security – How Does Ping Work on Fedora Without setuid and Capabilities

capabilitiesSecuritysetuid

As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities).

From my understanding the trend these last years has been to remove setuid binaries and replaced them with capabilities.

However when I look at the ping binary on my Fedora 32, it doesn't look to have any:

$ ls -la $(which ping)
-rwxr-xr-x. 1 root root 82960 May 18 10:26 /usr/bin/ping
$ sudo getcap -v $(which ping)
/usr/bin/ping
$

Does ping need to open raw socket on fedora? Or is there another way to give it the permission to open a raw socket?

Best Answer

I think https://fedoraproject.org/wiki/Changes/EnableSysctlPingGroupRange answers your question:

Enable the Linux kernel's net.ipv4.ping_group_range parameter to cover all groups. This will let all users on the operating system create ICMP Echo sockets without using setuid binaries, or having the CAP_NET_ADMIN and CAP_NET_RAW file capabilities.

Cross-reference detail

  • Targeted release: Fedora 31
  • Last updated: 2019-08-13
  • Tracker bug: #1740809
  • Release notes tracker: #376

The sysctl documentation writes,

ping_group_range - 2 INTEGERS

Restrict ICMP_PROTO datagram sockets to users in the group range. The default is "1 0", meaning, that nobody (not even root) may create ping sockets. Setting it to "100 100" would grant permissions to the single group. "0 4294967295" would enable it for the world, "100 4294967295" would enable it for the users, but not daemons.

An older code example demonstrates the use of this feature, and in particular shows that a socket is created with the IPPROTO_ICMP flag to identify that it will be used for raw ICMP

int sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)
Related Question