My Ubuntu Xenial system has /bin/ping as '-rwsr-xr-x' and getcap reports nothing. On the other hand raw(7) says "Only processes with an effective user ID of 0 o

My Ubuntu Xenial system has /bin/ping as '-rwsr-xr-x' and getcap reports nothing. On the other hand raw(7) says "Only processes with an effective user ID of 0 or the CAP_NET_RAW capability are allowed to open raw sockets" so I would expect setuid to not be needed any more. I assume Canonical has a reason for setting it up this way though I've no idea what that reason is. UNIX-derived systems tend to have a habit of requiring root for anything that even remotely might want to be restricted: the example that comes to mind is reserving ports 0-1024 for root, thus requiring that most daemons to start as root instead of an unprivileged user.