
+m4_bmatch(m4_defn([AC_AUTOCONF_VERSION]), [^2\.69], [AC_PROG_CC_STDC])
 AC_C_CONST
 AC_C_INLINE
 AC_C_VOLATILE
@@ -2439,7 +2441,17 @@ break)
 # Check for large file and 64-bit time support.
 #
 AC_SYS_LARGEFILE
-AC_SYS_YEAR2038
+m4_ifdef([AC_SYS_YEAR2038], [AC_SYS_YEAR2038], [
+    # GNU libc only allows setting _TIME_BITS when FILE_OFFSET_BITS is also set.    # GNU libc defines __TIMESIZE on systems where _TIME_BITS can be set.
+    AS_IF([test X"$ac_cv_sys_file_offset_bits" = X"yes"], [
+	AC_CHECK_DECL(__TIMESIZE, [
+	    AC_DEFINE([_TIME_BITS], [64], [Number of bits in a timestamp, on hosts where this is settable.])
+	], [], [
+AC_INCLUDES_DEFAULT
+#include <time.h>
+	])
+    ])
+])
 
 #
 # Don't allow undefined symbols, even in shared libraries, if possible.
@@ -2666,6 +2678,7 @@ AC_CHECK_FUNCS([getgrouplist], [], [
 		dnl	AC_DEFINE([HAVE___NSS_INITF_GROUP])
 		dnl    ])
 		dnl])
+		:
 	    ])
 	])
 	;;
@@ -3022,7 +3035,7 @@ AC_CHECK_FUNCS([setpassent setgroupent])
 dnl
 dnl Function checks for sudo_noexec
 dnl
-AS_IF([test X"$with_noexec" != X"no"],
+AS_IF([test X"$with_noexec" != X"no"], [
     # Check for non-standard exec functions
     AC_CHECK_FUNCS([exect execvP execvpe])
     # Check for posix_spawn, and posix_spawnp
diff --git a/include/sudo_fatal.h b/include/sudo_fatal.h
index 871bfc81c..0819e634b 100644
--- a/include/sudo_fatal.h
+++ b/include/sudo_fatal.h
@@ -171,12 +171,12 @@ sudo_dso_public int  sudo_fatal_callback_deregister_v1(sudo_fatal_callback_t fun
 sudo_dso_public int  sudo_fatal_callback_register_v1(sudo_fatal_callback_t func);
 sudo_dso_public char *sudo_warn_gettext_v1(const char *domainname, const char *msgid) sudo_attr_fmt_arg(2);
 sudo_dso_public void sudo_warn_set_locale_func_v1(sudo_warn_setlocale_t func);
-sudo_dso_public sudo_noreturn void sudo_fatal_nodebug_v1(const char *fmt, ...) sudo_printf0like(1, 2);
-sudo_dso_public sudo_noreturn void sudo_fatalx_nodebug_v1(const char *fmt, ...) sudo_printflike(1, 2);
-sudo_dso_public sudo_noreturn void sudo_gai_fatal_nodebug_v1(int errnum, const char *fmt, ...) sudo_printflike(2, 3);
-sudo_dso_public sudo_noreturn void sudo_vfatal_nodebug_v1(const char *fmt, va_list ap) sudo_printf0like(1, 0);
-sudo_dso_public sudo_noreturn void sudo_vfatalx_nodebug_v1(const char *fmt, va_list ap) sudo_printflike(1, 0);
-sudo_dso_public sudo_noreturn void sudo_gai_vfatal_nodebug_v1(int errnum, const char *fmt, va_list ap) sudo_printflike(2, 0);
+sudo_noreturn sudo_dso_public void sudo_fatal_nodebug_v1(const char *fmt, ...) sudo_printf0like(1, 2);
+sudo_noreturn sudo_dso_public void sudo_fatalx_nodebug_v1(const char *fmt, ...) sudo_printflike(1, 2);
+sudo_noreturn sudo_dso_public void sudo_gai_fatal_nodebug_v1(int errnum, const char *fmt, ...) sudo_printflike(2, 3);
+sudo_noreturn sudo_dso_public void sudo_vfatal_nodebug_v1(const char *fmt, va_list ap) sudo_printf0like(1, 0);
+sudo_noreturn sudo_dso_public void sudo_vfatalx_nodebug_v1(const char *fmt, va_list ap) sudo_printflike(1, 0);
+sudo_noreturn sudo_dso_public void sudo_gai_vfatal_nodebug_v1(int errnum, const char *fmt, va_list ap) sudo_printflike(2, 0);
 sudo_dso_public void sudo_warn_nodebug_v1(const char *fmt, ...) sudo_printf0like(1, 2);
 sudo_dso_public void sudo_warnx_nodebug_v1(const char *fmt, ...) sudo_printflike(1, 2);
 sudo_dso_public void sudo_gai_warn_nodebug_v1(int errnum, const char *fmt, ...) sudo_printflike(2, 3);
diff --git a/lib/eventlog/Makefile.in b/lib/eventlog/Makefile.in
index 190470a82..cd713c483 100644
--- a/lib/eventlog/Makefile.in
+++ b/lib/eventlog/Makefile.in
@@ -152,7 +152,7 @@ check-fuzzer:
 
