[rpcbind PATCH 1/6] rpcbind: only log failures in check_callit() if connection logging is enabled

[Scott Mayhew <smayhew@redhat.com>]

logit() forks a child process to call syslog().  A client can spam
CALLIT/BROADCAST/INDIRECT requests, leading to CPU, scheduler, and PID
pressure.  It's better to only log failures from check_callit() if
rpcbind is running with the '-l' option (connection logging).

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 src/security.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/security.c b/src/security.c
index 38967dd..02651d7 100644
--- a/src/security.c
+++ b/src/security.c
@@ -343,11 +343,13 @@ check_callit(SVCXPRT *xprt, struct r_rmtcall_args *args, int versnum /*__unused*
 	return 1;
 deny:
 #ifdef LIBWRAP
-	logit(deny_severity, sa, args->rmt_proc, args->rmt_prog,
-	    ": indirect call not allowed");
+	if (verboselog)
+		logit(deny_severity, sa, args->rmt_proc, args->rmt_prog,
+		      ": indirect call not allowed");
 #else
-	logit(LOG_AUTH|LOG_WARNING, sa, args->rmt_proc, args->rmt_prog,
-	    ": indirect call not allowed");
+	if (verboselog)
+		logit(LOG_AUTH|LOG_WARNING, sa, args->rmt_proc, args->rmt_prog,
+		      ": indirect call not allowed");
 #endif
 	return 0;
 }
-- 
2.55.0