Description of problem:
Most network-listening daemons in Fedora can be instructed to bind to
the loopback interface only. Portmap is an exception. This is a
particular problem on desktop installations where the file alteration
monitor (fam) needs portmap (on servers, one may simply remove portmap
if it isn't needed). FAM seems to be on the path to removal in the
next, or subsequent Fedora Core releases; but until then, I believe
that a modified portmap package should be shipped.

I've created a patch which adds a "-l" switch to portmap, instructing
it to bind 127.0.0.1 only. Also, I have changed the init-script to
look for a /etc/sysconfig/portmap script and honor whatever $OPTIONS
exist there, when starting the daemon; in addition, I have added a
/etc/sysconfig/portmap file consisting of one line: OPTIONS="-l"
This means that portmap will not listen on publicly exposed interfaces
by default, in line with other recent Fedora/Red Hat changes, such as
sendmail's default loopback-only behaviour (and X's ditto?). I know
that portmap access can be restricted, using hosts.allow/hosts.deny,
but that doesn't help much if a security bug is found in the code
initially accepting portmap trafic.

While messing with the portmap package, I also changed the initscript,
such that bug #99308 is closed.

My portmap patch, and other files for the altered portmap package, are
here: http://troels.arvin.dk/portmap-rpm-changes/

The portmap patch has been sent to the upstream project manager
(Wietse Venema).

I've tested the altered portmap package on my laptop, and
FAM-dependent applications seem to work well.

I suggest that an altered portmap package like the one proposed be
included in Fedora Core. If the Fedora Core developers think it's too
drastic not to have portmap listening on all interfaces by default,
then the default behaviour could be changed (although I don't
recommend it).

Version-Release number of selected component (if applicable):
portmap-4.0-59

How reproducible:
Always

Steps to Reproduce:
There is no way to make the current portmap daemon bind to 127.0.0.1
only. (Checked documentation and code.)

Additional info: