This question already has an answer here:
I'm looking at a handful of files on my system with setuid permission on my system, by running:
sudo find / -perm -4000
I noticed that /bin/ping shows up on the list.
Can anyone explain why ping requires setuid permission?
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
In order for ping to work it needs to be able to create a raw network socket. This is typically a privileged action.
On a modern Linux system this can be granted with "capabilities"
eg on CentOS 7:
$ ls -l /bin/ping
-rwxr-xr-x 1 root root 62088 Nov 7 2016 /bin/ping*
$ getcap /bin/ping
/bin/ping = cap_net_admin,cap_net_raw+p
On Debian 9.1 (Stretch):
$ getcap /bin/ping
/bin/ping = cap_net_raw+ep
Capabilities are a newer way of performing a more fine-grained form of privilege escalation without granting the whole of "root" that's granted with setuid programs.
Without capabilities then ping will need to be setuid root, in order to create the raw network socket.
