diff --git a/MANIFEST b/MANIFEST
index aa1cf59b5f..c61624cb8f 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -163,6 +163,7 @@ lib/util/sudo_dso.c
 lib/util/sudo_printf.c
 lib/util/term.c
 lib/util/ttysize.c
+lib/util/util.exp
 lib/util/utimes.c
 lib/zlib/Makefile.in
 lib/zlib/adler32.c
diff --git a/Makefile.in b/Makefile.in
index 78b0ab5511..f1ff214632 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -59,7 +59,10 @@ LIBTOOL_DEPS = @LIBTOOL_DEPS@
 
 SHELL = @SHELL@
 
+SED = @SED@
+
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 ECHO_N = @ECHO_N@
 ECHO_C = @ECHO_C@
@@ -104,19 +107,19 @@ cppcheck: config.status
 
 install-dirs install-binaries install-includes install-plugin: config.status pre-install
 	for d in $(SUBDIRS); do \
-	    (cd $$d && exec $(MAKE) $@) && continue; \
+	    (cd $$d && exec $(MAKE) "INSTALL_OWNER=$(INSTALL_OWNER)" $@) && continue; \
 	    exit $$?; \
 	done
 
 install-doc: config.status ChangeLog
 	for d in $(SUBDIRS); do \
-	    (cd $$d && exec $(MAKE) $@) && continue; \
+	    (cd $$d && exec $(MAKE) "INSTALL_OWNER=$(INSTALL_OWNER)" $@) && continue; \
 	    exit $$?; \
 	done
 
 install: config.status ChangeLog pre-install install-nls
 	for d in $(SUBDIRS); do \
-	    (cd $$d && exec $(MAKE) $@) && continue; \
+	    (cd $$d && exec $(MAKE) "INSTALL_OWNER=$(INSTALL_OWNER)" $@) && continue; \
 	    exit $$?; \
 	done
 
@@ -190,7 +193,7 @@ update-pot:
 		    sudo) tmpfiles=; cfiles="src/*c lib/*/*c";; \
 		    sudoers) \
 			echo "syntax error" > confstr.sh; \
-			sed -n -e 's/^badpass_message="/gettext "/p' \
+			$(SED) -n -e 's/^badpass_message="/gettext "/p' \
 			    -e 's/^passprompt="/gettext "/p' \
 			    -e 's/^mailsub="/gettext "/p' configure.ac \
 			    >> confstr.sh; \
@@ -204,7 +207,7 @@ update-pot:
 		    rm -f $$pot.tmp; \
 		else \
 		    printf '/^#$$/+1,$$d\nw\nq\n' | ed - $$pot; \
-		    sed '1,/^#$$/d' $$pot.tmp >> $$pot; \
+		    $(SED) '1,/^#$$/d' $$pot.tmp >> $$pot; \
 		    rm -f $$pot.tmp; \
 		fi; \
 	    done; \
@@ -234,14 +237,14 @@ compile-po:
 		    POFILES="$$POFILES $$po"; \
 		done; \
 	    done; \
-	    echo "all: `echo $$POFILES | sed 's/\.po/.mo/g'`" >> Makefile.$$$$; \
+	    echo "all: `echo $$POFILES | $(SED) 's/\.po/.mo/g'`" >> Makefile.$$$$; \
 	    echo "" >> Makefile.$$$$; \
 	    for po in $$POFILES; do \
-		mo=`echo $$po | sed 's/po$$/mo/'`; \
+		mo=`echo $$po | $(SED) 's/po$$/mo/'`; \
 		echo "$$mo: $$po" >> Makefile.$$$$; \
 		echo "	$(MSGFMT) --statistics -c -o $$mo $$po" >> Makefile.$$$$; \
 	    done; \
-	    make -f Makefile.$$$$; \
+	    $(MAKE) -f Makefile.$$$$; \
 	    rm -f Makefile.$$$$; \
 	fi
 
@@ -251,7 +254,7 @@ install-nls:
 	    for pot in $(POTFILES); do \
 		podir=`dirname $$pot`; \
 		domain=`basename $$pot .pot`; \
-		SUDO_LINGUAS=$${LINGUAS-"`echo $$podir/*.mo|sed 's:'$$podir'/\([^ ]*\).mo:\1:g'`"}; \
+		SUDO_LINGUAS=$${LINGUAS-"`echo $$podir/*.mo | $(SED) 's:'$$podir'/\([^ ]*\).mo:\1:g'`"}; \
 		echo $(ECHO_N) "Installing $$domain message catalogs:$(ECHO_C)"; \
 		for lang in $$SUDO_LINGUAS; do \
 		    test -s $$podir/$$lang.mo || continue; \
@@ -282,13 +285,13 @@ dist: check-dist force-dist
 force-dist: ChangeLog $(srcdir)/MANIFEST
 	pax -w -x ustar -s '/^/$(PACKAGE_TARNAME)-$(VERSION)\//' \
 	    -f ../$(PACKAGE_TARNAME)-$(VERSION).tar \
-	    `sed 's/[ 	].*//' $(srcdir)/MANIFEST`
+	    `$(SED) 's/[ 	].*//' $(srcdir)/MANIFEST`
 	gzip -9f ../$(PACKAGE_TARNAME)-$(VERSION).tar
 	ls -l ../$(PACKAGE_TARNAME)-$(VERSION).tar.gz
 
 package: sudo.pp
 	DESTDIR=`cd $(top_builddir) && pwd`/destdir; rm -rf $$DESTDIR; \
-	$(MAKE) install DESTDIR=$$DESTDIR && \
+	$(MAKE) install INSTALL_OWNER= DESTDIR=$$DESTDIR && \
 	$(SHELL) $(srcdir)/pp $(PPFLAGS) \
 	    --destdir=$$DESTDIR \
 	    $(srcdir)/sudo.pp \
diff --git a/doc/Makefile.in b/doc/Makefile.in
index 1372a3439a..6affc03535 100644
--- a/doc/Makefile.in
+++ b/doc/Makefile.in
@@ -34,6 +34,7 @@ TR = @TRPROG@
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Where to install things...
 prefix = @prefix@
@@ -305,15 +306,15 @@ install-binaries:
 install-includes:
 
 install-doc: install-dirs
-	for f in $(OTHER_DOCS); do $(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $$f $(DESTDIR)$(docdir); done
-	@LDAP@for f in $(OTHER_DOCS_LDAP); do $(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $$f $(DESTDIR)$(docdir); done
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudo.$(mantype) $(DESTDIR)$(mandirsu)/sudo.$(mansectsu)
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudo_plugin.$(mantype) $(DESTDIR)$(mandirsu)/sudo_plugin.$(mansectsu)
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudoreplay.$(mantype) $(DESTDIR)$(mandirsu)/sudoreplay.$(mansectsu)
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/visudo.$(mantype) $(DESTDIR)$(mandirsu)/visudo.$(mansectsu)
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudo.conf.$(mantype) $(DESTDIR)$(mandirform)/sudo.conf.$(mansectform)
-	$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudoers.$(mantype) $(DESTDIR)$(mandirform)/sudoers.$(mansectform)
-	@LDAP@$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0644 $(mansrcdir)/sudoers.ldap.$(mantype) $(DESTDIR)$(mandirform)/sudoers.ldap.$(mansectform)
+	for f in $(OTHER_DOCS); do $(INSTALL) $(INSTALL_OWNER) -m 0644 $$f $(DESTDIR)$(docdir); done
+	@LDAP@for f in $(OTHER_DOCS_LDAP); do $(INSTALL) $(INSTALL_OWNER) -m 0644 $$f $(DESTDIR)$(docdir); done
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudo.$(mantype) $(DESTDIR)$(mandirsu)/sudo.$(mansectsu)
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudo_plugin.$(mantype) $(DESTDIR)$(mandirsu)/sudo_plugin.$(mansectsu)
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudoreplay.$(mantype) $(DESTDIR)$(mandirsu)/sudoreplay.$(mansectsu)
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/visudo.$(mantype) $(DESTDIR)$(mandirsu)/visudo.$(mansectsu)
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudo.conf.$(mantype) $(DESTDIR)$(mandirform)/sudo.conf.$(mansectform)
+	$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudoers.$(mantype) $(DESTDIR)$(mandirform)/sudoers.$(mansectform)
+	@LDAP@$(INSTALL) $(INSTALL_OWNER) -m 0644 $(mansrcdir)/sudoers.ldap.$(mantype) $(DESTDIR)$(mandirform)/sudoers.ldap.$(mansectform)
 	@if test -n "$(MANCOMPRESS)"; then \
 	    for f in $(mandirsu)/sudo.$(mansectsu) $(mandirsu)/sudo_plugin.$(mansectsu) $(mandirsu)/sudoreplay.$(mansectsu) $(mandirsu)/visudo.$(mansectsu) $(mandirform)/sudo.conf.$(mansectform) $(mandirform)/sudoers.$(mansectform) $(mandirform)/sudoers.ldap.$(mansectform); do \
 		if test -f $(DESTDIR)$$f; then \
diff --git a/include/alloc.h b/include/alloc.h
index f7c566c7c9..f40518787a 100644
--- a/include/alloc.h
+++ b/include/alloc.h
@@ -23,15 +23,15 @@
 #undef efree
 #define efree(x)	free((void *)(x))
 
-int	 easprintf(char **, const char *, ...) __printflike(2, 3);
-int	 evasprintf(char **, const char *, va_list) __printflike(2, 0);
-void	*ecalloc(size_t, size_t) __malloc_like;
-void	*emalloc(size_t) __malloc_like;
-void	*emallocarray(size_t, size_t) __malloc_like;
-void	*erealloc(void *, size_t);
-void	*ereallocarray(void *, size_t, size_t);
-void	*erecalloc(void *, size_t, size_t, size_t);
-char	*estrdup(const char *) __malloc_like;
-char	*estrndup(const char *, size_t) __malloc_like;
+__dso_public int  easprintf(char **, const char *, ...) __printflike(2, 3);
+__dso_public int  evasprintf(char **, const char *, va_list) __printflike(2, 0);
+__dso_public void *ecalloc(size_t, size_t) __malloc_like;
+__dso_public void *emalloc(size_t) __malloc_like;
+__dso_public void *emallocarray(size_t, size_t) __malloc_like;
+__dso_public void *erealloc(void *, size_t);
+__dso_public void *ereallocarray(void *, size_t, size_t);
+__dso_public void *erecalloc(void *, size_t, size_t, size_t);
+__dso_public char *estrdup(const char *) __malloc_like;
+__dso_public char *estrndup(const char *, size_t) __malloc_like;
 
 #endif /* _SUDO_ALLOC_H */
diff --git a/include/compat/fnmatch.h b/include/compat/fnmatch.h
index a6fb6024c9..b4c418eac3 100644
--- a/include/compat/fnmatch.h
+++ b/include/compat/fnmatch.h
@@ -25,7 +25,7 @@
 #define	FNM_LEADING_DIR	(1 << 3)	/* Only match the leading directory */
 #define	FNM_CASEFOLD	(1 << 4)	/* Case insensitive matching */
 
-int sudo_fnmatch(const char *pattern, const char *string, int flags);
+__dso_public int sudo_fnmatch(const char *pattern, const char *string, int flags);
 
 #define fnmatch(_a, _b, _c)	sudo_fnmatch((_a), (_b), (_c))
 
diff --git a/include/compat/getaddrinfo.h b/include/compat/getaddrinfo.h
index 52031480d3..536d2acb78 100644
--- a/include/compat/getaddrinfo.h
+++ b/include/compat/getaddrinfo.h
@@ -66,10 +66,10 @@ struct addrinfo {
 #define EAI_OVERFLOW    10      /* An argument buffer overflowed */
 
