Bug 1315335

This is controlled now by net.ipv4.ping_group_range.  Changing that default to allow all gids should work.  However last I checked, our copy of /usr/bin/ping wasn't compiled to even try ping sockets.  So that would also need to change.

See:
http://openwall.info/wiki/people/segoon/ping
https://sturmflut.github.io/linux/ubuntu/2015/01/17/unprivileged-icmp-sockets-on-linux/

As Colin points out, it's a sysctl and therefore can be tuned at runtime.  There's no need to change anything in the kernel to get this to work.

(Note that the sysctl is under the ipv4 directory, but it controls this functionality for both ipv4 and ipv6.)

(In reply to Josh Boyer from comment #2)
> As Colin points out, it's a sysctl and therefore can be tuned at runtime. 
> There's no need to change anything in the kernel to get this to work.

The kernel RPM currently contains the default for the sysctl.  That doesn't mean it has to change there - we could also put an override in systemd or somewhere else.  But regardless of that, there is new API/attack surface being made generally available (as opposed to the current IMO relative obscurity this feature lives under), so having a discussion here in kernel bugzilla would make sense, right?

(In reply to Colin Walters from comment #3)
> (In reply to Josh Boyer from comment #2)
> > As Colin points out, it's a sysctl and therefore can be tuned at runtime. 
> > There's no need to change anything in the kernel to get this to work.
> 
> The kernel RPM currently contains the default for the sysctl. 

Only in the form of whatever default is in the actual source code.  We don't ship configuration files for the sysctls in the kernel RPM.  Those come from individual packages, or systemd, or at one point long ago maybe initscripts.

> mean it has to change there - we could also put an override in systemd or
> somewhere else.  But regardless of that, there is new API/attack surface
> being made generally available (as opposed to the current IMO relative
> obscurity this feature lives under), so having a discussion here in kernel
> bugzilla would make sense, right?

I don't see what there is to discuss though.  The functionality, obscure or not, has been present for IPv4 since 2011 and IPv6 since 2013.  From a kernel perspective, enabling it doesn't change the fact that anyone could have done so for 5 years already.

Switching to iputils to see if they have any comments on this.

Josh do you believe rhel7 has this feature also?

(In reply to Daniel Walsh from comment #6)
> Josh do you believe rhel7 has this feature also?

It should for IPv4 at least.  The rhel7 box I have locally has the sysctl and the commits are old enough that they should be in the upstream 3.10 kernel anyway.

The IPv6 support was added in the upstream 3.11 kernel.  Someone on the RHEL side would need to verify if commit 6d0bfe22611602f36617bc7aa2ffa1bbb2f54c67 was included.

(In reply to Colin Walters from comment #1)
> This is controlled now by net.ipv4.ping_group_range.  Changing that default
> to allow all gids should work.  However last I checked, our copy of
> /usr/bin/ping wasn't compiled to even try ping sockets.  So that would also
> need to change.

I don't know what/when you checked, but if you remove all capabilities from /usr/bin/ping, set net.ipv4.ping_group_range to "0 <something huge>" and try to ping something, it works. At least on my machine, currently Fedora 24.

I also checked rhel7 and it doesn't work there (with rebased iputils). Is it really enabled there?

I think that might be a namespaced sysctl, so we could turn this on via a container by container bases, versus turning it on for the entire machine, once we have docker run --sysctl support.