Add adminconfdir and --enable-adminconf to set it.

Configuration paths in sudo are now a colon-separated list of files
with the adminconfdir instance first (if enabled), followed by a
sysconfdir instance.

19 files changed, 275 insertions, 64 deletions

diff --git a/INSTALL.md b/INSTALL.md
index 59dfcae7e..57efc02bc 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -110,7 +110,8 @@ Defaults are listed in brackets after the description.
         Install plugins and helper programs in DIR/sudo [PREFIX/libexec/sudo]
 
     --sysconfdir=DIR
-        Look for `sudo.conf` and `sudoers` files in DIR. [/etc]
+        Look for configuration files such as `sudo.conf` and `sudoers`
+        in DIR. [/etc]
 
     --includedir=DIR
         Install sudo_plugin.h include file in DIR [PREFIX/include]
@@ -358,6 +359,15 @@ Defaults are listed in brackets after the description.
 
 ### Optional features:
 
+    --enable-adminconf=[DIR]
+        Search for configuration files in adminconfdir (PREFIX/etc
+        by default) in preference to configuration files in sysconfdir
+        (/etc by default).  This can be used on systems where
+        sysconfdir is located on a read-only filesystem.  When this
+        option is enabled, the visudo utility will store edited
+        sudoers files in adminconfdir if the original was located
+        in sysconfdir.
+
     --disable-root-mailer
         By default sudo will run the mailer as root when tattling
         on a user so as to prevent that user from killing the mailer.
diff --git a/Makefile.in b/Makefile.in
index 0b70609cb..af5317e5c 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2010-2015, 2017-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2010-2015, 2017-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -31,6 +31,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 includedir = @includedir@
 datarootdir = @datarootdir@
diff --git a/configure b/configure
index 42b67ff44..0fb10272c 100755
--- a/configure
+++ b/configure
@@ -789,6 +789,7 @@ PYTHON_PLUGIN
 SIGNAME
 devsearch
 DIGEST
+adminconfdir
 exampledir
 TMPFILES_D
 COMPAT_EXP
@@ -1050,6 +1051,7 @@ enable_openssl_pkgconfig_template
 enable_wolfssl
 enable_gcrypt
 enable_python
+enable_adminconf
 enable_shared
 enable_static
 with_pic
@@ -1770,6 +1772,9 @@ Optional Features:
   --enable-wolfssl        Use wolfSSL's TLS and sha2 functions
   --enable-gcrypt         Use GNU crypt's sha2 functions
   --enable-python         Compile python plugin support
+  --enable-adminconf[=DIR]
+                          Use configuration files from adminconfdir in
+                          preference to sysconfdir
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
   --enable-fast-install[=PKGS]
@@ -3623,6 +3628,7 @@ PRELOAD_MODULE='-module'
 LDAP='#'
 SUDO_NLS=disabled
 exampledir='$(docdir)/examples'
+adminconfdir='$(prefix)/etc'
 PYTHON_PLUGIN='#'
 LOGSRV_SRC='lib/logsrv'
 LOGSRVD_SRC='logsrvd'
@@ -7206,6 +7212,23 @@ printf "%s\n" "$as_me: WARNING: ignoring unknown argument to --enable-python: $e
 fi
 
 
+# Check whether --enable-adminconf was given.
+if test ${enable_adminconf+y}
+then :
+  enableval=$enable_adminconf;  case "$enableval" in
+    yes|no)
+	;;
+    *)	adminconfdir="$enableval"
+	enable_adminconf=yes
+	;;
+  esac
+
+else case e in #(
+  e) enable_adminconf=no ;;
+esac
+fi
+
+
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
 ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
@@ -35597,25 +35620,87 @@ SUDO_LIBS=${SUDO_LIBS# }
 SUDOERS_LIBS=${SUDOERS_LIBS# }
 