 /* Function prototypes. */
-int sudo_getaddrinfo(const char *nodename, const char *servname,
+__dso_public int sudo_getaddrinfo(const char *nodename, const char *servname,
                 const struct addrinfo *hints, struct addrinfo **res);
-void sudo_freeaddrinfo(struct addrinfo *ai);
-const char *sudo_gai_strerror(int ecode);
+__dso_public void sudo_freeaddrinfo(struct addrinfo *ai);
+__dso_public const char *sudo_gai_strerror(int ecode);
 
 /* Map sudo_* to RFC 3493 names. */
 #undef getaddrinfo
diff --git a/include/compat/getopt.h b/include/compat/getopt.h
index 20972b9eeb..9f51d3c3e6 100644
--- a/include/compat/getopt.h
+++ b/include/compat/getopt.h
@@ -55,19 +55,19 @@ struct option {
 	int val;
 };
 
-int	sudo_getopt_long(int, char * const *, const char *,
+__dso_public int sudo_getopt_long(int, char * const *, const char *,
 	    const struct option *, int *);
 #undef getopt_long
 #define getopt_long(_a, _b, _c, _d, _e) \
 	sudo_getopt_long((_a), (_b), (_c), (_d), (_e))
 
-int	sudo_getopt_long_only(int, char * const *, const char *,
+__dso_public int sudo_getopt_long_only(int, char * const *, const char *,
 	    const struct option *, int *);
 #undef getopt_long_only
 #define getopt_long_only(_a, _b, _c, _d, _e) \
 	sudo_getopt_long_only((_a), (_b), (_c), (_d), (_e))
 #if 0
-int	sudo_getopt(int, char * const [], const char *);
+__dso_public int sudo_getopt(int, char * const [], const char *);
 #undef getopt
 #define getopt(_a, _b, _c)	sudo_getopt((_a), (_b), (_c))
 #endif
diff --git a/include/compat/glob.h b/include/compat/glob.h
index 97e48c0531..6e7df71423 100644
--- a/include/compat/glob.h
+++ b/include/compat/glob.h
@@ -69,8 +69,8 @@ typedef struct {
 #define	GLOB_NOSYS	(-4)	/* Function not supported. */
 #define GLOB_ABEND	GLOB_ABORTED
 
-int	sudo_glob(const char *, int, int (*)(const char *, int), glob_t *);
-void	sudo_globfree(glob_t *);
+__dso_public int  sudo_glob(const char *, int, int (*)(const char *, int), glob_t *);
+__dso_public void sudo_globfree(glob_t *);
 
 #define glob(_a, _b, _c, _d) sudo_glob((_a), (_b), (_c), (_d))
 #define globfree(_a) sudo_globfree((_a))
diff --git a/include/compat/sha2.h b/include/compat/sha2.h
index 79dfc068db..34e4747000 100644
--- a/include/compat/sha2.h
+++ b/include/compat/sha2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2013-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -47,28 +47,28 @@ typedef struct {
     uint8_t buffer[SHA512_BLOCK_LENGTH];
 } SHA2_CTX;
 
-void SHA224Init(SHA2_CTX *ctx);
-void SHA224Pad(SHA2_CTX *ctx);
-void SHA224Transform(uint32_t state[8], const uint8_t buffer[SHA224_BLOCK_LENGTH]);
-void SHA224Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
-void SHA224Final(uint8_t digest[SHA224_DIGEST_LENGTH], SHA2_CTX *ctx);
+__dso_public void SHA224Init(SHA2_CTX *ctx);
+__dso_public void SHA224Pad(SHA2_CTX *ctx);
+__dso_public void SHA224Transform(uint32_t state[8], const uint8_t buffer[SHA224_BLOCK_LENGTH]);
+__dso_public void SHA224Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
+__dso_public void SHA224Final(uint8_t digest[SHA224_DIGEST_LENGTH], SHA2_CTX *ctx);
 
-void SHA256Init(SHA2_CTX *ctx);
-void SHA256Pad(SHA2_CTX *ctx);
-void SHA256Transform(uint32_t state[8], const uint8_t buffer[SHA256_BLOCK_LENGTH]);
-void SHA256Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
-void SHA256Final(uint8_t digest[SHA256_DIGEST_LENGTH], SHA2_CTX *ctx);
+__dso_public void SHA256Init(SHA2_CTX *ctx);
+__dso_public void SHA256Pad(SHA2_CTX *ctx);
+__dso_public void SHA256Transform(uint32_t state[8], const uint8_t buffer[SHA256_BLOCK_LENGTH]);
+__dso_public void SHA256Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
+__dso_public void SHA256Final(uint8_t digest[SHA256_DIGEST_LENGTH], SHA2_CTX *ctx);
 
-void SHA384Init(SHA2_CTX *ctx);
-void SHA384Pad(SHA2_CTX *ctx);
-void SHA384Transform(uint64_t state[8], const uint8_t buffer[SHA384_BLOCK_LENGTH]);
-void SHA384Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
-void SHA384Final(uint8_t digest[SHA384_DIGEST_LENGTH], SHA2_CTX *ctx);
+__dso_public void SHA384Init(SHA2_CTX *ctx);
+__dso_public void SHA384Pad(SHA2_CTX *ctx);
+__dso_public void SHA384Transform(uint64_t state[8], const uint8_t buffer[SHA384_BLOCK_LENGTH]);
+__dso_public void SHA384Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
+__dso_public void SHA384Final(uint8_t digest[SHA384_DIGEST_LENGTH], SHA2_CTX *ctx);
 
-void SHA512Init(SHA2_CTX *ctx);
-void SHA512Pad(SHA2_CTX *ctx);
-void SHA512Transform(uint64_t state[8], const uint8_t buffer[SHA512_BLOCK_LENGTH]);
-void SHA512Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
-void SHA512Final(uint8_t digest[SHA512_DIGEST_LENGTH], SHA2_CTX *ctx);
+__dso_public void SHA512Init(SHA2_CTX *ctx);
+__dso_public void SHA512Pad(SHA2_CTX *ctx);
+__dso_public void SHA512Transform(uint64_t state[8], const uint8_t buffer[SHA512_BLOCK_LENGTH]);
+__dso_public void SHA512Update(SHA2_CTX *ctx, const uint8_t *data, size_t len);
+__dso_public void SHA512Final(uint8_t digest[SHA512_DIGEST_LENGTH], SHA2_CTX *ctx);
 
 #endif /* _SUDOERS_SHA2_H */
diff --git a/include/fatal.h b/include/fatal.h
index 907a6259e6..ac7a9d3809 100644
--- a/include/fatal.h
+++ b/include/fatal.h
@@ -119,18 +119,18 @@
 extern int (*sudo_printf)(int msg_type, const char *fmt, ...);
 extern sigjmp_buf fatal_jmp;
 
-int	fatal_callback_deregister(void (*func)(void));
-int	fatal_callback_register(void (*func)(void));
-char   *warning_gettext(const char *msgid) __format_arg(1);
-void	fatal_disable_setjmp(void);
-void	fatal_enable_setjmp(void);
-void	fatal_nodebug(const char *, ...) __printf0like(1, 2) __attribute__((__noreturn__));
-void	fatalx_nodebug(const char *, ...) __printflike(1, 2) __attribute__((__noreturn__));
-void	vfatal_nodebug(const char *, va_list ap) __printf0like(1, 0) __attribute__((__noreturn__));
-void	vfatalx_nodebug(const char *, va_list ap) __printflike(1, 0) __attribute__((__noreturn__));
-void	warning_nodebug(const char *, ...) __printf0like(1, 2);
-void	warningx_nodebug(const char *, ...) __printflike(1, 2);
-void	vwarning_nodebug(const char *, va_list ap) __printf0like(1, 0);
-void	vwarningx_nodebug(const char *, va_list ap) __printflike(1, 0);
+__dso_public int  fatal_callback_deregister(void (*func)(void));
+__dso_public int  fatal_callback_register(void (*func)(void));
+__dso_public char *warning_gettext(const char *msgid) __format_arg(1);
+__dso_public void fatal_disable_setjmp(void);
+__dso_public void fatal_enable_setjmp(void);
+__dso_public void fatal_nodebug(const char *, ...) __printf0like(1, 2) __attribute__((__noreturn__));
+__dso_public void fatalx_nodebug(const char *, ...) __printflike(1, 2) __attribute__((__noreturn__));
+__dso_public void vfatal_nodebug(const char *, va_list ap) __printf0like(1, 0) __attribute__((__noreturn__));
+__dso_public void vfatalx_nodebug(const char *, va_list ap) __printflike(1, 0) __attribute__((__noreturn__));
+__dso_public void warning_nodebug(const char *, ...) __printf0like(1, 2);
+__dso_public void warningx_nodebug(const char *, ...) __printflike(1, 2);
+__dso_public void vwarning_nodebug(const char *, va_list ap) __printf0like(1, 0);
+__dso_public void vwarningx_nodebug(const char *, va_list ap) __printflike(1, 0);
 
 #endif /* _SUDO_FATAL_H_ */
diff --git a/include/fileops.h b/include/fileops.h
index 9cb537fdad..44cf9d6ded 100644
--- a/include/fileops.h
+++ b/include/fileops.h
@@ -26,8 +26,8 @@
 
 struct timeval;
 
-bool lock_file(int, int);
-int touch(int, char *, struct timeval *);
-ssize_t  sudo_parseln(char **buf, size_t *bufsize, unsigned int *lineno, FILE *fp);
+__dso_public bool lock_file(int, int);
+__dso_public int touch(int, char *, struct timeval *);
+__dso_public ssize_t  sudo_parseln(char **buf, size_t *bufsize, unsigned int *lineno, FILE *fp);
 
 #endif /* _SUDO_FILEOPS_H */
diff --git a/include/lbuf.h b/include/lbuf.h
index b3fd1c35fb..37cc73ebc6 100644
--- a/include/lbuf.h
+++ b/include/lbuf.h
@@ -32,10 +32,10 @@ struct lbuf {
     int cols;
 };
 
-void lbuf_init(struct lbuf *, int (*)(const char *), int, const char *, int);
-void lbuf_destroy(struct lbuf *);
-void lbuf_append(struct lbuf *, const char *, ...) __printflike(2, 3);
-void lbuf_append_quoted(struct lbuf *, const char *, const char *, ...) __printflike(3, 4);
-void lbuf_print(struct lbuf *);
+__dso_public void lbuf_init(struct lbuf *, int (*)(const char *), int, const char *, int);
+__dso_public void lbuf_destroy(struct lbuf *);
+__dso_public void lbuf_append(struct lbuf *, const char *, ...) __printflike(2, 3);
+__dso_public void lbuf_append_quoted(struct lbuf *, const char *, const char *, ...) __printflike(3, 4);
+__dso_public void lbuf_print(struct lbuf *);
 
 #endif /* _SUDO_LBUF_H */
diff --git a/include/missing.h b/include/missing.h
index 99db7f9ba2..af3ff956c9 100644
--- a/include/missing.h
+++ b/include/missing.h
@@ -247,7 +247,7 @@
  * Simple isblank() macro and function for systems without it.
  */
 #ifndef HAVE_ISBLANK
-int isblank(int);
+__dso_public int isblank(int);
 # define isblank(_x)	((_x) == ' ' || (_x) == '\t')
 #endif
 
@@ -309,7 +309,7 @@ typedef struct sigaction sigaction_t;
 extern const char *__progname;
 #  define getprogname()		(__progname)
 # else
-const char *getprogname(void);
+__dso_public const char *getprogname(void);
 # endif /* HAVE___PROGNAME */
 #endif /* !HAVE_GETPROGNAME */
 
@@ -372,102 +372,102 @@ struct timeval;
 struct timespec;
 
