The format value has to be a string literal, every time.
Otherwise, you are not using these functions correctly. To reinforce this fact, I putrestrict over every non-contrib example of this I could find.
Wheh netgroup_base is set we now do out own netgroup lookups using
LDAP. Previously, LDAP was queried directly to get a list of the
netgroups the user belongs to but other netgroups queries went
through innetgr(3). This makes it possible to use netgroups
in LDAP sudoers on systems that don't have an innetgr() function.
GitHub issue #251.
in a per-nss list of userspecs and defaults instead of using separate
lookup and list functions. This makes it possible to have a single
implementation of the code for sudoers lookup and listing.
This makes it possible to convert from LDAP sudoers to a traditional
sudoers file. Semantic differences between file sudoers and LDAP
sudoers mean that LDIF -> sudoers is not completely equivalent.