X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=authbind.git;a=blobdiff_plain;f=authbind.1;h=d73e998990a92e6139d5c2ef6165f7aaac8e0569;hp=2cc5a7580760e953f252978c2bb0524bc899d180;hb=7ad50c1428c0a3585e977bb354b7569347d21615;hpb=c53d1583f0458572cbb113a33de9bc9280dd2817

diff --git a/authbind.1 b/authbind.1
index 2cc5a75..d73e998 100644
--- a/authbind.1
+++ b/authbind.1
@@ -104,16 +104,6 @@ each 16-byte chunk expressed in the minimal nonzero number
 of hex digits (i.e. with leading zeroes removed), the chunks
 being separated by colons as is conventional.
 .PP
-So for example an attempt to bind to [2620:106:e002:f00f::21]:80
-would result in authbind calling
-.I access(2)
-on
-.B /etc/authbind/byport/80
-and then
-.B /etc/authbind/byaddr/2620:106:e002:f00f::21,80
-and then
-.BR /etc/authbind/byaddr/2620:106:e002:f00f:0:0:0:21,80 .
-.PP
 Fourthly, if the question is still unresolved, the file
 .BI /etc/authbind/byuid/ uid
 will be opened and read.  If the file does not exist then the binding
@@ -156,21 +146,47 @@ cannot be accessed, then not only will
 fail, but an error message will be printed to stderr.  Unrecognised
 lines in
 .BI /etc/authbind/byuid/ uid
-files are silently ignored (as are lines whose
+files are silently ignored, as are lines whose
 .I addr
 has non-zero bits more than
 .I length
-from the top) or where some
+from the top or where some
 .I min
 is larger than
 .IR max .
-.PP
+.SH EXAMPLE
+So for example an attempt by uid 432
+to bind to port 80 of address [2620:106:e002:f00f::21]
+would result in authbind calling
+.I access(2)
+on, in order,
+.RS
+.B /etc/authbind/byport/80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f::21,80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f:0:0:0:21,80
+.RE
+If none of these files exist, authbind will read
+.RS
+.B /etc/authbind/byuid/432
+.RE
+and search for a line to permit
+the relevant access; examples of lines which would do so are:
+.RS
+.B 2620:106:e002:f00f::21,80
+.br
+.B ::/0,80
+.RE
+.SH PORTS 512-1023
 Authorising binding to ports from 512 to 1023 inclusive is
 not recommended.  Some protocols (including some versions of NFS)
 authorise clients by seeing that they are using a port number in this
 range.  So by authorising a program to be a server for such a port,
 you are also authorising it to impersonate the whole host for those
-protocols.  To make sure that this isn't done by accident,
+protocols.
+
+To make sure that this isn't done by accident,
 if the port number requested is in the range 512-1023, authbind
 will expect the permission files to have an additional
 .B !