netdev - [PATCH net-next-2.6] net: ipv4: add ping_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 14 May 2011 00:22:13 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Andi Kleen <andi@...stfloor.org>
Cc:	Vasiliy Kulikov <segoon@...nwall.com>,
	David Miller <davem@...emloft.net>, solar@...nwall.com,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	peak@...o.troja.mff.cuni.cz, kees.cook@...onical.com,
	dan.j.rosenberg@...il.com, eugene@...hat.com, nelhage@...lice.com,
	kuznet@....inr.ac.ru, pekkas@...core.fi, jmorris@...ei.org,
	yoshfuji@...ux-ipv6.org, kaber@...sh.net, linux-man@...r.kernel.org
Subject: [PATCH net-next-2.6] net: ipv4: add ping_group_range documentation

Le vendredi 13 mai 2011 à 14:30 -0700, Andi Kleen a écrit :
> Vasiliy Kulikov <segoon@...nwall.com> writes:
> 
> > This patch adds IPPROTO_ICMP socket kind.  It makes it possible to send
> > ICMP_ECHO messages and receive the corresponding ICMP_ECHOREPLY messages
> > without any special privileges.  In other words, the patch makes it
> > possible to implement setuid-less and CAP_NET_RAW-less /bin/ping.  In
> > order not to increase the kernel's attack surface, the new functionality
> > is disabled by default, but is enabled at bootup by supporting Linux
> > distributions, optionally with restriction to a group or a group range
> > (see below).
> 
> You'll need to do a manpage patch too. Otherwise noone will know how to use
> it.

Yes probably...

It would be nice to copy part of changelog in 
Documentation/networking/ip-sysctl.txt


socket(2) is restricted to the group range specified in
"/proc/sys/net/ipv4/ping_group_range".  It is "1 0" by default, meaning
that nobody (not even root) may create ping sockets.  Setting it to "100
100" would grant permissions to the single group (to either make
/sbin/ping g+s and owned by this group or to grant permissions to the
"netadmins" group), "0 4294967295" would enable it for the world, "100
4294967295" would enable it for the users, but not daemons.


Too late here, time for sleep...


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html