Re: [PATCH 1/3] man/man2/landlock_add_rule.2: Clarify ephemeral port range

["Günther Noack" <gnoack3000@gmail.com>]

On Thu, Sep 17, 2026 at 09:58:50AM +0200, Matthieu Buffet wrote:
> Clarify that ephemeral port range can differ from system to system, and
> that a compromised application can choose (without any randomness)
> exactly which ephemeral port will be chosen next (as long as it is
> within the kernel-wide ip_local_port_range)
> 
> Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> ---
>  man/man2/landlock_add_rule.2 | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> index fe01a98d99ea..633d89824373 100644
> --- a/man/man2/landlock_add_rule.2
> +++ b/man/man2/landlock_add_rule.2
> @@ -109,9 +109,13 @@ is the network port in host endianness.
>  It should be noted that port 0 passed to
>  .BR bind (2)
>  will bind to an available port from the ephemeral port range.
> -This can be configured in the
> +The range is configured globally in the
>  .I /proc/sys/net/ipv4/ip_local_port_range
> -sysctl (also used for IPv6).
> +sysctl (also used for IPv6),
> +and can be further restricted per-socket using

Grammar nit: I believe this should be "per socket".

> +.BR setsockopt (2)
> +with
> +.BR IP_LOCAL_PORT_RANGE (2const).
>  .IP
>  A Landlock rule with port 0
>  and the
> -- 
> 2.47.3
> 

High level remark: The kernel-side documentation has slightly
different phrasing, saying:

  It should be noted that port 0 passed to bind(2) will bind to an
  available port from the ephemeral port range. This can be configured
  with the /proc/sys/net/ipv4/ip_local_port_range sysctl (also used
  for IPv6), and within that range, on a per-socket basis with
  setsockopt(IP_LOCAL_PORT_RANGE).

But I think your variant is slightly clearer.  Do you plan to update
the kernel-side documentation as well?

Thanks,
–Günther