3 ms·

Along with the aforementioned IPPROTO_ICMP; you can still use file capabilities(7) instead (or as well, in the case of older kernels): # chmod 0711 /bin/ping #

• geofft 10y ago
  File capabilities are certainly better than setuid, but they still have the same problem of elevating privileges in a potentially-attacker-controlled environment. If setuid ping has a vulnerability that lets you get root, CAP_NET_RAW ping would also have a vulnerability that lets you read all traffic into the machine and spoof packets from privileged ports or existing connections. That's an uncomfortably large amount of access, even if it isn't quite root.