Comment # 10 on bug 1190552 from Christian Boltz

(In reply to Cristian Rodr���guez from comment #9)
> "file" does use use socket() .. if it did.. there is a seccomp filter
> dissallowing anything but AF_UNIX.
> 
> less doesn't use it either.

Thanks, good to know.

> What the hell is going on.. don't have time to dig further right now. need a
> trace of the program..  

Further upstream discussion brought up an interesting idea - NFS. The lessopen
profile already allows "network inet{,6} stream" for NFS over TCP, but maybe
Werner uses NFS over UDP?

Werner, does the file you tried to access live on NFS?
If yes, does less/lessopen.sh work for files on your local disk?


> and whatis lport in the audit log also? wasn't able
> to find the meaning on the web.. it is logging port? low port?

lport means local port (aka source port)