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
diff --git a/lib/iolog/Makefile.in b/lib/iolog/Makefile.in
index 4e1f3a4bc..61bc05815 100644
--- a/lib/iolog/Makefile.in
+++ b/lib/iolog/Makefile.in
@@ -200,7 +200,7 @@ fuzz_iolog_json_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_iolog_json: fuzz_iolog_json
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -225,7 +225,7 @@ fuzz_iolog_legacy_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_iolog_legacy: fuzz_iolog_legacy
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -250,7 +250,7 @@ fuzz_iolog_timing_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_iolog_timing: fuzz_iolog_timing
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -302,7 +302,7 @@ fuzz: run-fuzz_iolog_json run-fuzz_iolog_legacy run-fuzz_iolog_timing
 
 check-fuzzer: $(FUZZ_PROGS)
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -319,7 +319,7 @@ check-fuzzer: $(FUZZ_PROGS)
 
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
diff --git a/lib/util/Makefile.in b/lib/util/Makefile.in
index 45d0eedff..7898eecea 100644
--- a/lib/util/Makefile.in
+++ b/lib/util/Makefile.in
@@ -360,7 +360,7 @@ fuzz_sudo_conf_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_sudo_conf: fuzz_sudo_conf
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -424,7 +424,7 @@ fuzz: run-fuzz_sudo_conf
 
 check-fuzzer: $(FUZZ_PROGS)
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -438,7 +438,7 @@ check-fuzzer: $(FUZZ_PROGS)
 # Note: some regress checks are run from srcdir for consistent error messages
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -506,8 +506,9 @@ clean:
 mostlyclean: clean
 
 distclean: clean
-	-rm -rf Makefile mksiglist mksiglist.h siglist.c mksigname \
-	    mksigname.h signame.c .libs $(shlib_exp) $(shlib_map) $(shlib_opt)
+	-rm -rf Makefile mksiglist mksiglist.h siglist.c \
+	    mksigname mksigname.h signame.c regress/harness \
+	    .libs $(shlib_exp) $(shlib_map) $(shlib_opt)
 
 clobber: distclean
 
diff --git a/logsrvd/Makefile.in b/logsrvd/Makefile.in
index edd35bc37..2a1f0d1a5 100644
--- a/logsrvd/Makefile.in
+++ b/logsrvd/Makefile.in
@@ -195,7 +195,7 @@ fuzz_logsrvd_conf_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_logsrvd_conf: fuzz_logsrvd_conf
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -256,7 +256,7 @@ fuzz: run-fuzz_logsrvd_conf
 
 check-fuzzer: $(FUZZ_PROGS)
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -269,7 +269,7 @@ check-fuzzer: $(FUZZ_PROGS)
 
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -291,7 +291,7 @@ check-verbose: check
 
 clean:
 	-$(LIBTOOL) $(LTFLAGS) --mode=clean rm -f $(PROGS) $(FUZZ_PROGS) \
-	    *.lo *.o *.la
+	    $(TEST_PROGS) *.lo *.o *.la
 	-rm -f *.i *.plog stamp-* core *.core core.*
 	-rm -rf regress/corpus/logsrvd_conf
 
diff --git a/plugins/python/Makefile.in b/plugins/python/Makefile.in
index 4cac26c72..e79f57061 100644
--- a/plugins/python/Makefile.in
+++ b/plugins/python/Makefile.in
@@ -229,7 +229,7 @@ check-fuzzer:
 
