4 ms·
Worth noting you don't actually need to be fully root in Linux to do standard pings with your code, there's a couple of different options available at the OS le
by raesene9 11mo ago
Worth noting you don't actually need to be fully root in Linux to do standard pings with your code, there's a couple of different options available at the OS level without needing to modify code.
1. You can just add the capability CAP_NET_RAW to your process, at which point it can ping freely
2. There's a sysctl that allows for unprivileged ping "net.ipv4.ping_group_range" which can be used at the host level to allow different groups to use ICMP ping.
- bouk 11mo agooption 2 is what this blog is about, the example code creates a socket using that method
- vbezhenar 11mo ago> You can just add the capability CAP_NET_RAW to your process, at which point it can ping freely What are consequences of this capability? Seems like restricting this to root was done for a reason?
- raesene9 11mo agoIt lets you send raw sockets, and has some dangers (e.g. packet forgery). It's included in pretty much every container in existence (if you're running as root in the container or have ambient capabilities setup). The goal of the capabilities system was to allow processes and users to gain a small portion of root privileges without giving them all. In the "old days" ping on a Linux host would be setuid root, so it essentially had all of root's rights. In more modern setups it either has CAP_NET_RAW or the ping_group sysctl is used to allow non-root users to use it.
- champtar 11mo agoCAP_NET_RAW also allow to capture packets (tcpdump) so you really can have some fun like running a TCP stack in user space or MITM http connections: https://blog.champtar.fr/IPv6_RA_MITM/ https://blog.champtar.fr/IPv6_RA_MITM/ / https://blog.champtar.fr/Metadata_MITM_root_EKS_GKE/ https://blog.champtar.fr/Metadata_MITM_root_EKS_GKE/
- octoberfranklin 11mo ago> There's a sysctl that allows for unprivileged ping "net.ipv4.ping_group_range" What are the risks of enabling this for all groups (i.e. sysctl net.ipv4.ping_group_range='0 4294967294')? Note this allows unprivileged ICMP sockets, not unprivileged RAW sockets.