Hi,
While trying to work out a problem being reported in exim's logs,
it has been found that an update to the connect(2) man page is
needed to clear up the Linux kernel behaviour, which has been this
way since at least the dawn of git history.
The current connect(2) page, as per kernel.org, says:
EACCES For UNIX domain sockets, which are identified by pathname:
Write permission is denied on the socket file, or search
permission is denied for one of the directories in the path
prefix. (See also path_resolution(7).)
EACCES, EPERM
The user tried to connect to a broadcast address without
having the socket broadcast flag enabled or the connection
request failed because of a local firewall rule.
EACCES can also be returned from connect(2) due to a remote firewall
rule as well, or due to one of several "destination unreachable" codes
via the IPv6 protocol - please see: the tab_unreach array in
net/ipv6/icmp6.h. These codes are ADM_PROHIBITED, POLICY_FAIL, and
REJECT_ROUTE. Whether all these are appropriate for connect(2), I'm
unsure. However, ADM_PROHIBITED certainly is, and has been the cause
of the issue I've been seeing with exim.
Besides exim, it also appears if you use telnet to an IPv6 address
which elicits an ADM_PROHIBITED destination unreachable response
from some remote router/firewall.
So, it is not true that it's only restricted to local firewall rules.
Thanks.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 10.2Mbps down 587kbps up
