Weekly Edition
Return to the Kernel page
| |||||||||||||
ICMP sockets
The Openwall Linux developers have an interesting problem: they have
managed to create a distribution which is entirely free of setuid-root binaries,
with one exception: ping still needs to be setuid root to be able
to send ICMP echo packets. That seems a little untidy, so the project put
together a patch which allows ping
to run as an unprivileged user. It implements a new type of socket
protocol (IPPROTO_ICMP) which, despite its name, is not usable for
ICMP communications in general. The only type of message which is allowed
through is ICMP_ECHO (and the associated replies).
Interestingly, this patch has been trimmed down from the version which is applied to Openwall kernels. In the full version, the ability to create ICMP sockets is restricted to a specific group, which can be set by way of a sysctl knob. The ping binary is then installed setgid. In this way, full access to ICMP sockets is not given to unprivileged users, while ping only gets enough privilege to create such sockets. The group check was removed from the posted patch to make acceptance easier, but it seems likely to be added back before the next posting. For more information about the thinking behind this design, see this message from Solar Designer. (Log in to post comments)
ICMP sockets Posted Dec 25, 2010 4:29 UTC (Sat) by brouhaha (subscriber, #1698) [Link] If it can't be used for anything but ping, by design, then why not call it a ping socket? "ICMP socket" is clearly a misnomer.
ICMP sockets Posted Dec 27, 2010 14:05 UTC (Mon) by Kwi (subscriber, #59584) [Link]
The interface permits any ICMP message, but the implementation restricts messages to ICMP ECHO for security reasons.
If, at some point, other ICMP messages are deemed safe for use by non-privileged users, they can be enabled in the implementation, without changing the interface.
ICMP sockets Posted Jul 22, 2011 6:48 UTC (Fri) by arekm (subscriber, #4846) [Link]
Are there patches for iputils ping, mtr that use this feature in backward compatible way?
|
|||||||||||||