#594880 rpcbind loopback test is too strict

Package:
rpcbind
Source:
rpcbind
Description:
converts RPC program numbers into universal addresses
Submitter:
John Hughes
Date:
2013-07-29 22:12:04 UTC
Severity:
important
#594880#5
Date:
2010-08-30 10:54:21 UTC
From:
To:
rpcbind in "secure" mode only allows calls from the loopback address.

The check for this is "addr == loopback && port < reserved".

This is too strict, why the restriction on the port?
#594880#10
Date:
2013-07-28 23:18:08 UTC
From:
To:
Because any normal user can bind to ports > reserved?
So I don't think it's too strict... therefore can we close the bug?


But one thing perhaps,.. shouldn't the test be for <= reserved instead
of just < ?

Cheers,
Chris.
#594880#15
Date:
2013-07-29 22:08:27 UTC
From:
To:
??
       CAP_NET_BIND_SERVICE
              Bind  a socket to Internet domain privileged ports (port numbers
              less than 1024).

Trying out:
$ id
uid=1000

$ nc -l 20000
$ nc -l 400
nc: Permission denied
$ nc -l 50
nc: Permission denied
$ nc -l 512
nc: Permission denied


Cheers,
Chris.