 #ifndef HAVE_CLOSEFROM
-void sudo_closefrom(int);
+__dso_public void sudo_closefrom(int);
 # undef closefrom
 # define closefrom(_a) sudo_closefrom((_a))
 #endif /* HAVE_CLOSEFROM */
 #ifndef HAVE_GETCWD
-char *sudo_getcwd(char *, size_t size);
+__dso_public char *sudo_getcwd(char *, size_t size);
 # undef getcwd
 # define getcwd(_a, _b) sudo_getcwd((_a), (_b))
 #endif /* HAVE_GETCWD */
 #ifndef HAVE_GETGROUPLIST
-int sudo_getgrouplist(const char *, gid_t, gid_t *, int *);
+__dso_public int sudo_getgrouplist(const char *, gid_t, gid_t *, int *);
 # undef getgrouplist
 # define getgrouplist(_a, _b, _c, _d) sudo_getgrouplist((_a), (_b), (_c), (_d))
 #endif /* GETGROUPLIST */
 #ifndef HAVE_GETLINE
-ssize_t sudo_getline(char **, size_t *, FILE *);
+__dso_public ssize_t sudo_getline(char **, size_t *, FILE *);
 # undef getline
 # define getline(_a, _b, _c) sudo_getline((_a), (_b), (_c))
 #endif /* HAVE_GETLINE */
 #ifndef HAVE_UTIMES
-int sudo_utimes(const char *, const struct timeval *);
+__dso_public int sudo_utimes(const char *, const struct timeval *);
 # undef utimes
 # define utimes(_a, _b) sudo_utimes(((_a), (_b))
 #endif /* HAVE_UTIMES */
 #ifdef HAVE_FUTIME
-int sudo_futimes(int, const struct timeval *);
+__dso_public int sudo_futimes(int, const struct timeval *);
 # undef futimes
 # define futimes(_a, _b) sudo_futimes(((_a), (_b))
 #endif /* HAVE_FUTIME */
 #if !defined(HAVE_SNPRINTF) || defined(PREFER_PORTABLE_SNPRINTF)
-int sudo_snprintf(char *, size_t, const char *, ...) __printflike(3, 4);
+__dso_public int sudo_snprintf(char *, size_t, const char *, ...) __printflike(3, 4);
 # undef snprintf
 # define snprintf sudo_snprintf
 #endif /* HAVE_SNPRINTF */
 #if !defined(HAVE_VSNPRINTF) || defined(PREFER_PORTABLE_SNPRINTF)
-int sudo_vsnprintf(char *, size_t, const char *, va_list) __printflike(3, 0);
+__dso_public int sudo_vsnprintf(char *, size_t, const char *, va_list) __printflike(3, 0);
 # undef vsnprintf
 # define vsnprintf sudo_vsnprintf
 #endif /* HAVE_VSNPRINTF */
 #if !defined(HAVE_ASPRINTF) || defined(PREFER_PORTABLE_SNPRINTF)
-int sudo_asprintf(char **, const char *, ...) __printflike(2, 3);
+__dso_public int sudo_asprintf(char **, const char *, ...) __printflike(2, 3);
 # undef asprintf
 # define asprintf sudo_asprintf
 #endif /* HAVE_ASPRINTF */
 #if !defined(HAVE_VASPRINTF) || defined(PREFER_PORTABLE_SNPRINTF)
-int sudo_vasprintf(char **, const char *, va_list) __printflike(2, 0);
+__dso_public int sudo_vasprintf(char **, const char *, va_list) __printflike(2, 0);
 # undef vasprintf
 # define vasprintf sudo_vasprintf
 #endif /* HAVE_VASPRINTF */
 #ifndef HAVE_STRLCAT
-size_t sudo_strlcat(char *, const char *, size_t);
+__dso_public size_t sudo_strlcat(char *, const char *, size_t);
 # undef strlcat
 # define strlcat(_a, _b, _c) sudo_strlcat((_a), (_b), (_c))
 #endif /* HAVE_STRLCAT */
 #ifndef HAVE_STRLCPY
-size_t sudo_strlcpy(char *, const char *, size_t);
+__dso_public size_t sudo_strlcpy(char *, const char *, size_t);
 # undef strlcpy
 # define strlcpy(_a, _b, _c) sudo_strlcpy((_a), (_b), (_c))
 #endif /* HAVE_STRLCPY */
 #ifndef HAVE_MEMRCHR
-void *sudo_memrchr(const void *, int, size_t);
+__dso_public void *sudo_memrchr(const void *, int, size_t);
 # undef memrchr
 # define memrchr(_a, _b, _c) sudo_memrchr((_a), (_b), (_c))
 #endif /* HAVE_MEMRCHR */
 #ifndef HAVE_MEMSET_S
-errno_t sudo_memset_s(void *, rsize_t, int, rsize_t);
+__dso_public errno_t sudo_memset_s(void *, rsize_t, int, rsize_t);
 # undef memset_s
 # define memset_s(_a, _b, _c, _d) sudo_memset_s((_a), (_b), (_c), (_d))
 #endif /* HAVE_MEMSET_S */
 #ifndef HAVE_MKDTEMP
-char *sudo_mkdtemp(char *);
+__dso_public char *sudo_mkdtemp(char *);
 # undef mkdtemp
 # define mkdtemp(_a) sudo_mkdtemp((_a))
 #endif /* HAVE_MKDTEMP */
 #ifndef HAVE_MKSTEMPS
-int mkstemps(char *, int);
+__dso_public int sudo_mkstemps(char *, int);
 # undef mkstemps
 # define mkstemps(_a, _b) sudo_mkstemps((_a), (_b))
 #endif /* HAVE_MKSTEMPS */
 #ifndef HAVE_PW_DUP
-struct passwd *sudo_pw_dup(const struct passwd *);
+__dso_public struct passwd *sudo_pw_dup(const struct passwd *);
 # undef pw_dup
 # define pw_dup(_a) sudo_pw_dup((_a))
 #endif /* HAVE_PW_DUP */
 #ifndef HAVE_STRSIGNAL
-char *sudo_strsignal(int);
+__dso_public char *sudo_strsignal(int);
 # undef strsignal
 # define strsignal(_a) sudo_strsignal((_a))
 #endif /* HAVE_STRSIGNAL */
 #ifndef HAVE_SIG2STR
-int sudo_sig2str(int, char *);
+__dso_public int sudo_sig2str(int, char *);
 # undef sig2str
 # define sig2str(_a, _b) sudo_sig2str((_a), (_b))
 #endif /* HAVE_SIG2STR */
 #ifndef HAVE_STRTONUM
-long long sudo_strtonum(const char *, long long, long long, const char **);
+__dso_public long long sudo_strtonum(const char *, long long, long long, const char **);
 # undef strtonum
 # define strtonum(_a, _b, _c, _d) sudo_strtonum((_a), (_b), (_c), (_d))
 #endif /* HAVE_STRTONUM */
@@ -476,12 +476,12 @@ long long sudo_strtonum(const char *, long long, long long, const char **);
 # ifdef __MACH__
 #  define CLOCK_MONOTONIC 1
 # endif
-int sudo_clock_gettime(clockid_t clock_id, struct timespec *tp);
+__dso_public int sudo_clock_gettime(clockid_t clock_id, struct timespec *tp);
 # undef clock_gettime
 # define clock_gettime(_a, _b) sudo_clock_gettime((_a), (_b))
 #endif /* HAVE_CLOCK_GETTIME */
 #ifndef HAVE_INET_PTON
-int sudo_inet_pton(int af, const char *src, void *dst);
+__dso_public int sudo_inet_pton(int af, const char *src, void *dst);
 # undef inet_pton
 # define inet_pton(_a, _b, _c) sudo_inet_pton((_a), (_b), (_c))
 #endif /* HAVE_INET_PTON */
diff --git a/include/secure_path.h b/include/secure_path.h
index aa4f8de651..fcc48e5100 100644
--- a/include/secure_path.h
+++ b/include/secure_path.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2012-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -24,8 +24,8 @@
 #define SUDO_PATH_WORLD_WRITABLE	-4
 #define SUDO_PATH_GROUP_WRITABLE	-5
 
-int sudo_secure_dir(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
-int sudo_secure_file(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
-int sudo_secure_path(const char *path, unsigned int type, uid_t uid, gid_t gid, struct stat *sbp);
+__dso_public int sudo_secure_dir(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
+__dso_public int sudo_secure_file(const char *path, uid_t uid, gid_t gid, struct stat *sbp);
+__dso_public int sudo_secure_path(const char *path, unsigned int type, uid_t uid, gid_t gid, struct stat *sbp);
 
 #endif /* _SUDO_SECURE_PATH_H */
diff --git a/include/sudo_conf.h b/include/sudo_conf.h
index 6350e9c76c..941115dd2c 100644
--- a/include/sudo_conf.h
+++ b/include/sudo_conf.h
@@ -33,18 +33,18 @@ struct plugin_info {
 TAILQ_HEAD(plugin_info_list, plugin_info);
 
 /* Read main sudo.conf file. */
-void sudo_conf_read(const char *);
+__dso_public void sudo_conf_read(const char *);
 
 /* Accessor functions. */
-const char *sudo_conf_askpass_path(void);
-const char *sudo_conf_sesh_path(void);
-const char *sudo_conf_noexec_path(void);
-const char *sudo_conf_plugin_dir_path(void);
-const char *sudo_conf_debug_flags(void);
-struct plugin_info_list *sudo_conf_plugins(void);
-bool sudo_conf_disable_coredump(void);
-bool sudo_conf_probe_interfaces(void);
-int sudo_conf_group_source(void);
-int sudo_conf_max_groups(void);
+__dso_public const char *sudo_conf_askpass_path(void);
+__dso_public const char *sudo_conf_sesh_path(void);
+__dso_public const char *sudo_conf_noexec_path(void);
+__dso_public const char *sudo_conf_plugin_dir_path(void);
+__dso_public const char *sudo_conf_debug_flags(void);
+__dso_public struct plugin_info_list *sudo_conf_plugins(void);
+__dso_public bool sudo_conf_disable_coredump(void);
+__dso_public bool sudo_conf_probe_interfaces(void);
+__dso_public int sudo_conf_group_source(void);
+__dso_public int sudo_conf_max_groups(void);
 
 #endif /* _SUDO_CONF_H */
diff --git a/include/sudo_debug.h b/include/sudo_debug.h
index 31be22d092..83d6cafab9 100644
--- a/include/sudo_debug.h
+++ b/include/sudo_debug.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2012 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2011-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -208,24 +208,24 @@
 extern const char *const sudo_debug_priorities[];
 extern const char *const sudo_debug_subsystems[];
 