 if test X"$prefix" = X"NONE"; then
-    test "$mandir" = '${datarootdir}/man' && mandir='$(prefix)/man'
+    test X"$mandir" = X'${datarootdir}/man' && mandir='$(prefix)/man'
 else
-    test "$mandir" = '${datarootdir}/man' && mandir='$(datarootdir)/man'
+    test X"$mandir" = X'${datarootdir}/man' && mandir='$(datarootdir)/man'
+fi
+test X"$bindir" = X'${exec_prefix}/bin' && bindir='$(exec_prefix)/bin'
+test X"$sbindir" = X'${exec_prefix}/sbin' && sbindir='$(exec_prefix)/sbin'
+test X"$libexecdir" = X'${exec_prefix}/libexec' && libexecdir='$(exec_prefix)/libexec'
+test X"$includedir" = X'${prefix}/include' && includedir='$(prefix)/include'
+test X"$datarootdir" = X'${prefix}/share' && datarootdir='$(prefix)/share'
+test X"$docdir" = X'${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
+test X"$localedir" = X'${datarootdir}/locale' && localedir='$(datarootdir)/locale'
+test X"$localstatedir" = X'${prefix}/var' && localstatedir='$(prefix)/var'
+test X"$runstatedir" = X'${localstatedir}/run' && runstatedir='$(localstatedir)/run'
+test X"$adminconfdir" = X'${prefix}/etc' && adminconfdir='$(prefix)/etc'
+test X"$sysconfdir" = X'${prefix}/etc' && sysconfdir='/etc'
+
+# The configuration file search path is to check adminconfdir first and
+# fall back to sysconfdir.  This can support systems with read-only
+# sysconfdir (/etc) that contains a set of default configuration files.
+
+    _sysconfdir="$sysconfdir"
+    while :; do
+	_sysconfdir="`echo \"$_sysconfdir\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
+	case "$_sysconfdir" in
+	*\${[A-Za-z]*}*)
+	    eval _sysconfdir="$_sysconfdir"
+	    ;;
+	*)
+	    break
+	    ;;
+    esac
+done
+case "$_sysconfdir" in
+    NONE/*)
+        _sysconfdir="${ac_default_prefix}${_sysconfdir#NONE}"
+        ;;
+esac
+
+
+    _adminconfdir="$adminconfdir"
+    while :; do
+	_adminconfdir="`echo \"$_adminconfdir\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
+	case "$_adminconfdir" in
+	*\${[A-Za-z]*}*)
+	    eval _adminconfdir="$_adminconfdir"
+	    ;;
+	*)
+	    break
+	    ;;
+    esac
+done
+case "$_adminconfdir" in
+    NONE/*)
+        _adminconfdir="${ac_default_prefix}${_adminconfdir#NONE}"
+        ;;
+esac
+
+if test $enable_adminconf = yes
+then :
+
+    # Only use adminconfdir if different from sysconfdir
+    if test X"$_sysconfdir" != X"$_adminconfdir"
+then :
+
+	cvtsudoers_conf='$(adminconfdir)/cvtsudoers.conf:'$cvtsudoers_conf
+	sudo_conf='$(adminconfdir)/sudo.conf:'$sudo_conf
+	sudo_logsrvd_conf='$(adminconfdir)/sudo_logsrvd.conf:'$sudo_logsrvd_conf
+	sudoers_path='$(adminconfdir)/sudoers:'$sudoers_path
+
+fi
+
 fi
-test "$bindir" = '${exec_prefix}/bin' && bindir='$(exec_prefix)/bin'
-test "$sbindir" = '${exec_prefix}/sbin' && sbindir='$(exec_prefix)/sbin'
-test "$libexecdir" = '${exec_prefix}/libexec' && libexecdir='$(exec_prefix)/libexec'
-test "$includedir" = '${prefix}/include' && includedir='$(prefix)/include'
-test "$datarootdir" = '${prefix}/share' && datarootdir='$(prefix)/share'
-test "$docdir" = '${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
-test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
-test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'
-test "$runstatedir" = '${localstatedir}/run' && runstatedir='$(localstatedir)/run'
-test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
 
-# Expand config file paths for use in pathnames.h
+# Expand config file paths for use in pathnames.h (after config dir override)
 
+    as_save_IFS=$IFS
+    IFS=:
+    _sudo_define_path_res=
+    for as_dir in $cvtsudoers_conf; do
 
-    _sudo_define_path_exp="$cvtsudoers_conf"
+    _sudo_define_path_exp="$as_dir"
     while :; do
 	_sudo_define_path_exp="`echo \"$_sudo_define_path_exp\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
 	case "$_sudo_define_path_exp" in
@@ -35633,14 +35718,25 @@ case "$_sudo_define_path_exp" in
         ;;
 esac
 
