9
3
In the Jessie version for the Raspberry Pi, ping requires the setuid bit to be set. What is the rationale for this?
Old Geezer
Posted 2016-02-05T09:02:19.980
Reputation: 613
Why does ping require the setuid bit?
Answers
15
ping needs to generate and receive ICMP packets, and usually that's done using "raw sockets" – a feature limited to root (cap_net_raw) because it could also be abused to sniff and disrupt other traffic on the system.
Many distributions now just give ping the cap_net_raw privilege (see capabilities(7) and getcap(8) manual pages) instead of full setuid root. This however needs both the kernel and the filesystem to support extended attributes (xattrs), and some "minimal" systems disable those.
Also, recently a special "ICMP" socket type was added that allows sending ICMP Echo messages only, without any additional privileges. The ping command hasn't been updated for it yet though.
user1686
Posted 2016-02-05T09:02:19.980
Reputation: 283 655
i think capabilities(7) doesn't use xattrs. – ggg – 2016-10-16T21:38:39.813
2@ggg: But it does. Try
getfattr --dump --match=.* /sbin/ping. – user1686 – 2016-10-17T07:11:11.637