-void sudo_debug_enter(const char *func, const char *file, int line, int subsys);
-void sudo_debug_execve2(int level, const char *path, char *const argv[], char *const envp[]);
-void sudo_debug_exit(const char *func, const char *file, int line, int subsys);
-void sudo_debug_exit_int(const char *func, const char *file, int line, int subsys, int rval);
-void sudo_debug_exit_long(const char *func, const char *file, int line, int subsys, long rval);
-void sudo_debug_exit_size_t(const char *func, const char *file, int line, int subsys, size_t rval);
-void sudo_debug_exit_bool(const char *func, const char *file, int line, int subsys, int rval);
-void sudo_debug_exit_str(const char *func, const char *file, int line, int subsys, const char *rval);
-void sudo_debug_exit_str_masked(const char *func, const char *file, int line, int subsys, const char *rval);
-void sudo_debug_exit_ptr(const char *func, const char *file, int line, int subsys, const void *rval);
-int sudo_debug_fd_get(void);
-int sudo_debug_fd_set(int fd);
-int sudo_debug_init(const char *debugfile, const char *settings);
-void sudo_debug_printf_nvm(int pri, const char *fmt, ...) __printf0like(2, 3);
-void sudo_debug_printf2(const char *func, const char *file, int line, int level, const char *fmt, ...) __printf0like(5, 6);
-void sudo_debug_vprintf2(const char *func, const char *file, int line, int level, const char *fmt, va_list ap) __printf0like(5, 0);
-void sudo_debug_write(const char *str, int len, int errno_val);
-void sudo_debug_write2(const char *func, const char *file, int line, const char *str, int len, int errno_val);
-pid_t sudo_debug_fork(void);
+__dso_public void sudo_debug_enter(const char *func, const char *file, int line, int subsys);
+__dso_public void sudo_debug_execve2(int level, const char *path, char *const argv[], char *const envp[]);
+__dso_public void sudo_debug_exit(const char *func, const char *file, int line, int subsys);
+__dso_public void sudo_debug_exit_int(const char *func, const char *file, int line, int subsys, int rval);
+__dso_public void sudo_debug_exit_long(const char *func, const char *file, int line, int subsys, long rval);
+__dso_public void sudo_debug_exit_size_t(const char *func, const char *file, int line, int subsys, size_t rval);
+__dso_public void sudo_debug_exit_bool(const char *func, const char *file, int line, int subsys, int rval);
+__dso_public void sudo_debug_exit_str(const char *func, const char *file, int line, int subsys, const char *rval);
+__dso_public void sudo_debug_exit_str_masked(const char *func, const char *file, int line, int subsys, const char *rval);
+__dso_public void sudo_debug_exit_ptr(const char *func, const char *file, int line, int subsys, const void *rval);
+__dso_public int sudo_debug_fd_get(void);
+__dso_public int sudo_debug_fd_set(int fd);
+__dso_public int sudo_debug_init(const char *debugfile, const char *settings);
+__dso_public void sudo_debug_printf_nvm(int pri, const char *fmt, ...) __printf0like(2, 3);
+__dso_public void sudo_debug_printf2(const char *func, const char *file, int line, int level, const char *fmt, ...) __printf0like(5, 6);
+__dso_public void sudo_debug_vprintf2(const char *func, const char *file, int line, int level, const char *fmt, va_list ap) __printf0like(5, 0);
+__dso_public void sudo_debug_write(const char *str, int len, int errno_val);
+__dso_public void sudo_debug_write2(const char *func, const char *file, int line, const char *str, int len, int errno_val);
+__dso_public pid_t sudo_debug_fork(void);
 
 #endif /* _SUDO_DEBUG_H */
diff --git a/include/sudo_dso.h b/include/sudo_dso.h
index c604ea4515..dfb51f63ee 100644
--- a/include/sudo_dso.h
+++ b/include/sudo_dso.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2010, 2013, 2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -40,10 +40,10 @@ struct sudo_preload_table {
 };
 
 /* Public functions. */
-char *sudo_dso_strerror(void);
-int sudo_dso_unload(void *handle);
-void *sudo_dso_findsym(void *handle, const char *symbol);
-void *sudo_dso_load(const char *path, int mode);
-void sudo_dso_preload_table(struct sudo_preload_table *table);
+__dso_public char *sudo_dso_strerror(void);
+__dso_public int sudo_dso_unload(void *handle);
+__dso_public void *sudo_dso_findsym(void *handle, const char *symbol);
+__dso_public void *sudo_dso_load(const char *path, int mode);
+__dso_public void sudo_dso_preload_table(struct sudo_preload_table *table);
 
 #endif /* _SUDO_DSO_H */
diff --git a/include/sudo_event.h b/include/sudo_event.h
index 1a979755e3..338561c0dc 100644
--- a/include/sudo_event.h
+++ b/include/sudo_event.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 Todd C. Miller <Todd.Miller@courtesan.com>
+ * Copyright (c) 2013-2014 Todd C. Miller <Todd.Miller@courtesan.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -83,43 +83,43 @@ struct sudo_event_base {
 };
 
 /* Allocate a new event base. */
-struct sudo_event_base *sudo_ev_base_alloc(void);
+__dso_public struct sudo_event_base *sudo_ev_base_alloc(void);
 
 /* Free an event base. */
-void sudo_ev_base_free(struct sudo_event_base *base);
+__dso_public void sudo_ev_base_free(struct sudo_event_base *base);
 
 /* Allocate a new event. */
-struct sudo_event *sudo_ev_alloc(int fd, short events, sudo_ev_callback_t callback, void *closure);
+__dso_public struct sudo_event *sudo_ev_alloc(int fd, short events, sudo_ev_callback_t callback, void *closure);
 
 /* Free an event. */
-void sudo_ev_free(struct sudo_event *ev);
+__dso_public void sudo_ev_free(struct sudo_event *ev);
 
 /* Add an event, returns 0 on success, -1 on error */
-int sudo_ev_add(struct sudo_event_base *head, struct sudo_event *ev, struct timeval *timo, bool tohead);
+__dso_public int sudo_ev_add(struct sudo_event_base *head, struct sudo_event *ev, struct timeval *timo, bool tohead);
 
 /* Delete an event, returns 0 on success, -1 on error */
-int sudo_ev_del(struct sudo_event_base *head, struct sudo_event *ev);
+__dso_public int sudo_ev_del(struct sudo_event_base *head, struct sudo_event *ev);
 
 /* Main event loop, returns SUDO_CB_SUCCESS, SUDO_CB_BREAK or SUDO_CB_ERROR */
-int sudo_ev_loop(struct sudo_event_base *head, int flags);
+__dso_public int sudo_ev_loop(struct sudo_event_base *head, int flags);
 
 /* Return the remaining timeout associated with an event. */
-int sudo_ev_get_timeleft(struct sudo_event *ev, struct timeval *tv);
+__dso_public int sudo_ev_get_timeleft(struct sudo_event *ev, struct timeval *tv);
 
 /* Cause the event loop to exit after one run through. */
-void sudo_ev_loopexit(struct sudo_event_base *base);
+__dso_public void sudo_ev_loopexit(struct sudo_event_base *base);
 
 /* Break out of the event loop right now. */
-void sudo_ev_loopbreak(struct sudo_event_base *base);
+__dso_public void sudo_ev_loopbreak(struct sudo_event_base *base);
 
 /* Rescan for events and restart the event loop. */
-void sudo_ev_loopcontinue(struct sudo_event_base *base);
+__dso_public void sudo_ev_loopcontinue(struct sudo_event_base *base);
 
 /* Returns true if event loop stopped due to sudo_ev_loopexit(). */
-bool sudo_ev_got_exit(struct sudo_event_base *base);
+__dso_public bool sudo_ev_got_exit(struct sudo_event_base *base);
 
 /* Returns true if event loop stopped due to sudo_ev_loopbreak(). */
-bool sudo_ev_got_break(struct sudo_event_base *base);
+__dso_public bool sudo_ev_got_break(struct sudo_event_base *base);
 
 /* Return the fd associated with an event. */
 #define sudo_ev_get_fd(_ev) ((_ev) ? (_ev)->fd : -1)
diff --git a/include/sudo_util.h b/include/sudo_util.h
index 61a7180f1e..f8c04dcad4 100644
--- a/include/sudo_util.h
+++ b/include/sudo_util.h
@@ -137,39 +137,39 @@
 #endif
 
 /* aix.c */
-int aix_prep_user(char *user, const char *tty);
-int aix_restoreauthdb(void);
-int aix_setauthdb(char *user);
+__dso_public int aix_prep_user(char *user, const char *tty);
+__dso_public int aix_restoreauthdb(void);
+__dso_public int aix_setauthdb(char *user);
 
 /* atobool.c */
-int atobool(const char *str);
+__dso_public int atobool(const char *str);
 
 /* atoid.c */
-id_t atoid(const char *str, const char *sep, char **endp, const char **errstr);
+__dso_public id_t atoid(const char *str, const char *sep, char **endp, const char **errstr);
 
 /* atomode.c */
-int atomode(const char *cp, const char **errstr);
+__dso_public int atomode(const char *cp, const char **errstr);
 
 /* fmt_string.h */
-char *fmt_string(const char *var, const char *value);
+__dso_public char *fmt_string(const char *var, const char *value);
 
 /* gidlist.c */
-int parse_gid_list(const char *gidstr, const gid_t *basegid, GETGROUPS_T **gidsp);
+__dso_public int parse_gid_list(const char *gidstr, const gid_t *basegid, GETGROUPS_T **gidsp);
 
 /* progname.c */
-void initprogname(const char *);
+__dso_public void initprogname(const char *);
 
 /* setgroups.c */
-int sudo_setgroups(int ngids, const GETGROUPS_T *gids);
+__dso_public int sudo_setgroups(int ngids, const GETGROUPS_T *gids);
 
 /* term.c */
-bool term_cbreak(int);
-bool term_copy(int, int);
-bool term_noecho(int);
-bool term_raw(int, int);
-bool term_restore(int, bool);
+__dso_public bool term_cbreak(int);
+__dso_public bool term_copy(int, int);
+__dso_public bool term_noecho(int);
+__dso_public bool term_raw(int, int);
+__dso_public bool term_restore(int, bool);
 
 /* ttysize.c */
-void get_ttysize(int *rowp, int *colp);
+__dso_public void get_ttysize(int *rowp, int *colp);
 
 #endif /* _SUDO_UTIL_H */
diff --git a/install-sh b/install-sh
index 79e7f40817..6944fba19a 100755
--- a/install-sh
+++ b/install-sh
@@ -51,6 +51,12 @@ BACKIT=false
 TOUCHIT=true
 DIRMODE=false
 
+# INSTALL_BACKUP is like -b but for use with libtool
+if test X"${INSTALL_BACKUP}" != X""; then
+    BACKIT=true
+    BACKUP="${INSTALL_BACKUP}"
+fi
+
 case `${WHOAMI}` in
 root)
     ROOT=true
@@ -217,7 +223,7 @@ if [ X"$1" != X"$2" ] ; then
     fi
 fi
 
-##  Strip and set the modes.
+##  Strip and set the owner/mode.
 if ${STRIPIT} ; then
     ${STRIP} "${DEST}" || exit 1
 fi
@@ -228,6 +234,6 @@ if ${CHGROUPIT} ; then
     ${CHGRP} "${GROUP}" "${DEST}" || exit 1
 fi
 if ${CHMODIT} ; then
-    ${CHMOD} "${MODE}"  "${DEST}" || exit 1
+    ${CHMOD} "${MODE}" "${DEST}" || exit 1
 fi
 exit 0
diff --git a/lib/util/Makefile.in b/lib/util/Makefile.in
index f12c3aae5e..1a70e6f362 100644
--- a/lib/util/Makefile.in
+++ b/lib/util/Makefile.in
@@ -36,9 +36,21 @@ libexecdir = @libexecdir@
 datarootdir = @datarootdir@
 localstatedir = @localstatedir@
 
+# File extension, mode and map file to use for shared libraries/objects
+soext = @SOEXT@
+shlib_mode = @SHLIB_MODE@
+shlib_exp = $(srcdir)/util.exp
+shlib_map = util.map
+shlib_opt = util.opt
+
 # Compiler & tools to use
 CC = @CC@
 LIBTOOL = @LIBTOOL@
+SED = @SED@
+
+# Our install program supports extra flags...
+INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # C preprocessor flags
 CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(top_srcdir) @CPPFLAGS@
@@ -46,6 +58,10 @@ CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(top_srcdir) @CPPFLAGS@
 # Usually -O and/or -g
 CFLAGS = @CFLAGS@
 
