Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #168670

Re: make ping executable by normal users?

Cross-posted to 2 groups.

Show all headers | View raw

On Thu, Jun 2, 2016 at 2:33 PM, Santiago Vila <sanvila@unex.es> wrote:
> On Thu, Jun 02, 2016 at 01:56:08PM -0800, Britton Kerin wrote:
>> On my old debian system I could ping as a normal user.  The ping
>> binary had the suid bit set.  Now I get:
>>
>>     $ ping www.google.com
>>     ping: icmp open socket: Operation not permitted
>>     2 $
>>
>> presumably because the bit isn't set.
>>
>> What's the right fix?  I could setuid it but then if I understand
>> correctly it might get changed back by an upgrade.  Does it use
>> capabilites or something?
>
> Yes, it uses capabilities. The simple fix is to do this:
>
> dpkg-reconfigure iputils-ping

Well, that works, thanks.  But I really don't get the overall behavior.
It says this:

     root@debian:/home/bkerin# dpkg-reconfigure iputils-ping
     Setcap worked! Ping(6) is not suid!
     root@debian:/home/bkerin#

And then ping works for non-root users.

How, just by executing dpkg-reconfigure, did I tell it this is what
I wanted?  If that's the default, why wasn't it that way to begin with?

More generally, is it somehow possible to still run debian without
capabilities?  I hate them.  The simple root-or-not security model
is much simpler and doesn't promise more than it can really
deliver.  I'm sad to see capabilities now as the default.

Britton

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

make ping executable by normal users? Britton Kerin <britton.kerin@gmail.com> - 2016-06-03 00:00 +0200
  Re: make ping executable by normal users? Lisi Reisz <lisi.reisz@gmail.com> - 2016-06-03 00:30 +0200
    Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-03 01:20 +0200
  Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-03 01:00 +0200
    Re: make ping executable by normal users? Britton Kerin <britton.kerin@gmail.com> - 2016-06-08 01:00 +0200
      Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-08 02:20 +0200
      Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-08 03:00 +0200
      Re: make ping executable by normal users? Adam Borowski <kilobyte@angband.pl> - 2016-06-08 13:20 +0200
      Re: make ping executable by normal users? Ben Hutchings <ben@decadent.org.uk> - 2016-06-08 15:50 +0200
        Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-08 16:40 +0200
  Re: make ping executable by normal users? Mark Fletcher <mark27q1@gmail.com> - 2016-06-03 04:00 +0200
  Re: make ping executable by normal users? Jan Bakuwel <jan.bakuwel@omiha.com> - 2016-06-06 00:10 +0200
    Re: make ping executable by normal users? Norbert Kiszka <norbert@linux.pl> - 2016-06-06 00:30 +0200
    Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-06 16:20 +0200
      Re: make ping executable by normal users? Mark Fletcher <mark27q1@gmail.com> - 2016-06-06 17:30 +0200
        Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 18:10 +0200
          Re: make ping executable by normal users? Norbert Kiszka <norbert@linux.pl> - 2016-06-06 18:20 +0200
            Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 18:30 +0200
              Re: make ping executable by normal users? Norbert Kiszka <norbert@linux.pl> - 2016-06-06 18:40 +0200
                Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 19:10 +0200
                Re: make ping executable by normal users? Norbert Kiszka <norbert@linux.pl> - 2016-06-06 20:00 +0200
                Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 21:10 +0200
                Re: make ping executable by normal users? Norbert Kiszka <norbert@linux.pl> - 2016-06-06 21:40 +0200
        Re: make ping executable by normal users? Santiago Vila <sanvila@unex.es> - 2016-06-06 18:10 +0200
      Re: make ping executable by normal users? Reco <recoverym4n@gmail.com> - 2016-06-06 17:50 +0200
        Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 18:20 +0200
          Re: make ping executable by normal users? Reco <recoverym4n@gmail.com> - 2016-06-06 18:30 +0200
            Re: make ping executable by normal users? David Wright <deblis@lionunicorn.co.uk> - 2016-06-06 18:40 +0200
              Re: make ping executable by normal users? Reco <recoverym4n@gmail.com> - 2016-06-07 16:00 +0200
                Re: make ping executable by normal users? Nicolas George <george@nsup.org> - 2016-06-07 17:10 +0200

csiph-web