X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=authbind.git;a=blobdiff_plain;f=authbind.1;h=d73e998990a92e6139d5c2ef6165f7aaac8e0569;hp=74d44d727d9ec00931c4bd6ec1dc601a5b5c5066;hb=64b7841344fcc3cc5208a6ac8ec92c2db1a8802f;hpb=32f41fed121ea4fe4e9171c509691e1b16db13f8

diff --git a/authbind.1 b/authbind.1
index 74d44d7..d73e998 100644
--- a/authbind.1
+++ b/authbind.1
@@ -146,21 +146,47 @@ cannot be accessed, then not only will
 fail, but an error message will be printed to stderr.  Unrecognised
 lines in
 .BI /etc/authbind/byuid/ uid
-files are silently ignored (as are lines whose
+files are silently ignored, as are lines whose
 .I addr
 has non-zero bits more than
 .I length
-from the top) or where some
+from the top or where some
 .I min
 is larger than
 .IR max .
-.PP
+.SH EXAMPLE
+So for example an attempt by uid 432
+to bind to port 80 of address [2620:106:e002:f00f::21]
+would result in authbind calling
+.I access(2)
+on, in order,
+.RS
+.B /etc/authbind/byport/80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f::21,80
+.br
+.B /etc/authbind/byaddr/2620:106:e002:f00f:0:0:0:21,80
+.RE
+If none of these files exist, authbind will read
+.RS
+.B /etc/authbind/byuid/432
+.RE
+and search for a line to permit
+the relevant access; examples of lines which would do so are:
+.RS
+.B 2620:106:e002:f00f::21,80
+.br
+.B ::/0,80
+.RE
+.SH PORTS 512-1023
 Authorising binding to ports from 512 to 1023 inclusive is
 not recommended.  Some protocols (including some versions of NFS)
 authorise clients by seeing that they are using a port number in this
 range.  So by authorising a program to be a server for such a port,
 you are also authorising it to impersonate the whole host for those
-protocols.  To make sure that this isn't done by accident,
+protocols.
+
+To make sure that this isn't done by accident,
 if the port number requested is in the range 512-1023, authbind
 will expect the permission files to have an additional
 .B !