Package: iputils-ping
Version: 3:20121221-5
Tags: patch
I have installed iputils-ping without having setcap, so the /bin/ping*
binaries where suid root
thanks to the warning message, I have installed libcap2-bin and then ran
dpkg-reconfigure on iputils-ping, but even if the setcap was done
correctly, the binaries remain setuid
I have to remove and then reinstall iputils-ping to have /bin/ping*
nosuid and with capabilities
the attached patch should be sufficient for ping, but also the arping,
clockdiff and tracepath postinst files should be modified accordingly
ciao
--- iputils-ping.postinst 2014-02-01 22:16:48.000000000 +0100
+++ iputils-ping.postinst.nosuid 2015-02-15 23:10:10.459548411 +0100
@@ -8,6 +8,7 @@
# bit.
if command -v setcap > /dev/null; then
if setcap cap_net_raw+ep /bin/ping cap_net_raw+ep /bin/ping6; then
+ chmod u-s /bin/ping /bin/ping6
echo "Setcap worked! Ping(6) is not suid!"
else
echo "Setcap failed on /bin/ping, falling back to setuid" >&2
