Bug 408927

Summary:	net-misc/iputils: set caps instead of suids
Product:	Gentoo Linux	Reporter:	Alessandro Di Federico <ale>
Component:	New packages	Assignee:	Gentoo's Team for Core System packages <base-system>
Status:	RESOLVED DUPLICATE
Severity:	enhancement
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Alessandro Di Federico 2012-03-19 23:12:09 UTC

Hi, why ping, ping6 and traceroute6 need the suid bit? Couldn't they simply have set the CAP_NET_RAW capability through the extended attributes?

setcap "cap_net_raw=ep" /bin/ping

I've tested that and seems to work fine.
This is Gentoo, so it would be possible to make some kind of install-time feature-detection to see if extended attributes are enabled and supported by the file system. Or maybe it would be nice to have a nosuid USE flag.

The main reason I don't like to have the suid bit active on /bin/ping is that allows users to escape `iptables -m owner` matching, as the user appears as root.

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2012-03-20 15:07:16 UTC

(In reply to comment #0)
> Hi, why ping, ping6 and traceroute6 need the suid bit? Couldn't they simply
> have set the CAP_NET_RAW capability through the extended attributes?

Not everyone out there uses xattr.

Comment 2 SpanKY gentoo-dev

2013-01-25 04:22:37 UTC


*** This bug has been marked as a duplicate of bug 359937 ***