+# Flags to pass to the link stage
+LDFLAGS = @LDFLAGS@
+LT_LDFLAGS = @LT_LDFLAGS@ @LT_LDMAP@ @LT_LDOPT@ @LT_LDEXPORTS@
+
 # PIE flags
 PIE_CFLAGS = @PIE_CFLAGS@
 PIE_LDFLAGS = @PIE_LDFLAGS@
@@ -54,6 +70,9 @@ PIE_LDFLAGS = @PIE_LDFLAGS@
 SSP_CFLAGS = @SSP_CFLAGS@
 SSP_LDFLAGS = @SSP_LDFLAGS@
 
+# Libtool style shard library version
+SHLIB_VERSION = 0:0:0
+
 # cppcheck options, usually set in the top-level Makefile
 CPPCHECK_OPTS = -q --force --enable=warning,performance,portability --suppress=constStatement --error-exitcode=1 --inline-suppr -U__cplusplus -UQUAD_MAX -UQUAD_MIN -UUQUAD_MAX -U_POSIX_HOST_NAME_MAX -U_POSIX_PATH_MAX
 
@@ -62,6 +81,10 @@ TEST_PROGS = atofoo_test conf_test hltq_test parseln_test @COMPAT_TEST_PROGS@
 TEST_LIBS = @LIBS@ @LIBINTL@
 TEST_LDFLAGS = @LDFLAGS@
 
+# User and group ids the installed files should be "owned" by
+install_uid = 0
+install_gid = 0
+
 # OS dependent defines
 DEFS = @OSDEFS@ -D_PATH_SUDO_CONF=\"$(sysconfdir)/sudo.conf\"
 
@@ -85,6 +108,10 @@ CONF_TEST_OBJS = conf_test.lo locale_stub.lo
 
 HLTQ_TEST_OBJS = hltq_test.lo locale_stub.lo
 
+FNM_TEST_OBJS = fnm_test.lo locale_stub.lo
+
+GLOBTEST_OBJS = globtest.lo locale_stub.lo
+
 all: libsudo_util.la
 
 Makefile: $(srcdir)/Makefile.in
@@ -98,8 +125,14 @@ Makefile: $(srcdir)/Makefile.in
 .c.lo:
 	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $<
 
-libsudo_util.la: $(LTOBJS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(LTOBJS) -no-install
+$(shlib_map): $(shlib_exp)
+	@awk 'BEGIN { print "{\n\tglobal:" } { print "\t\t"$$0";" } END { print "\tlocal:\n\t\t*;\n};" }' $(shlib_exp) > $@
+
+$(shlib_opt): $(shlib_exp)
+	@$(SED) 's/^/+e /' $(shlib_exp) > $@
+
+libsudo_util.la: $(LTOBJS) @LT_LDDEP@
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(LDFLAGS) $(LT_LDFLAGS) $(LTOBJS) -version-info $(SHLIB_VERSION) -rpath $(libexecdir)/sudo @LIBDL@
 
 siglist.c: mksiglist
 	./mksiglist > $@
@@ -113,12 +146,6 @@ mksiglist: $(srcdir)/mksiglist.c $(srcdir)/mksiglist.h $(incdir)/missing.h $(top
 mksigname: $(srcdir)/mksigname.c $(srcdir)/mksigname.h $(incdir)/missing.h $(top_builddir)/config.h
 	$(CC) $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/mksigname.c -o $@
 
-fnm_test: fnm_test.o libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ fnm_test.o libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS)
-
-globtest: globtest.o libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ globtest.o libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS)
-
 $(srcdir)/mksiglist.h: $(srcdir)/siglist.in
 	@if [ -n "$(DEVEL)" ]; then \
 	    awk 'BEGIN {print "/* public domain */\n"} /^    [A-Z]/ {printf("#ifdef SIG%s\n    if (sudo_sys_siglist[SIG%s] == NULL)\n\tsudo_sys_siglist[SIG%s] = \"%s\";\n#endif\n", $$1, $$1, $$1, substr($$0, 13))}' < $(srcdir)/siglist.in > $@; \
@@ -130,22 +157,32 @@ $(srcdir)/mksigname.h: $(srcdir)/siglist.in
 	fi
 
 atofoo_test: $(ATOFOO_TEST_OBJS) libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(ATOFOO_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(ATOFOO_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
 
 conf_test: $(CONF_TEST_OBJS) libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CONF_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CONF_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
 
-parseln_test: $(PARSELN_TEST_OBJS) libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(PARSELN_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
+fnm_test: $(FNM_TEST_OBJS) libsudo_util.la
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(FNM_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
+
+globtest: $(GLOBTEST_OBJS) libsudo_util.la
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(GLOBTEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
 
 hltq_test: $(HLTQ_TEST_OBJS) libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(HLTQ_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(HLTQ_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
+
+parseln_test: $(PARSELN_TEST_OBJS) libsudo_util.la
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(PARSELN_TEST_OBJS) libsudo_util.la $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LDFLAGS) $(TEST_LIBS) -no-fast-install
 
 pre-install:
 
-install:
+install: install-dirs
+	if [ X"$(soext)" != X"" ]; then \
+	    INSTALL_BACKUP='~' $(LIBTOOL) --quiet --mode=install $(INSTALL) $(INSTALL_OWNER) libsudo_util.la $(DESTDIR)$(libexecdir)/sudo; \
+	fi
 
 install-dirs:
+	$(SHELL) $(top_srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)/sudo
 
 install-binaries:
 
@@ -168,7 +205,7 @@ check: $(TEST_PROGS)
 		./fnm_test $(srcdir)/regress/fnmatch/fnm_test.in || rval=`expr $$rval + $$?`; \
 	    fi; \
 	    if test -f globtest; then \
-		mkdir -p `sed 's@/[^/]*$$@@' $(srcdir)/regress/glob/files | sort -u`; \
+		mkdir -p `$(SED) 's@/[^/]*$$@@' $(srcdir)/regress/glob/files | sort -u`; \
 		touch `cat $(srcdir)/regress/glob/files`; \
 		chmod 0755 `grep '/r[^/]*$$' $(srcdir)/regress/glob/files`; \
 		chmod 0444 `grep '/s[^/]*$$' $(srcdir)/regress/glob/files`; \
@@ -305,9 +342,10 @@ fmt_string.lo: $(srcdir)/fmt_string.c $(incdir)/compat/stdbool.h \
                $(incdir)/missing.h $(incdir)/sudo_debug.h \
                $(incdir)/sudo_util.h $(top_builddir)/config.h
 	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/fmt_string.c
-fnm_test.o: $(srcdir)/regress/fnmatch/fnm_test.c $(incdir)/compat/fnmatch.h \
-            $(incdir)/missing.h $(top_builddir)/config.h
-	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/regress/fnmatch/fnm_test.c
+fnm_test.lo: $(srcdir)/regress/fnmatch/fnm_test.c $(incdir)/compat/fnmatch.h \
+             $(incdir)/missing.h $(top_builddir)/config.h
+	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/regress/fnmatch/fnm_test.c
+fnm_test.o: fnm_test.lo
 fnmatch.lo: $(srcdir)/fnmatch.c $(incdir)/compat/charclass.h \
             $(incdir)/compat/fnmatch.h $(incdir)/missing.h \
             $(top_builddir)/config.h
@@ -334,9 +372,10 @@ gidlist.lo: $(srcdir)/gidlist.c $(incdir)/alloc.h $(incdir)/compat/stdbool.h \
 glob.lo: $(srcdir)/glob.c $(incdir)/compat/charclass.h $(incdir)/compat/glob.h \
          $(incdir)/missing.h $(top_builddir)/config.h
 	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/glob.c
-globtest.o: $(srcdir)/regress/glob/globtest.c $(incdir)/compat/glob.h \
-            $(incdir)/missing.h $(top_builddir)/config.h
-	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/regress/glob/globtest.c
+globtest.lo: $(srcdir)/regress/glob/globtest.c $(incdir)/compat/glob.h \
+             $(incdir)/missing.h $(top_builddir)/config.h
+	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/regress/glob/globtest.c
+globtest.o: globtest.lo
 hltq_test.lo: $(srcdir)/regress/tailq/hltq_test.c $(incdir)/compat/stdbool.h \
               $(incdir)/fatal.h $(incdir)/missing.h $(incdir)/queue.h \
               $(incdir)/sudo_util.h $(top_builddir)/config.h
@@ -369,7 +408,7 @@ parseln_test.lo: $(srcdir)/regress/sudo_parseln/parseln_test.c \
 progname.lo: $(srcdir)/progname.c $(incdir)/compat/stdbool.h \
              $(incdir)/missing.h $(incdir)/sudo_util.h $(top_builddir)/config.h
 	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/progname.c
-pw_dup.lo: $(srcdir)/pw_dup.c $(top_builddir)/config.h
+pw_dup.lo: $(srcdir)/pw_dup.c $(incdir)/missing.h $(top_builddir)/config.h
 	$(LIBTOOL) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(DEFS) $(srcdir)/pw_dup.c
 secure_path.lo: $(srcdir)/secure_path.c $(incdir)/missing.h \
                 $(incdir)/secure_path.h $(incdir)/sudo_debug.h \
diff --git a/lib/util/fatal.c b/lib/util/fatal.c
index 48012897a2..8da8b21566 100644
--- a/lib/util/fatal.c
+++ b/lib/util/fatal.c
@@ -43,7 +43,7 @@ struct sudo_fatal_callback {
 };
 SLIST_HEAD(sudo_fatal_callback_list, sudo_fatal_callback);
 
-sigjmp_buf fatal_jmp;
+__dso_public sigjmp_buf fatal_jmp;
 static bool setjmp_enabled = false;
 static struct sudo_fatal_callback_list callbacks;
 
diff --git a/lib/util/getaddrinfo.c b/lib/util/getaddrinfo.c
index 92db4cd99e..24b0fd1cdd 100644
--- a/lib/util/getaddrinfo.c
+++ b/lib/util/getaddrinfo.c
@@ -59,8 +59,8 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 
-#include "compat/getaddrinfo.h"
 #include "missing.h"
+#include "compat/getaddrinfo.h"
 
 /* We need access to h_errno to map errors from gethostbyname. */
 #ifndef HAVE_DECL_H_ERRNO
diff --git a/lib/util/pw_dup.c b/lib/util/pw_dup.c
index 56a5aa041e..41da6d05eb 100644
--- a/lib/util/pw_dup.c
+++ b/lib/util/pw_dup.c
@@ -45,6 +45,8 @@
 #endif /* HAVE_MALLOC_H && !STDC_HEADERS */
 #include <pwd.h>
 
+#include "missing.h"
+
 #define PW_SIZE(name, size)				\
 do {							\
 	if (pw->name) {					\
diff --git a/lib/util/regress/fnmatch/fnm_test.c b/lib/util/regress/fnmatch/fnm_test.c
index 7795363969..993c39ce77 100644
--- a/lib/util/regress/fnmatch/fnm_test.c
+++ b/lib/util/regress/fnmatch/fnm_test.c
@@ -14,14 +14,15 @@
 #ifdef HAVE_STRINGS_H
 # include <strings.h>
 #endif /* HAVE_STRINGS_H */
+
+#include "missing.h"
+
 #ifdef HAVE_FNMATCH
 # include <fnmatch.h>
 #else
 # include "compat/fnmatch.h"
 #endif
 
-#include "missing.h"
-
 __dso_public int main(int argc, char *argv[]);
 
 int
diff --git a/lib/util/sudo_dso.c b/lib/util/sudo_dso.c
index 44f0604009..972d9d828d 100644
--- a/lib/util/sudo_dso.c
+++ b/lib/util/sudo_dso.c
@@ -40,8 +40,8 @@
 #endif
 #include <errno.h>
 
-#include "sudo_dso.h"
 #include "missing.h"
+#include "sudo_dso.h"
 
