[rpcbind PATCH 4/6] rpcbind: restrict RPCBPROC_GETSTAT to loopback callers

[Scott Mayhew <smayhew@redhat.com>]

There's no reason to allow remote machines to query the local machine's
rpcbind statistics.

Signed-off-by: Scott Mayhew <smayhew@redhat.com>
---
 src/security.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security.c b/src/security.c
index 6bd22fd..3b55151 100644
--- a/src/security.c
+++ b/src/security.c
@@ -87,6 +87,7 @@ check_access(SVCXPRT *xprt, rpcproc_t proc, rpcprog_t prog, unsigned int rpcbver
 	switch (proc) {
 	case RPCBPROC_SET:
 	case RPCBPROC_UNSET:
+	case RPCBPROC_GETSTAT:
 		if (!insecure && !is_loopback(caller)) {
 #ifdef RPCBIND_DEBUG
 			  if (debugging)
@@ -109,7 +110,6 @@ check_access(SVCXPRT *xprt, rpcproc_t proc, rpcprog_t prog, unsigned int rpcbver
 	case RPCBPROC_TADDR2UADDR:
 	case RPCBPROC_GETVERSADDR:
 	case RPCBPROC_GETADDRLIST:
-	case RPCBPROC_GETSTAT:
 	default:
 		break;
 	}
-- 
2.55.0