netdev - connect(2) man page EACCES error (IPv6 usage)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200428113118.GR25745@shell.armlinux.org.uk>
Date:   Tue, 28 Apr 2020 12:31:19 +0100
From:   Russell King - ARM Linux admin <linux@...linux.org.uk>
To:     mtk.manpages@...il.com
Cc:     linux-man@...r.kernel.org, netdev@...r.kernel.org
Subject: connect(2) man page EACCES error (IPv6 usage)

Hi,

While trying to work out a problem being reported in exim's logs,
it has been found that an update to the connect(2) man page is
needed to clear up the Linux kernel behaviour, which has been this
way since at least the dawn of git history.

The current connect(2) page, as per kernel.org, says:

        EACCES For UNIX domain sockets, which are identified by pathname:
               Write permission is denied on the socket file, or search
               permission is denied for one of the directories in the path
               prefix.  (See also path_resolution(7).)

        EACCES, EPERM
               The user tried to connect to a broadcast address without
               having the socket broadcast flag enabled or the connection
               request failed because of a local firewall rule.

EACCES can also be returned from connect(2) due to a remote firewall
rule as well, or due to one of several "destination unreachable" codes
via the IPv6 protocol - please see: the tab_unreach array in
net/ipv6/icmp6.h.  These codes are ADM_PROHIBITED, POLICY_FAIL, and
REJECT_ROUTE.  Whether all these are appropriate for connect(2), I'm
unsure.  However, ADM_PROHIBITED certainly is, and has been the cause
of the issue I've been seeing with exim.

Besides exim, it also appears if you use telnet to an IPv6 address
which elicits an ADM_PROHIBITED destination unreachable response
from some remote router/firewall.

So, it is not true that it's only restricted to local firewall rules.

Thanks.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 10.2Mbps down 587kbps up