3 ms·

It doesn't need to be fixed. There isn't an issue here. Depending on the OS, ping is either set setuid[1] as root, or more commonly these days, ping is granted

It doesn't need to be fixed. There isn't an issue here. Depending on the OS, ping is either set setuid[1] as root, or more commonly these days, ping is granted a "capability"[2], such as CAP_NET_RAW on Linux. macOS does things a little different[3]. This allows non-root users to run stuff like ping without granting them full root access. You do not need to, nor should you, run the script as root. % ls -l /usr/bin/ping -rwxr-xr-x 1 root root 89768 Apr 8 09:00 /usr/bin/ping % getcap /usr/bin/ping /usr/bin/ping cap_net_raw=ep ~ % whoami jake ~ % id uid=1000(jake) gid=1000(jake) groups=1000(jake),4(adm),24(cdrom) % ping -c 3 8.8.8.8 PING 8.8.8.8 (8.8.8.8): 56 data bytes 64 bytes from 8.8.8.8: icmp_seq=0 ttl=117 time=9.195 ms 64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=8.837 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=117 time=10.998 ms --- 8.8.8.8 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.837/9.677/10.998/0.946 ms Hope that helps. Happy to elaborate on any unclear points. 1. https://unix.stackexchange.com/questions/382771/why-does-ping-need-setuid-permission https://unix.stackexchange.com/questions/382771/why-does-pin... 2. https://unix.stackexchange.com/questions/592911/how-does-ping-work-on-fedora-without-setuid-and-capabilities https://unix.stackexchange.com/questions/592911/how-does-pin... 3. https://apple.stackexchange.com/questions/312857/how-does-macos-allow-standard-users-to-ping https://apple.stackexchange.com/questions/312857/how-does-ma... Edit: updated explanation a bit.

gertlex 2y ago
Further, I'm not sure you can do command injection, as the the `host` variable is treated as a single token in the shell call. `host = "google.com; wget exploit"` won't run `wget exploit`. Happy to learn if there's a more nefarious trick that gets around this, though.
trulyrandom 2y ago
On Linux, "net.ipv4.ping_group_range" is typically used to allow unprivileged users to do ICMP echo requests. Setting the setuid bit or granting a capability are both very old ways of doing this.
- runjake 2y ago
  This is new to me. So, here's what I see on Ubuntu 24.04 LTS: $ sudo sysctl -a | grep net.ipv4.ping net.ipv4.ping_group_range = 1 0 The man page[1] states: ping_group_range (two integers; default: see below; since Linux 2.6.39) Range of the group IDs (minimum and maximum group IDs, inclusive) that are allowed to create ICMP Echo sockets. >>The default is "1 0", which means no group is allowed to create ICMP Echo sockets.<< This would seem to indicate this isn't being used -- at least on Ubuntu? What am I missing? 1. https://www.man7.org/linux/man-pages/man7/icmp.7.html https://www.man7.org/linux/man-pages/man7/icmp.7.html

gertlex 2y ago

Further, I'm not sure you can do command injection, as the the `host` variable is treated as a single token in the shell call. `host = "google.com; wget exploit"` won't run `wget exploit`. Happy to learn if there's a more nefarious trick that gets around this, though.

trulyrandom 2y ago

On Linux, "net.ipv4.ping_group_range" is typically used to allow unprivileged users to do ICMP echo requests. Setting the setuid bit or granting a capability are both very old ways of doing this.

runjake 2y ago
This is new to me. So, here's what I see on Ubuntu 24.04 LTS: $ sudo sysctl -a | grep net.ipv4.ping net.ipv4.ping_group_range = 1 0 The man page[1] states: ping_group_range (two integers; default: see below; since Linux 2.6.39) Range of the group IDs (minimum and maximum group IDs, inclusive) that are allowed to create ICMP Echo sockets. >>The default is "1 0", which means no group is allowed to create ICMP Echo sockets.<< This would seem to indicate this isn't being used -- at least on Ubuntu? What am I missing? 1. https://www.man7.org/linux/man-pages/man7/icmp.7.html https://www.man7.org/linux/man-pages/man7/icmp.7.html