32 ms·

Ping is actually an excellent candidate for virtualization/containers/SELinux since it has to run as root. A bug in ping could mean a carefully crafted response

Ping is actually an excellent candidate for virtualization/containers/SELinux since it has to run as root. A bug in ping could mean a carefully crafted response could lead to a remote exploit. There are obviously also a number of local exploits that take advantage of setuid binaries like ping: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2851 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2851

justincormack 12y ago
It doesnt have to any more - Linux supports special icmp sockets see https://lwn.net/Articles/420799/ https://lwn.net/Articles/420799/
stock_toaster 12y ago
I think sandboxing (with something like capsicum[1], or maybe seccomp?) would be more appropriate for ping than "containerization". [1]: https://www.freebsd.org/cgi/man.cgi?query=capsicum&sektion=4 https://www.freebsd.org/cgi/man.cgi?query=capsicum&sektion=4