Re: [PATCH v2 1/2] man/man2/landlock_add_rule.2: Clarify ephemeral port range

[Alejandro Colomar <alx@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2136 bytes --]

Hi!

> Date: 2026-11-06 22:24:11+0100
> From: Günther Noack <gnoack3000@gmail.com>
>
> On Tue, Nov 03, 2026 at 12:39:31AM +0100, Matthieu Buffet wrote:
> > Clarify that ephemeral port range can differ from system to system, and
> > that an application can choose exactly which ephemeral port will be
> > chosen next (as long as it is within the kernel-wide
> > ip_local_port_range).
> > 
> > Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
> > ---
> >  man/man2/landlock_add_rule.2 | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/man/man2/landlock_add_rule.2 b/man/man2/landlock_add_rule.2
> > index 94bc63068935..253498bfa2cf 100644
> > --- a/man/man2/landlock_add_rule.2
> > +++ b/man/man2/landlock_add_rule.2
> > @@ -109,9 +109,13 @@ is the network port in host endianness.
> >  It should be noted that port 0 passed to
> >  .BR bind (2)
> >  will bind to an available port from the ephemeral port range.
> > -This can be configured in the
> > +The range is configured globally in the
> >  .I /proc/sys/net/ipv4/ip_local_port_range
> > -sysctl (also used for IPv6).
> > +sysctl (also used for IPv6),
> > +and can be further restricted per socket using
> > +.BR setsockopt (2)
> > +with
> > +.BR IP_LOCAL_PORT_RANGE (2const).
> >  .IP
> >  A Landlock rule with port 0
> >  and the
> > 
> > base-commit: c189a6b2e4dd2e74f3b360b24e489e27f4e45bad
> > -- 
> > 2.47.3
> > 
> 
> Reviewed-by: Günther Noack <gnoack3000@gmail.com>
> 
> I think Mickaël's Reviewed-by from [1] should also count since you
> addressed the grammar nit from [2].

Thanks!  I've applied the patch with both Reviewed-by tags.


Have a lovely day!
Alex

> 
> The high level remark from [2] still stands, please don't forget to
> ideally update the kernel documentation in line with these changes, so
> that it uses the same wording on both sides.
> 
> Thanks,
> –Günther
> 
> [1] https://lore.kernel.org/all/20260929.hooQuaaf9An5@digikod.net/
> [2] https://lore.kernel.org/all/20260926.6c13f561a21f@gnoack.org/

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]