 /*
  * Pointer for statically compiled symbols.
diff --git a/lib/util/sudo_printf.c b/lib/util/sudo_printf.c
index 09839242a7..87e3041d3c 100644
--- a/lib/util/sudo_printf.c
+++ b/lib/util/sudo_printf.c
@@ -33,7 +33,7 @@
 #include "sudo_plugin.h"
 #include "sudo_debug.h"
 
-int
+__dso_public int
 _sudo_printf(int msg_type, const char *fmt, ...)
 {
     va_list ap;
@@ -67,4 +67,4 @@ _sudo_printf(int msg_type, const char *fmt, ...)
     return len;
 }
 
-sudo_printf_t sudo_printf = _sudo_printf;
+__dso_public sudo_printf_t sudo_printf = _sudo_printf;
diff --git a/lib/util/term.c b/lib/util/term.c
index e03b29b065..6c14b2f696 100644
--- a/lib/util/term.c
+++ b/lib/util/term.c
@@ -69,8 +69,8 @@ static struct termios term, oterm;
 static int changed;
 
 /* tgetpass() needs to know the erase and kill chars for cbreak mode. */
-int term_erase;
-int term_kill;
+__dso_public int term_erase;
+__dso_public int term_kill;
 
 static volatile sig_atomic_t got_sigttou;
 
diff --git a/lib/util/util.exp b/lib/util/util.exp
new file mode 100644
index 0000000000..7f0786f00b
--- /dev/null
+++ b/lib/util/util.exp
@@ -0,0 +1,155 @@
+SHA224Final
+SHA224Init
+SHA224Pad
+SHA224Transform
+SHA224Update
+SHA256Final
+SHA256Init
+SHA256Pad
+SHA256Transform
+SHA256Update
+SHA384Final
+SHA384Init
+SHA384Pad
+SHA384Transform
+SHA384Update
+SHA512Final
+SHA512Init
+SHA512Pad
+SHA512Transform
+SHA512Update
+_sudo_printf
+aix_prep_user
+aix_restoreauthdb
+aix_setauthdb
+atobool
+atoid
+atomode
+closefrom_fallback
+easprintf
+ecalloc
+emalloc
+emallocarray
+erealloc
+ereallocarray
+erecalloc
+estrdup
+estrndup
+evasprintf
+fatal_callback_deregister
+fatal_callback_register
+fatal_disable_setjmp
+fatal_enable_setjmp
+fatal_jmp
+fatal_nodebug
+fatalx_nodebug
+fmt_string
+get_ttysize
+getprogname
+initprogname
+isblank
+lbuf_append
+lbuf_append_quoted
+lbuf_destroy
+lbuf_init
+lbuf_print
+lock_file
+parse_gid_list
+sudo_asprintf
+sudo_clock_gettime
+sudo_closefrom
+sudo_conf_askpass_path
+sudo_conf_debug_flags
+sudo_conf_disable_coredump
+sudo_conf_group_source
+sudo_conf_max_groups
+sudo_conf_noexec_path
+sudo_conf_plugin_dir_path
+sudo_conf_plugins
+sudo_conf_probe_interfaces
+sudo_conf_read
+sudo_conf_sesh_path
+sudo_debug_enter
+sudo_debug_execve2
+sudo_debug_exit
+sudo_debug_exit_bool
+sudo_debug_exit_int
+sudo_debug_exit_long
+sudo_debug_exit_ptr
+sudo_debug_exit_size_t
+sudo_debug_exit_str
+sudo_debug_exit_str_masked
+sudo_debug_fd_get
+sudo_debug_fd_set
+sudo_debug_fork
+sudo_debug_init
+sudo_debug_printf2
+sudo_debug_printf_nvm
+sudo_debug_vprintf2
+sudo_debug_write
+sudo_debug_write2
+sudo_dso_findsym
+sudo_dso_load
+sudo_dso_preload_table
+sudo_dso_strerror
+sudo_dso_unload
+sudo_ev_add
+sudo_ev_alloc
+sudo_ev_base_alloc
+sudo_ev_base_free
+sudo_ev_del
+sudo_ev_free
+sudo_ev_get_timeleft
+sudo_ev_got_break
+sudo_ev_got_exit
+sudo_ev_loop
+sudo_ev_loopbreak
+sudo_ev_loopcontinue
+sudo_ev_loopexit
+sudo_fnmatch
+sudo_freeaddrinfo
+sudo_futimes
+sudo_gai_strerror
+sudo_getaddrinfo
+sudo_getcwd
+sudo_getgrouplist
+sudo_getline
+sudo_getopt_long
+sudo_getopt_long_only
+sudo_glob
+sudo_globfree
+sudo_inet_pton
+sudo_memrchr
+sudo_memset_s
+sudo_mkdtemp
+sudo_mkstemps
+sudo_parseln
+sudo_printf
+sudo_pw_dup
+sudo_secure_dir
+sudo_secure_file
+sudo_setgroups
+sudo_sig2str
+sudo_snprintf
+sudo_strlcat
+sudo_strlcpy
+sudo_strsignal
+sudo_strtonum
+sudo_utimes
+sudo_vasprintf
+sudo_vsnprintf
+term_cbreak
+term_copy
+term_erase
+term_kill
+term_noecho
+term_raw
+term_restore
+touch
+vfatal_nodebug
+vfatalx_nodebug
+vwarning_nodebug
+vwarningx_nodebug
+warning_gettext
+warning_nodebug
+warningx_nodebug
diff --git a/plugins/group_file/Makefile.in b/plugins/group_file/Makefile.in
index 1b11bbdec6..bceb0f23ab 100644
--- a/plugins/group_file/Makefile.in
+++ b/plugins/group_file/Makefile.in
@@ -29,9 +29,11 @@ cross_compiling = @CROSS_COMPILING@
 # Compiler & tools to use
 CC = @CC@
 LIBTOOL = @LIBTOOL@ @LT_STATIC@
+SED = @SED@
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Libraries
 LT_LIBS = $(top_builddir)/lib/util/libsudo_util.la
@@ -76,6 +78,10 @@ shlib_exp = $(srcdir)/group_file.exp
 shlib_map = group_file.map
 shlib_opt = group_file.opt
 
+# User and group ids the installed files should be "owned" by
+install_uid = 0
+install_gid = 0
+
 # OS dependent defines
 DEFS = @OSDEFS@
 
@@ -103,7 +109,7 @@ $(shlib_map): $(shlib_exp)
 	@awk 'BEGIN { print "{\n\tglobal:" } { print "\t\t"$$0";" } END { print "\tlocal:\n\t\t*;\n};" }' $(shlib_exp) > $@
 
 $(shlib_opt): $(shlib_exp)
-	@sed 's/^/+e /' $(shlib_exp) > $@
+	@$(SED) 's/^/+e /' $(shlib_exp) > $@
 
 group_file.la: $(OBJS) $(LT_LIBS) @LT_LDDEP@
 	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) -o $@ $(OBJS) $(LIBS) -module -avoid-version -rpath $(plugindir)
@@ -123,7 +129,7 @@ install-doc:
 
 install-plugin: install-dirs group_file.la
 	if [ X"$(soext)" != X"" ]; then \
-	    $(INSTALL) -b~ -m $(shlib_mode) .libs/group_file$(soext) $(DESTDIR)$(plugindir)/group_file.so; \
+	    $(INSTALL) -b~ $(INSTALL_OWNER) -m $(shlib_mode) .libs/group_file$(soext) $(DESTDIR)$(plugindir)/group_file.so; \
 	fi
 
 uninstall:
diff --git a/plugins/sample/Makefile.in b/plugins/sample/Makefile.in
index d0872221b8..c289857936 100644
--- a/plugins/sample/Makefile.in
+++ b/plugins/sample/Makefile.in
@@ -29,9 +29,11 @@ cross_compiling = @CROSS_COMPILING@
 # Compiler & tools to use
 CC = @CC@
 LIBTOOL = @LIBTOOL@ @LT_STATIC@
+SED = @SED@
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Libraries
 LIBS = $(top_builddir)/lib/util/libsudo_util.la
@@ -75,6 +77,10 @@ shlib_exp = $(srcdir)/sample_plugin.exp
 shlib_map = sample_plugin.map
 shlib_opt = sample_plugin.opt
 
+# User and group ids the installed files should be "owned" by
+install_uid = 0
+install_gid = 0
+
 # OS dependent defines
 DEFS = @OSDEFS@
 
@@ -102,7 +108,7 @@ $(shlib_map): $(shlib_exp)
 	@awk 'BEGIN { print "{\n\tglobal:" } { print "\t\t"$$0";" } END { print "\tlocal:\n\t\t*;\n};" }' $(shlib_exp) > $@
 
 $(shlib_opt): $(shlib_exp)
-	@sed 's/^/+e /' $(shlib_exp) > $@
+	@$(SED) 's/^/+e /' $(shlib_exp) > $@
 
 sample_plugin.la: $(OBJS) @LT_LDDEP@
 	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) -o $@ $(OBJS) $(LIBS) -module -avoid-version -rpath $(plugindir)
@@ -122,7 +128,7 @@ install-doc:
 
 install-plugin: install-dirs sample_plugin.la
 	if [ X"$(soext)" != X"" ]; then \
-	    $(INSTALL) -b~ -m $(shlib_mode) .libs/sample_plugin$(soext) $(DESTDIR)$(plugindir)/sample_plugin.so; \
+	    $(INSTALL) -b~ $(INSTALL_OWNER) -m $(shlib_mode) .libs/sample_plugin$(soext) $(DESTDIR)$(plugindir)/sample_plugin.so; \
 	fi
 
 uninstall:
diff --git a/plugins/sudoers/Makefile.in b/plugins/sudoers/Makefile.in
index e66cfca038..d2b552d381 100644
--- a/plugins/sudoers/Makefile.in
+++ b/plugins/sudoers/Makefile.in
@@ -41,19 +41,21 @@ CC = @CC@
 LIBTOOL = @LIBTOOL@
 FLEX = @FLEX@
 YACC = @YACC@
+SED = @SED@
 PERL = perl
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Libraries
 LT_LIBS = $(top_builddir)/lib/util/libsudo_util.la
 LIBS = $(LT_LIBS) @LIBINTL@
 NET_LIBS = @NET_LIBS@
-SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS) @ZLIB@ @LIBMD@ @LIBDL@
+SUDOERS_LIBS = @SUDOERS_LIBS@ @AFS_LIBS@ @GETGROUPS_LIB@ $(LIBS) $(NET_LIBS) @ZLIB@ @LIBMD@
 REPLAY_LIBS = @REPLAY_LIBS@ @ZLIB@
 VISUDO_LIBS = $(NET_LIBS) @LIBMD@
-TESTSUDOERS_LIBS = $(NET_LIBS) @LIBMD@ @LIBDL@
+TESTSUDOERS_LIBS = $(NET_LIBS) @LIBMD@
 
 # C preprocessor flags
 CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(devdir) -I$(srcdir) -I$(top_srcdir) -DLIBDIR=\"$(libdir)\" @CPPFLAGS@
@@ -155,7 +157,7 @@ CHECK_ADDR_OBJS = check_addr.o interfaces.o locale.o match_addr.o
 
 CHECK_BASE64_OBJS = check_base64.o base64.o locale.o
 
-CHECK_DIGEST_OBJS = check_digest.o
+CHECK_DIGEST_OBJS = check_digest.o locale.o
 
 CHECK_FILL_OBJS = check_fill.o hexchar.o locale.o toke_util.o
 
@@ -183,7 +185,7 @@ $(shlib_map): $(shlib_exp)
 	@awk 'BEGIN { print "{\n\tglobal:" } { print "\t\t"$$0";" } END { print "\tlocal:\n\t\t*;\n};" }' $(shlib_exp) > $@
 