+	if test -z "${_sudo_define_path_res}"; then
+	    _sudo_define_path_res="${_sudo_define_path_exp}"
+	else
+	    _sudo_define_path_res="${_sudo_define_path_res}:${_sudo_define_path_exp}"
+	fi
+    done
+    IFS=$as_save_IFS
     cat >>confdefs.h <<EOF
-#define _PATH_CVTSUDOERS_CONF "$_sudo_define_path_exp"
+#define _PATH_CVTSUDOERS_CONF "${_sudo_define_path_res}"
 EOF
 
 
 
+    as_save_IFS=$IFS
+    IFS=:
+    _sudo_define_path_res=
+    for as_dir in $sudo_conf; do
 
-    _sudo_define_path_exp="$sudo_conf"
+    _sudo_define_path_exp="$as_dir"
     while :; do
 	_sudo_define_path_exp="`echo \"$_sudo_define_path_exp\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
 	case "$_sudo_define_path_exp" in
@@ -35658,14 +35754,25 @@ case "$_sudo_define_path_exp" in
         ;;
 esac
 
+	if test -z "${_sudo_define_path_res}"; then
+	    _sudo_define_path_res="${_sudo_define_path_exp}"
+	else
+	    _sudo_define_path_res="${_sudo_define_path_res}:${_sudo_define_path_exp}"
+	fi
+    done
+    IFS=$as_save_IFS
     cat >>confdefs.h <<EOF
-#define _PATH_SUDO_CONF "$_sudo_define_path_exp"
+#define _PATH_SUDO_CONF "${_sudo_define_path_res}"
 EOF
 
 
 
+    as_save_IFS=$IFS
+    IFS=:
+    _sudo_define_path_res=
+    for as_dir in $sudo_logsrvd_conf; do
 
-    _sudo_define_path_exp="$sudo_logsrvd_conf"
+    _sudo_define_path_exp="$as_dir"
     while :; do
 	_sudo_define_path_exp="`echo \"$_sudo_define_path_exp\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
 	case "$_sudo_define_path_exp" in
@@ -35683,14 +35790,25 @@ case "$_sudo_define_path_exp" in
         ;;
 esac
 
+	if test -z "${_sudo_define_path_res}"; then
+	    _sudo_define_path_res="${_sudo_define_path_exp}"
+	else
+	    _sudo_define_path_res="${_sudo_define_path_res}:${_sudo_define_path_exp}"
+	fi
+    done
+    IFS=$as_save_IFS
     cat >>confdefs.h <<EOF
-#define _PATH_SUDO_LOGSRVD_CONF "$_sudo_define_path_exp"
+#define _PATH_SUDO_LOGSRVD_CONF "${_sudo_define_path_res}"
 EOF
 
 
 
+    as_save_IFS=$IFS
+    IFS=:
+    _sudo_define_path_res=
+    for as_dir in $sudoers_path; do
 
-    _sudo_define_path_exp="$sudoers_path"
+    _sudo_define_path_exp="$as_dir"
     while :; do
 	_sudo_define_path_exp="`echo \"$_sudo_define_path_exp\" | sed -e 's/(/{/g' -e 's/)/}/g'`"
 	case "$_sudo_define_path_exp" in
@@ -35708,8 +35826,15 @@ case "$_sudo_define_path_exp" in
         ;;
 esac
 
+	if test -z "${_sudo_define_path_res}"; then
+	    _sudo_define_path_res="${_sudo_define_path_exp}"
+	else
+	    _sudo_define_path_res="${_sudo_define_path_res}:${_sudo_define_path_exp}"
+	fi
+    done
+    IFS=$as_save_IFS
     cat >>confdefs.h <<EOF
-#define _PATH_SUDOERS "$_sudo_define_path_exp"
+#define _PATH_SUDOERS "${_sudo_define_path_res}"
 EOF
 
