3 ms·
Oh no thats not all... Linux also has had a way to allow non root users to do ping, using `socket(PF_INET, SOCK_DGRAM, IPPROTO_ICMP)`, which would get around th
by justincormack 11y ago
Oh no thats not all... Linux also has had a way to allow non root users to do ping, using `socket(PF_INET, SOCK_DGRAM, IPPROTO_ICMP)`, which would get around the whole suid/capabilities approach to ping. That was the whole reason why it was introduced, and it can just do ICMP not generic raw sockets like CAP_NET_RAW (which lets you spoof any traffic), and avoids suid root binaries. Unfortunately you have to explicitly enable it (and there was at least one security issue in that implementation too), with net.ipv4.ping_group_range (or ipv6).
- cyphar 11y agoI didn't know that. But I guess the reason why it's not just implemented that way by default is so it can be easily ported (even if all kernels supported it, relying on the kernel implementation of ICMP packets might cause inconsistencies you wouldn't see in raw sockets).
- justincormack 11y agoIt is the same interface, and I believe all the implementations are compatible with it, it just filters the types of raw packets you are allowed to create.