 $(shlib_opt): $(shlib_exp)
-	@sed 's/^/+e /' $(shlib_exp) > $@
+	@$(SED) 's/^/+e /' $(shlib_exp) > $@
 
 # Prevent default rules from building .c files from .l and .y files
 .l.c:
@@ -200,37 +202,37 @@ sudoers.la: $(SUDOERS_OBJS) $(LT_LIBS) libparsesudoers.la @LT_LDDEP@
 	$(LIBTOOL) @LT_STATIC@ --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) -o $@ $(SUDOERS_OBJS) libparsesudoers.la $(SUDOERS_LIBS) -module -avoid-version -rpath $(plugindir)
 
 visudo: libparsesudoers.la $(VISUDO_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(VISUDO_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) libparsesudoers.la $(LIBS) $(VISUDO_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(VISUDO_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) libparsesudoers.la $(LIBS) $(VISUDO_LIBS) -no-fast-install
 
 sudoreplay: timestr.lo $(REPLAY_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(REPLAY_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) timestr.lo $(LIBS) $(REPLAY_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(REPLAY_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) timestr.lo $(LIBS) $(REPLAY_LIBS) -no-fast-install
 
 testsudoers: libparsesudoers.la $(TEST_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(TEST_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) libparsesudoers.la $(LIBS) $(TESTSUDOERS_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(TEST_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) libparsesudoers.la $(LIBS) $(TESTSUDOERS_LIBS) -no-fast-install
 
 check_addr: $(CHECK_ADDR_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_ADDR_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) $(NET_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_ADDR_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) $(NET_LIBS) -no-fast-install
 
 check_base64: $(CHECK_BASE64_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_BASE64_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_BASE64_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) -no-fast-install
 
 check_digest: $(CHECK_DIGEST_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_DIGEST_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) @LIBMD@
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_DIGEST_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) @LIBMD@ -no-fast-install
 
 check_fill: $(CHECK_FILL_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_FILL_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_FILL_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) -no-fast-install
 
 check_iolog_path: $(CHECK_IOLOG_PATH_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_IOLOG_PATH_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_IOLOG_PATH_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) -no-fast-install
 
 # We need to link check_symbols with -lpthread on HP-UX since LDAP uses threads
 check_symbols: $(CHECK_SYMBOLS_OBJS) $(LT_LIBS)
 	if [ X"$(soext)" != X"" ]; then \
-	    $(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_SYMBOLS_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) @SUDO_LIBS@ @LIBDL@; \
+	    $(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_SYMBOLS_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) @SUDO_LIBS@ -no-fast-install; \
 	fi
 
 check_wrap: $(CHECK_WRAP_OBJS) $(LT_LIBS)
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_WRAP_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_WRAP_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) -no-fast-install
 
 GENERATED = gram.h gram.c toke.c def_data.c def_data.h getdate.c
 
@@ -241,7 +243,7 @@ $(devdir)/gram.c $(devdir)/gram.h: $(srcdir)/gram.y
 	    else \
 		gram_y="$(srcdir)/gram.y"; \
 	    fi; \
-	    cmd='$(YACC) -d -p sudoers '"$$gram_y"'; echo "#include <config.h>" > $(devdir)/gram.c; sed "s/^\\(#line .*\\) \"y\\.tab\\.c\"/\1 \"gram.c\"/" y.tab.c >> $(devdir)/gram.c; rm -f y.tab.c; mv -f y.tab.h $(devdir)/gram.h'; \
+	    cmd='$(YACC) -d -p sudoers '"$$gram_y"'; echo "#include <config.h>" > $(devdir)/gram.c; $(SED) "s/^\\(#line .*\\) \"y\\.tab\\.c\"/\1 \"gram.c\"/" y.tab.c >> $(devdir)/gram.c; rm -f y.tab.c; mv -f y.tab.h $(devdir)/gram.h'; \
 	    echo "$$cmd"; eval $$cmd; \
 	fi
 
@@ -264,7 +266,7 @@ $(devdir)/getdate.c: $(srcdir)/getdate.y
 	    else \
 		getdate_y="$(srcdir)/getdate.y"; \
 	    fi; \
-	    cmd='$(YACC) '"$$getdate_y"'; echo "#include <config.h>" > $(devdir)/getdate.c; sed "s/^\\(#line .*\\) \"y\\.tab\\.c\"/\1 \"getdate.c\"/" y.tab.c >> $(devdir)/getdate.c; rm -f y.tab.c'; \
+	    cmd='$(YACC) '"$$getdate_y"'; echo "#include <config.h>" > $(devdir)/getdate.c; $(SED) "s/^\\(#line .*\\) \"y\\.tab\\.c\"/\1 \"getdate.c\"/" y.tab.c >> $(devdir)/getdate.c; rm -f y.tab.c'; \
 	    echo "$$cmd"; eval $$cmd; \
 	fi
 
@@ -289,33 +291,31 @@ install-dirs:
 	$(SHELL) $(top_srcdir)/mkinstalldirs $(DESTDIR)$(plugindir) \
 	    $(DESTDIR)$(visudodir) $(DESTDIR)$(replaydir) \
 	    $(DESTDIR)$(sudoersdir) $(DESTDIR)$(docdir) \
-	    `echo $(DESTDIR)$(rundir)|sed 's,/[^/]*$$,,'` \
-	    `echo $(DESTDIR)$(vardir)|sed 's,/[^/]*$$,,'`
-	$(INSTALL) -d -O $(install_uid) -G $(install_gid) -m 0711 $(DESTDIR)$(rundir)
-	$(INSTALL) -d -O $(install_uid) -G $(install_gid) -m 0711 $(DESTDIR)$(vardir)
+	    `echo $(DESTDIR)$(rundir)|$(SED) 's,/[^/]*$$,,'` \
+	    `echo $(DESTDIR)$(vardir)|$(SED) 's,/[^/]*$$,,'`
+	$(INSTALL) -d $(INSTALL_OWNER) -m 0711 $(DESTDIR)$(rundir)
+	$(INSTALL) -d $(INSTALL_OWNER) -m 0711 $(DESTDIR)$(vardir)
 
 install-binaries: visudo sudoreplay install-dirs
-	$(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -m 0755 sudoreplay $(DESTDIR)$(replaydir)/sudoreplay
-	$(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -m 0755 visudo $(DESTDIR)$(visudodir)/visudo
+	INSTALL_BACKUP='~' $(LIBTOOL) --mode=install $(INSTALL) $(INSTALL_OWNER) -m 0755 sudoreplay $(DESTDIR)$(replaydir)/sudoreplay
+	INSTALL_BACKUP='~' $(LIBTOOL) --mode=install $(INSTALL) $(INSTALL_OWNER) -m 0755 visudo $(DESTDIR)$(visudodir)/visudo
 
 install-includes:
 
 install-doc: install-dirs
-	@LDAP@$(INSTALL) -O $(install_uid) -G $(install_gid) -m 0755 $(srcdir)/sudoers2ldif $(DESTDIR)$(docdir)
+	@LDAP@$(INSTALL) $(INSTALL_OWNER) -m 0755 $(srcdir)/sudoers2ldif $(DESTDIR)$(docdir)
 
 install-plugin: sudoers.la install-dirs
 	if [ X"$(soext)" != X"" -a -e .libs/sudoers$(soext) ]; then \
 	    test X"$$SUDO_PREINSTALL_CMD" != X"" && \
 		$$SUDO_PREINSTALL_CMD .libs/sudoers$(soext); \
-	    $(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -m $(shlib_mode) .libs/sudoers$(soext) $(DESTDIR)$(plugindir)/sudoers.so; \
+	    INSTALL_BACKUP='~' $(INSTALL) $(INSTALL_OWNER) -m $(shlib_mode) .libs/sudoers$(soext) $(DESTDIR)$(plugindir)/sudoers.so; \
 	fi
 
 install-sudoers: install-dirs
-	$(INSTALL) -d -O $(sudoers_uid) -G $(sudoers_gid) -m 0750 \
-	    $(DESTDIR)$(sudoersdir)/sudoers.d
+	$(INSTALL) -d $(INSTALL_OWNER) -m 0750 $(DESTDIR)$(sudoersdir)/sudoers.d
 	test -r $(DESTDIR)$(sudoersdir)/sudoers || \
-	    $(INSTALL) -O $(sudoers_uid) -G $(sudoers_gid) -m $(sudoers_mode) \
-		sudoers $(DESTDIR)$(sudoersdir)/sudoers
+	    $(INSTALL) $(INSTALL_OWNER) -m $(sudoers_mode) sudoers $(DESTDIR)$(sudoersdir)/sudoers
 
 uninstall:
 	-rm -f $(DESTDIR)$(plugindir)/sudoers.so
diff --git a/plugins/sudoers/match.c b/plugins/sudoers/match.c
index eb7cedabf4..7aab375651 100644
--- a/plugins/sudoers/match.c
+++ b/plugins/sudoers/match.c
@@ -48,11 +48,6 @@
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif /* HAVE_UNISTD_H */
-#ifdef HAVE_FNMATCH
-# include <fnmatch.h>
-#else
-# include "compat/fnmatch.h"
-#endif /* HAVE_FNMATCH */
 #ifndef SUDOERS_NAME_MATCH
 # ifdef HAVE_GLOB
 #  include <glob.h>
@@ -81,11 +76,6 @@
 #  include <ndir.h>
 # endif
 #endif
-#ifdef HAVE_SHA224UPDATE
-# include <sha2.h>
-#else
-# include "compat/sha2.h"
-#endif
 #include <pwd.h>
 #include <grp.h>
 #include <errno.h>
@@ -94,6 +84,17 @@
 #include "parse.h"
 #include <gram.h>
 
+#ifdef HAVE_FNMATCH
+# include <fnmatch.h>
+#else
+# include "compat/fnmatch.h"
+#endif /* HAVE_FNMATCH */
+#ifdef HAVE_SHA224UPDATE
+# include <sha2.h>
+#else
+# include "compat/sha2.h"
+#endif
+
 static struct member_list empty = TAILQ_HEAD_INITIALIZER(empty);
 
 static bool command_matches_dir(const char *sudoers_dir, size_t dlen);
diff --git a/plugins/sudoers/regress/parser/check_digest.c b/plugins/sudoers/regress/parser/check_digest.c
index 3bcf359033..367e2f9627 100644
--- a/plugins/sudoers/regress/parser/check_digest.c
+++ b/plugins/sudoers/regress/parser/check_digest.c
@@ -39,14 +39,15 @@
 #elif defined(HAVE_INTTYPES_H)
 # include <inttypes.h>
 #endif
+
+#include "missing.h"
+
 #ifdef HAVE_SHA224UPDATE
 # include <sha2.h>
 #else
 # include "compat/sha2.h"
 #endif
 
-#include "missing.h"
-
 __dso_public int main(int argc, char *argv[]);
 
 static struct digest_function {
diff --git a/plugins/sudoers/sudoers.c b/plugins/sudoers/sudoers.c
index e27d691c84..94f74ee21f 100644
--- a/plugins/sudoers/sudoers.c
+++ b/plugins/sudoers/sudoers.c
@@ -70,14 +70,15 @@
 # include <selinux/selinux.h>
 #endif
 #include <ctype.h>
-#ifndef HAVE_GETADDRINFO
-# include "compat/getaddrinfo.h"
-#endif
 
 #include "sudoers.h"
 #include "auth/sudo_auth.h"
 #include "secure_path.h"
 