 
@@ -37934,7 +38059,6 @@ fi
 echo "" >&6
 echo "Configured Sudo version $PACKAGE_VERSION" >&6
 echo " Compiler settings:" >&6
-echo "  prefix			: $prefix" >&6
 echo "  compiler			: $CC" >&6
 echo "  compiler options		: $CFLAGS" >&6
 echo "  preprocessor options		: $CPPFLAGS" >&6
@@ -38042,18 +38166,30 @@ echo "  mail if user not in sudoers	: ${mail_no_user}" >&6
 echo "  mail if user not on host	: ${mail_no_host}" >&6
 echo "  mail if command not allowed	: ${mail_no_perms}" >&6
 echo " Pathnames:" >&6
+echo "  prefix			: $prefix" >&6
+echo "  sysconfdir			: $_sysconfdir" >&6
+if test "${enable_adminconf-no}" != "no"; then
+    echo "  adminconfdir			: $_adminconfdir" >&6
+fi
 echo "  log directory			: ${log_dir}" >&6
+echo "  run directory			: ${rundir}" >&6
+echo "  var directory			: ${vardir}" >&6
+echo "  I/O log directory		: ${iolog_dir}" >&6
+echo "  sudo_logsrvd relay directory	: ${relay_dir}" >&6
+if test X"$with_exampledir" != X""; then
+    echo "  exampledir			: $exampledir" >&6
+fi
 echo "  plugin directory		: ${plugindir}" >&6
 echo "  sudoers plugin		: ${sudoers_plugin}" >&6
 if test "${enable_python-no}" != "no"; then
     echo "  python plugin			: ${python_plugin}" >&6
 fi
-echo "  run directory			: ${rundir}" >&6
-echo "  var directory			: ${vardir}" >&6
-echo "  I/O log directory		: ${iolog_dir}" >&6
-echo "  sudo_logsrvd relay directory	: ${relay_dir}" >&6
-echo "  time zone directory		: ${tzdir}" >&6
+echo "  sudoers file			: ${sudoers_path}" >&6
+echo "  cvtsudoers.conf file		: ${cvtsudoers_conf}" >&6
+echo "  sudo.conf file		: ${sudo_conf}" >&6
+echo "  sudo_logsrvd.conf file	: ${sudo_logsrvd_conf}" >&6
 echo "  path to sendmail		: ${with_sendmail}" >&6
+echo "  time zone directory		: ${tzdir}" >&6
 if test -n "$TMPFILES_D"; then
     echo "  systemd tempfiles dir	: ${TMPFILES_D}" >&6
 fi
diff --git a/configure.ac b/configure.ac
index d4f074275..6f91f2838 100644
--- a/configure.ac
+++ b/configure.ac
@@ -109,6 +109,7 @@ AC_SUBST([RC_LINK])dnl
 AC_SUBST([COMPAT_EXP])dnl
 AC_SUBST([TMPFILES_D])dnl
 AC_SUBST([exampledir], ['$(docdir)/examples'])dnl
+AC_SUBST([adminconfdir], ['$(prefix)/etc'])dnl
 AC_SUBST([DIGEST])dnl
 AC_SUBST([devsearch])dnl
 AC_SUBST([SIGNAME])dnl
@@ -1570,6 +1571,17 @@ AC_ARG_ENABLE(python,
   esac
 ])
 
