17 lines
970 B
Plaintext
17 lines
970 B
Plaintext
10:16:36 leo@group-20 ~ → sudo chmod u-s /bin/ping
|
|
10:18:59 leo@group-20 ~ → ping google.com
|
|
ping: socktype: SOCK_RAW
|
|
ping: socket: Operation not permitted
|
|
ping: => missing cap_net_raw+p capability or setuid?
|
|
10:19:03 leo@group-20 ~ → sudo setcap cap_net_raw+ep /bin/ping
|
|
10:19:48 leo@group-20 ~ → ping google.com
|
|
PING google.com (142.251.20.138) 56(84) bytes of data.
|
|
64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=1 ttl=112 time=10.5 ms
|
|
64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=2 ttl=112 time=9.83 ms
|
|
|
|
The capability is required because ping sends ICMP packets to function.
|
|
It has to create raw network sockets and for that the kernel needs the cap_net_raw capability.
|
|
|
|
The permitted set grants the executable the right to posess this capability.
|
|
The effective set is needed because ping is not programmed to automatically set the effective set on runtime which is needed for the program to open the raw socket immediately.
|