Why does ping need setuid permission? [duplicate]

Question

I'm looking at a handful of files on my system with setuid permission on my system, by running:

sudo find / -perm -4000

I noticed that /bin/ping shows up on the list.

Can anyone explain why ping requires setuid permission?

Answer 1

In order for ping to work it needs to be able to create a raw network socket. This is typically a privileged action.

On a modern Linux system this can be granted with "capabilities"

eg on CentOS 7:

$ ls -l /bin/ping
-rwxr-xr-x 1 root root 62088 Nov  7  2016 /bin/ping*

$ getcap /bin/ping
/bin/ping = cap_net_admin,cap_net_raw+p

On Debian 9.1 (Stretch):

$ getcap /bin/ping
/bin/ping = cap_net_raw+ep

Capabilities are a newer way of performing a more fine-grained form of privilege escalation without granting the whole of "root" that's granted with setuid programs.

Without capabilities then ping will need to be setuid root, in order to create the raw network socket.