+AC_ARG_ENABLE(adminconf,
+[AS_HELP_STRING([--enable-adminconf[[=DIR]]], [Use configuration files from adminconfdir in preference to sysconfdir])],
+[ case "$enableval" in
+    yes|no)
+	;;
+    *)	adminconfdir="$enableval"
+	enable_adminconf=yes
+	;;
+  esac
+], [enable_adminconf=no])
+
 dnl
 dnl C compiler checks
 dnl
@@ -4320,20 +4332,36 @@ dnl
 dnl Override default configure dirs for the Makefile
 dnl
 if test X"$prefix" = X"NONE"; then
-    test "$mandir" = '${datarootdir}/man' && mandir='$(prefix)/man'
+    test X"$mandir" = X'${datarootdir}/man' && mandir='$(prefix)/man'
 else
-    test "$mandir" = '${datarootdir}/man' && mandir='$(datarootdir)/man'
+    test X"$mandir" = X'${datarootdir}/man' && mandir='$(datarootdir)/man'
 fi
-test "$bindir" = '${exec_prefix}/bin' && bindir='$(exec_prefix)/bin'
-test "$sbindir" = '${exec_prefix}/sbin' && sbindir='$(exec_prefix)/sbin'
-test "$libexecdir" = '${exec_prefix}/libexec' && libexecdir='$(exec_prefix)/libexec'
-test "$includedir" = '${prefix}/include' && includedir='$(prefix)/include'
-test "$datarootdir" = '${prefix}/share' && datarootdir='$(prefix)/share'
-test "$docdir" = '${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
-test "$localedir" = '${datarootdir}/locale' && localedir='$(datarootdir)/locale'
-test "$localstatedir" = '${prefix}/var' && localstatedir='$(prefix)/var'
-test "$runstatedir" = '${localstatedir}/run' && runstatedir='$(localstatedir)/run'
-test "$sysconfdir" = '${prefix}/etc' && sysconfdir='/etc'
+test X"$bindir" = X'${exec_prefix}/bin' && bindir='$(exec_prefix)/bin'
+test X"$sbindir" = X'${exec_prefix}/sbin' && sbindir='$(exec_prefix)/sbin'
+test X"$libexecdir" = X'${exec_prefix}/libexec' && libexecdir='$(exec_prefix)/libexec'
+test X"$includedir" = X'${prefix}/include' && includedir='$(prefix)/include'
+test X"$datarootdir" = X'${prefix}/share' && datarootdir='$(prefix)/share'
+test X"$docdir" = X'${datarootdir}/doc/${PACKAGE_TARNAME}' && docdir='$(datarootdir)/doc/$(PACKAGE_TARNAME)'
+test X"$localedir" = X'${datarootdir}/locale' && localedir='$(datarootdir)/locale'
+test X"$localstatedir" = X'${prefix}/var' && localstatedir='$(prefix)/var'
+test X"$runstatedir" = X'${localstatedir}/run' && runstatedir='$(localstatedir)/run'
+test X"$adminconfdir" = X'${prefix}/etc' && adminconfdir='$(prefix)/etc'
+test X"$sysconfdir" = X'${prefix}/etc' && sysconfdir='/etc'
+
+# The configuration file search path is to check adminconfdir first and
+# fall back to sysconfdir.  This can support systems with read-only
+# sysconfdir (/etc) that contains a set of default configuration files.
+SUDO_EXPAND_PATH([$sysconfdir], [_sysconfdir])
+SUDO_EXPAND_PATH([$adminconfdir], [_adminconfdir])
+AS_IF([test $enable_adminconf = yes], [
+    # Only use adminconfdir if different from sysconfdir
+    AS_IF([test X"$_sysconfdir" != X"$_adminconfdir"], [
+	cvtsudoers_conf='$(adminconfdir)/cvtsudoers.conf:'$cvtsudoers_conf
+	sudo_conf='$(adminconfdir)/sudo.conf:'$sudo_conf
+	sudo_logsrvd_conf='$(adminconfdir)/sudo_logsrvd.conf:'$sudo_logsrvd_conf
+	sudoers_path='$(adminconfdir)/sudoers:'$sudoers_path
+    ])
+])
 
