finalise changelog

[authbind.git] / authbind.1

diff --git a/authbind.1 b/authbind.1
index 2cc5a7580760e953f252978c2bb0524bc899d180..d73e998990a92e6139d5c2ef6165f7aaac8e0569 100644 (file)
--- a/authbind.1
+++ b/authbind.1
@@ -104,16 +104,6 @@ each 16-byte chunk expressed in the minimal nonzero number
 of hex digits (i.e. with leading zeroes removed), the chunks
 being separated by colons as is conventional.
 .PP
-So for example an attempt to bind to [2620:106:e002:f00f::21]:80
-would result in authbind calling
-.I access(2)
-on
-.B /etc/authbind/byport/80
-and then
-.B /etc/authbind/byaddr/2620:106:e002:f00f::21,80
-and then
-.BR /etc/authbind/byaddr/2620:106:e002:f00f:0:0:0:21,80 .
-.PP
 Fourthly, if the question is still unresolved, the file
 .BI /etc/authbind/byuid/ uid
 will be opened and read.  If the file does not exist then the binding
@@ -156,21 +146,47 @@ cannot be accessed, then not only will
 fail, but an error message will be printed to stderr.  Unrecognised
 lines in
 .BI /etc/authbind/byuid/ uid
-files are silently ignored (as are lines whose
+files are silently ignored, as are lines whose
 .I addr
 has non-zero bits more than
 .I length
-from the top) or where some
+from the top or where some
 .I min
 is larger than
 .IR max .
-.PP
+.SH EXAMPLE
+So for example an attempt by uid 432
+to bind to port 80 of address [2620:106:e002:f00f::21]
+would result in authbind calling
+.I access(2)
+on, in order,
+.RS
+.B /etc/authbind/byport/80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f::21,80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f:0:0:0:21,80
+.RE
+If none of these files exist, authbind will read
+.RS
+.B /etc/authbind/byuid/432
+.RE
+and search for a line to permit
+the relevant access; examples of lines which would do so are:
+.RS
+.B 2620:106:e002:f00f::21,80
+.br
+.B ::/0,80
+.RE
+.SH PORTS 512-1023
 Authorising binding to ports from 512 to 1023 inclusive is
 not recommended.  Some protocols (including some versions of NFS)
 authorise clients by seeing that they are using a port number in this
 range.  So by authorising a program to be a server for such a port,
 you are also authorising it to impersonate the whole host for those
-protocols.  To make sure that this isn't done by accident,
+protocols.
+
+To make sure that this isn't done by accident,
 if the port number requested is in the range 512-1023, authbind
 will expect the permission files to have an additional
 .B !