[PATCH 1/3] man/man2/landlock_add_rule.2: Clarify ephemeral port range

[Matthieu Buffet <matthieu@buffet.re>]

Clarify that ephemeral port range can differ from system to system, and
that a compromised application can choose (without any randomness)
exactly which ephemeral port will be chosen next (as long as it is
within the kernel-wide ip_local_port_range)

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
---
 man/man2/landlock_add_rule.2 | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
index fe01a98d99ea..633d89824373 100644
--- a/man/man2/landlock_add_rule.2
+++ b/man/man2/landlock_add_rule.2
@@ -109,9 +109,13 @@ is the network port in host endianness.
 It should be noted that port 0 passed to
 .BR bind (2)
 will bind to an available port from the ephemeral port range.
-This can be configured in the
+The range is configured globally in the
 .I /proc/sys/net/ipv4/ip_local_port_range
-sysctl (also used for IPv6).
+sysctl (also used for IPv6),
+and can be further restricted per-socket using
+.BR setsockopt (2)
+with
+.BR IP_LOCAL_PORT_RANGE (2const).
 .IP
 A Landlock rule with port 0
 and the
-- 
2.47.3