 # Expand config file paths for use in pathnames.h (after config dir override)
 SUDO_DEFINE_PATH([$cvtsudoers_conf], [_PATH_CVTSUDOERS_CONF])
@@ -4367,7 +4395,6 @@ fi
 echo "" >&AS_MESSAGE_FD
 echo "Configured Sudo version $PACKAGE_VERSION" >&AS_MESSAGE_FD
 echo " Compiler settings:" >&AS_MESSAGE_FD
-echo "  prefix			: $prefix" >&AS_MESSAGE_FD
 echo "  compiler			: $CC" >&AS_MESSAGE_FD
 echo "  compiler options		: $CFLAGS" >&AS_MESSAGE_FD
 echo "  preprocessor options		: $CPPFLAGS" >&AS_MESSAGE_FD
@@ -4475,18 +4502,30 @@ echo "  mail if user not in sudoers	: ${mail_no_user}" >&AS_MESSAGE_FD
 echo "  mail if user not on host	: ${mail_no_host}" >&AS_MESSAGE_FD
 echo "  mail if command not allowed	: ${mail_no_perms}" >&AS_MESSAGE_FD
 echo " Pathnames:" >&AS_MESSAGE_FD
+echo "  prefix			: $prefix" >&AS_MESSAGE_FD
+echo "  sysconfdir			: $_sysconfdir" >&AS_MESSAGE_FD
+if test "${enable_adminconf-no}" != "no"; then
+    echo "  adminconfdir			: $_adminconfdir" >&AS_MESSAGE_FD
+fi
 echo "  log directory			: ${log_dir}" >&AS_MESSAGE_FD
+echo "  run directory			: ${rundir}" >&AS_MESSAGE_FD
+echo "  var directory			: ${vardir}" >&AS_MESSAGE_FD
+echo "  I/O log directory		: ${iolog_dir}" >&AS_MESSAGE_FD
+echo "  sudo_logsrvd relay directory	: ${relay_dir}" >&AS_MESSAGE_FD
+if test X"$with_exampledir" != X""; then
+    echo "  exampledir			: $exampledir" >&AS_MESSAGE_FD
+fi
 echo "  plugin directory		: ${plugindir}" >&AS_MESSAGE_FD
 echo "  sudoers plugin		: ${sudoers_plugin}" >&AS_MESSAGE_FD
 if test "${enable_python-no}" != "no"; then
     echo "  python plugin			: ${python_plugin}" >&AS_MESSAGE_FD
 fi
-echo "  run directory			: ${rundir}" >&AS_MESSAGE_FD
-echo "  var directory			: ${vardir}" >&AS_MESSAGE_FD
-echo "  I/O log directory		: ${iolog_dir}" >&AS_MESSAGE_FD
-echo "  sudo_logsrvd relay directory	: ${relay_dir}" >&AS_MESSAGE_FD
-echo "  time zone directory		: ${tzdir}" >&AS_MESSAGE_FD
+echo "  sudoers file			: ${sudoers_path}" >&AS_MESSAGE_FD
+echo "  cvtsudoers.conf file		: ${cvtsudoers_conf}" >&AS_MESSAGE_FD
+echo "  sudo.conf file		: ${sudo_conf}" >&AS_MESSAGE_FD
+echo "  sudo_logsrvd.conf file	: ${sudo_logsrvd_conf}" >&AS_MESSAGE_FD
 echo "  path to sendmail		: ${with_sendmail}" >&AS_MESSAGE_FD
+echo "  time zone directory		: ${tzdir}" >&AS_MESSAGE_FD
 if test -n "$TMPFILES_D"; then
     echo "  systemd tempfiles dir	: ${TMPFILES_D}" >&AS_MESSAGE_FD
 fi
diff --git a/docs/Makefile.in b/docs/Makefile.in
index 20797af8a..d8614d69f 100644
--- a/docs/Makefile.in
+++ b/docs/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2010-2015, 2017-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2010-2015, 2017-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -47,6 +47,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/examples/Makefile.in b/examples/Makefile.in
index 706e6cce7..710b4924e 100644
--- a/examples/Makefile.in
+++ b/examples/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2014, 2017-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2014, 2017-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -40,6 +40,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/include/Makefile.in b/include/Makefile.in
index 92f05632f..da6d08d74 100644
--- a/include/Makefile.in
+++ b/include/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2015, 2017-2018 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2015, 2017-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -40,6 +40,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/lib/util/Makefile.in b/lib/util/Makefile.in
index 71aeb5f06..fa66db6ec 100644
--- a/lib/util/Makefile.in
+++ b/lib/util/Makefile.in
@@ -37,6 +37,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/lib/zlib/Makefile.in b/lib/zlib/Makefile.in
index a2c924c42..df44c2a04 100644
--- a/lib/zlib/Makefile.in
+++ b/lib/zlib/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2018 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -35,6 +35,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/logsrvd/Makefile.in b/logsrvd/Makefile.in
index 375c685b8..028e752f5 100644
--- a/logsrvd/Makefile.in
+++ b/logsrvd/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2019-2021 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2019-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -98,6 +98,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localedir = @localedir@
diff --git a/m4/sudo.m4 b/m4/sudo.m4
index 7fa1e73bd..5660b0721 100644
--- a/m4/sudo.m4
+++ b/m4/sudo.m4
@@ -2,7 +2,7 @@ dnl Local m4 macros for autoconf (used by sudo)
 dnl
 dnl SPDX-License-Identifier: ISC
 dnl
-dnl Copyright (c) 1994-1996, 1998-2005, 2007-2022
+dnl Copyright (c) 1994-1996, 1998-2005, 2007-2023
 dnl	Todd C. Miller <Todd.Miller@sudo.ws>
 dnl
 dnl Permission to use, copy, modify, and distribute this software for any
@@ -705,10 +705,21 @@ esac
 ])
 