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
diff --git a/plugins/sudoers/Makefile.in b/plugins/sudoers/Makefile.in
index 2786d1ccd..3dcc746f2 100644
--- a/plugins/sudoers/Makefile.in
+++ b/plugins/sudoers/Makefile.in
@@ -423,7 +423,7 @@ fuzz_policy_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_policy: fuzz_policy
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -448,7 +448,7 @@ fuzz_sudoers_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_sudoers: fuzz_sudoers
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -473,7 +473,7 @@ fuzz_sudoers_ldif_seed_corpus.zip:
 	rm -rf $$tdir
 
 run-fuzz_sudoers_ldif: fuzz_sudoers_ldif
-	l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	test -n "$$l" || l="C"; \
 	LC_ALL="$$l"; export LC_ALL; \
 	unset LANG || LANG=; \
@@ -621,7 +621,7 @@ fuzz: run-fuzz_policy run-fuzz_sudoers run-fuzz_sudoers_ldif
 
 check-fuzzer: $(FUZZ_PROGS)
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -638,7 +638,7 @@ check-fuzzer: $(FUZZ_PROGS)
 
 check: $(TEST_PROGS) visudo testsudoers cvtsudoers check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -689,7 +689,8 @@ clean:
 mostlyclean: clean
 
 distclean: clean
-	-rm -rf Makefile sudoers sudoers.lo .libs $(shlib_map) $(shlib_opt)
+	-rm -rf Makefile sudoers sudoers.lo regress/harness \
+	    .libs $(shlib_map) $(shlib_opt)
 	@if [ -n "$(DEVEL)" -a "$(devdir)" != "$(srcdir)" ]; then \
 	    cmd='rm -rf $(GENERATED)'; \
 	    echo "$$cmd"; eval $$cmd; \
diff --git a/scripts/mkpkg b/scripts/mkpkg
index dd4f4492f..4a63585f0 100755
--- a/scripts/mkpkg
+++ b/scripts/mkpkg
@@ -277,6 +277,12 @@ case "$osversion" in
 	make_opts="${make_opts}${make_opts+ }"'docdir=$(datarootdir)/doc/packages/$(PACKAGE_TARNAME)'
 	;;
     deb*|ubu*)
+	# Sudo-specific executables moved to /usr/libexec/sudo starting in
+	# Debian: Debian 12 (Bookworm)
+	# Ubuntu: Ubuntu 22.04 (Jammy Jellyfish)
+	# Previously, they were stored in /usr/lib/sudo.
+	libexec=lib
+
 	# AppArmor is enabled by default starting in
 	# Debian: Debian 10 (Buster)
 	# Ubuntu: Ubuntu 12.04 (Precise Pangolin)
@@ -286,11 +292,17 @@ case "$osversion" in
 		if [ -z $osmajor ] || [ $osmajor -ge 10 ]; then
 		    with_apparmor=true
 		fi
+		if [ -z $osmajor ] || [ $osmajor -ge 12 ]; then
+		    libexec=libexec
+		fi
 		;;
 	    ubu*)
 		if [ -z $osmajor ] || [ $osmajor -ge 14 ]; then
 		    with_apparmor=true
 		fi
+		if [ -z $osmajor ] || [ $osmajor -ge 22 ]; then
+		    libexec=libexec
+		fi
 		;;
 	esac
 
@@ -338,7 +350,7 @@ case "$osversion" in
 		--disable-root-mailer
 		--with-sendmail=/usr/sbin/sendmail
 		--mandir=/usr/share/man
-		--libexecdir=/usr/lib
+		--libexecdir=/usr/$libexec
 		--with-linux-audit
 		$configure_opts"
 	# Use correct libaudit dependency
diff --git a/src/Makefile.in b/src/Makefile.in
index 6a947da68..d9fa3a693 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -332,7 +332,7 @@ check-fuzzer:
 
 check: $(TEST_PROGS) check-fuzzer
 	@if test X"$(cross_compiling)" != X"yes"; then \
-	    l=`locale -a 2>&1 | $(EGREP) -i '^C.UTF-?8$$'` || true; \
+	    l=`locale -a 2>&1 | $(EGREP) -i '^C\.UTF-?8$$' | $(SED) 1q` || true; \
 	    test -n "$$l" || l="C"; \
 	    LC_ALL="$$l"; export LC_ALL; \
 	    unset LANG || LANG=; \
@@ -357,7 +357,8 @@ clean:
 mostlyclean: clean
 
 distclean: clean
-	-rm -rf Makefile .libs $(shlib_map) $(shlib_opt) sudo_usage.h
+	-rm -rf Makefile intercept.exp sudo_usage.h \
+	    .libs $(shlib_map) $(shlib_opt)
 	@if [ -n "$(DEVEL)" -a "$(devdir)" != "$(srcdir)" ]; then \
 	    cmd='rm -rf $(GENERATED)'; \
 	    echo "$$cmd"; eval $$cmd; \