I'm looking at a handful of files on my system with setuid permission on my system, by running:
sudo find / -perm -4000
I noticed that /bin/ping
shows up on the list.
Can anyone explain why ping requires setuid permission?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityI'm looking at a handful of files on my system with setuid permission on my system, by running:
sudo find / -perm -4000
I noticed that /bin/ping
shows up on the list.
Can anyone explain why ping requires setuid permission?
In order for ping
to work it needs to be able to create a raw network socket. This is typically a privileged action.
On a modern Linux system this can be granted with "capabilities"
eg on CentOS 7:
$ ls -l /bin/ping
-rwxr-xr-x 1 root root 62088 Nov 7 2016 /bin/ping*
$ getcap /bin/ping
/bin/ping = cap_net_admin,cap_net_raw+p
On Debian 9.1 (Stretch):
$ getcap /bin/ping
/bin/ping = cap_net_raw+ep
Capabilities are a newer way of performing a more fine-grained form of privilege escalation without granting the whole of "root" that's granted with setuid programs.
Without capabilities then ping
will need to be setuid root, in order to create the raw network socket.