 dnl
-dnl Expand Makefile-style variables in $1 and define as the string $2.
-dnl Used to define file paths in pathnames.h.
+dnl Expand Makefile-style variables in $1, a colon-separated list of paths,
+dnl and define the result as a string using the name $2.
 dnl
 AC_DEFUN([SUDO_DEFINE_PATH], [
-    SUDO_EXPAND_PATH([$1], [_sudo_define_path_exp])
-    SUDO_DEFINE_UNQUOTED($2, "$_sudo_define_path_exp")
+    as_save_IFS=$IFS
+    IFS=:
+    _sudo_define_path_res=
+    for as_dir in $1; do
+	SUDO_EXPAND_PATH([$as_dir], [_sudo_define_path_exp])
+	if test -z "${_sudo_define_path_res}"; then
+	    _sudo_define_path_res="${_sudo_define_path_exp}"
+	else
+	    _sudo_define_path_res="${_sudo_define_path_res}:${_sudo_define_path_exp}"
+	fi
+    done
+    IFS=$as_save_IFS
+    SUDO_DEFINE_UNQUOTED($2, "${_sudo_define_path_res}")
 ])
diff --git a/plugins/audit_json/Makefile.in b/plugins/audit_json/Makefile.in
index 199a60d97..e885a3959 100644
--- a/plugins/audit_json/Makefile.in
+++ b/plugins/audit_json/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2020 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2020-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -86,6 +86,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/plugins/group_file/Makefile.in b/plugins/group_file/Makefile.in
index e387e4db4..3223292bd 100644
--- a/plugins/group_file/Makefile.in
+++ b/plugins/group_file/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2010-2018 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2010-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -88,6 +88,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/plugins/python/Makefile.in b/plugins/python/Makefile.in
index e79f57061..818f37c87 100644
--- a/plugins/python/Makefile.in
+++ b/plugins/python/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2019-2020 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2019-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -93,6 +93,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/plugins/sample/Makefile.in b/plugins/sample/Makefile.in
index e0a814c3e..a20cdd476 100644
--- a/plugins/sample/Makefile.in
+++ b/plugins/sample/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -87,6 +87,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/plugins/sample_approval/Makefile.in b/plugins/sample_approval/Makefile.in
index fb3b435cd..3ffe46541 100644
--- a/plugins/sample_approval/Makefile.in
+++ b/plugins/sample_approval/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2020 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2020-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -86,6 +86,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/plugins/sudoers/Makefile.in b/plugins/sudoers/Makefile.in
index 35788154f..6d2bb8fbb 100644
--- a/plugins/sudoers/Makefile.in
+++ b/plugins/sudoers/Makefile.in
@@ -120,6 +120,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localedir = @localedir@
diff --git a/plugins/system_group/Makefile.in b/plugins/system_group/Makefile.in
index da93c1dfa..9bdebde05 100644
--- a/plugins/system_group/Makefile.in
+++ b/plugins/system_group/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2011-2018 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2011-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -88,6 +88,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
diff --git a/src/Makefile.in b/src/Makefile.in
index 1d7dc5d67..99e735212 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -1,7 +1,7 @@
 #
 # SPDX-License-Identifier: ISC
 #
-# Copyright (c) 2010-2022 Todd C. Miller <Todd.Miller@sudo.ws>
+# Copyright (c) 2010-2023 Todd C. Miller <Todd.Miller@sudo.ws>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -102,6 +102,7 @@ exec_prefix = @exec_prefix@
 bindir = @bindir@
 sbindir = @sbindir@
 sysconfdir = @sysconfdir@
+adminconfdir = @adminconfdir@
 libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localedir = @localedir@