Hey.

In /etc/default/rpcbind there are some examples on how to
restrict rpcbind via options to localhost.

I guess it could be nice to add an example (either in that
file) or maybe in README.Debian or so, on how to do that
the systemd way (especially, since the options will probably
not work, given that rpcbind uses a systemd socket to listen)


IMO the neatest way to do it systemdish is via just overriding
the desired options and taking everything else from the vendor
unit file, which would work like this:

Have a file like:
/etc/systemd/system/rpcbind.socket.d/local.conf
(or maybe localhost-only.conf?)

with content like:
#restrict rpcbind to localhost
[Socket]
ListenStream=
ListenDatagram=
ListenStream=127.0.0.1:111
ListenDatagram=127.0.0.1:111
ListenStream=[::1]:111
ListenDatagram=[::1]:111

Note that the empty ListenStream= and  ListenDatagram= are
important.


Cheers,
Chris.

btw: Would you consider to lock down rpcbind per default
to localhost? It seems to me that NFS still works then,
and most people probably have no need for a rpcbind listening
to the wildcard interface.
Of course such change should then be mentioned in NEWS.Debian
an perhaps the release notes.