+#ifndef HAVE_GETADDRINFO
+# include "compat/getaddrinfo.h"
+#endif
+
 /*
  * Prototypes
  */
diff --git a/plugins/sudoers/sudoreplay.c b/plugins/sudoers/sudoreplay.c
index de4cb76717..1e7dc22d09 100644
--- a/plugins/sudoers/sudoreplay.c
+++ b/plugins/sudoers/sudoreplay.c
@@ -81,11 +81,6 @@
 #else
 # include "compat/stdbool.h"
 #endif /* HAVE_STDBOOL_H */
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
 
 #include <pathnames.h>
 
@@ -103,6 +98,12 @@
 #include "sudo_event.h"
 #include "sudo_util.h"
 
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
+
 #ifndef LINE_MAX
 # define LINE_MAX 2048
 #endif
diff --git a/plugins/sudoers/testsudoers.c b/plugins/sudoers/testsudoers.c
index 9307f161fc..eeb7bed905 100644
--- a/plugins/sudoers/testsudoers.c
+++ b/plugins/sudoers/testsudoers.c
@@ -46,11 +46,6 @@
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif /* HAVE_UNISTD_H */
-#ifdef HAVE_FNMATCH
-# include <fnmatch.h>
-#else
-# include "compat/fnmatch.h"
-#endif /* HAVE_FNMATCH */
 #ifdef HAVE_NETGROUP_H
 # include <netgroup.h>
 #endif /* HAVE_NETGROUP_H */
@@ -67,6 +62,12 @@
 #include "secure_path.h"
 #include <gram.h>
 
+#ifdef HAVE_FNMATCH
+# include <fnmatch.h>
+#else
+# include "compat/fnmatch.h"
+#endif /* HAVE_FNMATCH */
+
 /*
  * Function Prototypes
  */
diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index 62ef6b5b44..583d53dc91 100644
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -1997,11 +1997,6 @@ char *yytext;
 #  include <ndir.h>
 # endif
 #endif
-#ifdef HAVE_SHA224UPDATE
-# include <sha2.h>
-#else
-# include "compat/sha2.h"
-#endif
 #include <errno.h>
 #include <ctype.h>
 #include "sudoers.h"
@@ -2011,6 +2006,12 @@ char *yytext;
 #include "lbuf.h"
 #include "secure_path.h"
 
+#ifdef HAVE_SHA224UPDATE
+# include <sha2.h>
+#else
+# include "compat/sha2.h"
+#endif
+
 int sudolineno;			/* current sudoers line number. */
 int last_token;			/* last token that was parsed. */
 char *sudoers;			/* sudoers file being parsed. */
diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index 2c024da182..6dc0423451 100644
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -69,11 +69,6 @@
 #  include <ndir.h>
 # endif
 #endif
-#ifdef HAVE_SHA224UPDATE
-# include <sha2.h>
-#else
-# include "compat/sha2.h"
-#endif
 #include <errno.h>
 #include <ctype.h>
 #include "sudoers.h"
@@ -83,6 +78,12 @@
 #include "lbuf.h"
 #include "secure_path.h"
 
+#ifdef HAVE_SHA224UPDATE
+# include <sha2.h>
+#else
+# include "compat/sha2.h"
+#endif
+
 int sudolineno;			/* current sudoers line number. */
 int last_token;			/* last token that was parsed. */
 char *sudoers;			/* sudoers file being parsed. */
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index 7574435013..eef6615331 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -70,11 +70,6 @@
 #ifdef TIME_WITH_SYS_TIME
 # include <time.h>
 #endif
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
 
 #include "sudoers.h"
 #include "parse.h"
@@ -83,6 +78,12 @@
 #include "sudo_conf.h"
 #include <gram.h>
 
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
+
 struct sudoersfile {
     TAILQ_ENTRY(sudoersfile) entries;
     char *path;
diff --git a/plugins/system_group/Makefile.in b/plugins/system_group/Makefile.in
index cb746dc442..3661735054 100644
--- a/plugins/system_group/Makefile.in
+++ b/plugins/system_group/Makefile.in
@@ -29,9 +29,11 @@ cross_compiling = @CROSS_COMPILING@
 # Compiler & tools to use
 CC = @CC@
 LIBTOOL = @LIBTOOL@ @LT_STATIC@
+SED = @SED@
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Libraries
 LT_LIBS = $(top_builddir)/lib/util/libsudo_util.la
@@ -76,6 +78,10 @@ shlib_exp = $(srcdir)/system_group.exp
 shlib_map = system_group.map
 shlib_opt = system_group.opt
 
+# User and group ids the installed files should be "owned" by
+install_uid = 0
+install_gid = 0
+
 # OS dependent defines
 DEFS = @OSDEFS@
 
@@ -103,7 +109,7 @@ $(shlib_map): $(shlib_exp)
 	@awk 'BEGIN { print "{\n\tglobal:" } { print "\t\t"$$0";" } END { print "\tlocal:\n\t\t*;\n};" }' $(shlib_exp) > $@
 
 $(shlib_opt): $(shlib_exp)
-	@sed 's/^/+e /' $(shlib_exp) > $@
+	@$(SED) 's/^/+e /' $(shlib_exp) > $@
 
 system_group.la: $(OBJS) $(LT_LIBS) @LT_LDDEP@
 	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) -o $@ $(OBJS) $(LIBS) -module -avoid-version -rpath $(plugindir)
@@ -123,7 +129,7 @@ install-doc:
 
 install-plugin: install-dirs system_group.la
 	if [ X"$(soext)" != X"" ]; then \
-	    $(INSTALL) -b~ -m $(shlib_mode) .libs/system_group$(soext) $(DESTDIR)$(plugindir)/system_group.so; \
+	    $(INSTALL) -b~ $(INSTALL_OWNER) -m $(shlib_mode) .libs/system_group$(soext) $(DESTDIR)$(plugindir)/system_group.so; \
 	fi
 
 uninstall:
diff --git a/src/Makefile.in b/src/Makefile.in
index 4c76c7c593..d5b3106010 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -29,13 +29,15 @@ cross_compiling = @CROSS_COMPILING@
 # Compiler & tools to use
 CC = @CC@
 LIBTOOL = @LIBTOOL@ @LT_STATIC@
+SED = @SED@
 
 # Our install program supports extra flags...
 INSTALL = $(SHELL) $(top_srcdir)/install-sh -c
+INSTALL_OWNER = -o $(install_uid) -g $(install_gid)
 
 # Libraries
 LT_LIBS = $(top_builddir)/lib/util/libsudo_util.la
-LIBS = @LIBS@ @SUDO_LIBS@ @GETGROUPS_LIB@ @NET_LIBS@ @LIBINTL@ $(LT_LIBS) @LIBDL@
+LIBS = @LIBS@ @SUDO_LIBS@ @GETGROUPS_LIB@ @NET_LIBS@ @LIBINTL@ $(LT_LIBS)
 
 # C preprocessor flags
 CPPFLAGS = -I$(incdir) -I$(top_builddir) -I. -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@
@@ -136,7 +138,7 @@ sesh: $(SESH_OBJS) @LIBINTL@ $(LT_LIBS)
 	$(LIBTOOL) --mode=link $(CC) -o $@ $(SESH_OBJS) $(LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) @LIBINTL@ $(LIBS)
 
 check_ttyname: $(CHECK_TTYNAME_OBJS) $(top_builddir)/lib/util/libsudo_util.la
-	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_TTYNAME_OBJS) $(TEST_LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LIBS)
+	$(LIBTOOL) --mode=link $(CC) -o $@ $(CHECK_TTYNAME_OBJS) $(TEST_LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(TEST_LIBS) -no-fast-install
 
 pre-install:
 
@@ -149,17 +151,19 @@ install-dirs:
 install-rc:
 	@if [ -n "$(INIT_SCRIPT)" ]; then \
 	    $(SHELL) $(top_srcdir)/mkinstalldirs $(DESTDIR)$(INIT_DIR) \
-		`echo $(DESTDIR)$(RC_LINK)|sed 's,/[^/]*$$,,'`; \
-	    $(INSTALL) -O $(install_uid) -G $(install_gid) -m 0755 $(top_srcdir)/init.d/$(INIT_SCRIPT) $(DESTDIR)$(INIT_DIR)/sudo; \
+		`echo $(DESTDIR)$(RC_LINK) | $(SED) 's,/[^/]*$$,,'`; \
+	    $(INSTALL) $(INSTALL_OWNER) -m 0755 $(top_srcdir)/init.d/$(INIT_SCRIPT) $(DESTDIR)$(INIT_DIR)/sudo; \
 	    rm -f $(DESTDIR)$(RC_LINK); \
 	    ln -s $(INIT_DIR)/sudo $(DESTDIR)$(RC_LINK); \
 	fi
 
 install-binaries: install-dirs $(PROGS)
-	$(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -m 04755 sudo $(DESTDIR)$(bindir)/sudo
+	INSTALL_BACKUP='~' $(LIBTOOL) --mode=install $(INSTALL) $(INSTALL_OWNER) -m 04755 sudo $(DESTDIR)$(bindir)/sudo
 	rm -f $(DESTDIR)$(bindir)/sudoedit
 	ln -s sudo $(DESTDIR)$(bindir)/sudoedit
-	if [ -f sesh ]; then $(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -M 0755 sesh $(DESTDIR)$(libexecdir)/sudo/sesh; fi
+	if [ -f sesh ]; then \
+	    INSTALL_BACKUP='~' $(LIBTOOL) --mode=install $(INSTALL) $(INSTALL_OWNER) -m 0755 sesh $(DESTDIR)$(libexecdir)/sudo/sesh; \
+	fi
 
 install-doc:
 
@@ -168,7 +172,9 @@ install-includes:
 # We install sudo_noexec by hand so we can avoid a "lib" prefix
 # and a version number.  Since we use LD_PRELOAD, neither is needed.
 install-noexec: install-dirs libsudo_noexec.la
-	if [ -f .libs/libsudo_noexec$(shlib_ext) ]; then $(INSTALL) -b~ -O $(install_uid) -G $(install_gid) -m $(shlib_mode) .libs/libsudo_noexec$(shlib_ext) $(DESTDIR)$(noexecdir)/$(noexecfile); fi
+	if [ -f .libs/libsudo_noexec$(shlib_ext) ]; then \
+	    INSTALL_BACKUP='~' $(INSTALL) $(INSTALL_OWNER) -m $(shlib_mode) .libs/libsudo_noexec$(shlib_ext) $(DESTDIR)$(noexecdir)/$(noexecfile); \
+	fi
 
 install-plugin:
 
diff --git a/src/parse_args.c b/src/parse_args.c
index 6363da8f86..afa3a157c5 100644
--- a/src/parse_args.c
+++ b/src/parse_args.c
@@ -40,11 +40,6 @@
 #ifdef HAVE_UNISTD_H
 # include <unistd.h>
 #endif /* HAVE_UNISTD_H */
-#ifdef HAVE_GETOPT_LONG
-# include <getopt.h>
-# else
-# include "compat/getopt.h"
-#endif /* HAVE_GETOPT_LONG */
 #include <ctype.h>
 #include <grp.h>
 #include <pwd.h>
@@ -53,6 +48,12 @@
 #include "sudo.h"
 #include "lbuf.h"
 
+#ifdef HAVE_GETOPT_LONG
+# include <getopt.h>
+# else
+# include "compat/getopt.h"
+#endif /* HAVE_GETOPT_LONG */
+
 int tgetpass_flags;
 
 /*
diff --git a/src/preload.c b/src/preload.c
index 7d434d9d56..656e5bf3a8 100644
--- a/src/preload.c
+++ b/src/preload.c
@@ -28,6 +28,7 @@
 #endif
 
 #include "sudo_plugin.h"
+#include "missing.h"
 #include "sudo_dso.h"
 
 #ifdef STATIC_SUDOERS_PLUGIN