Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I use the ping command in a chroot environment?

$ ping 8.8.8.8
ping: icmp open socket: Operation not permitted

Currently I am using CentOs, but ideally there must be a solution that works in all chrooted environments.

share|improve this question

migrated from stackoverflow.com May 16 '11 at 19:45

This question came from our site for professional and enthusiast programmers.

    
What happens when you try? – Gilles May 16 '11 at 20:06
    
i get: "ping: icmp open socket: Operation not permitted" – kamal May 16 '11 at 21:10
up vote 2 down vote accepted

Under Linux, ping needs to run as root (because it needs to bind a raw IP socket; ordinary users can only do UDP and TCP). It's designed to be setuid root. It looks like your copy in the chroot isn't setuid root. Fix the permissions:

chown root:root /bin/ping; chmod u+srwx,go=rx /bin/ping

Note that there may be other commands in the chroot that need to be setuid (or setgid), in particular su and sudo.

Note that this answers assumes a chroot, not something with more restrictions like a jail.

share|improve this answer

As have been pointed out, ping needs the permission to bind a raw IP socket. Traditionally setuid has been used to allow normal users to use it. However, using capabilities (POSIX 1003.1e, capabilities(7)), a minimal set of capabilities can be selectively enabled, limiting the security consequences of potential vulnerabilities.

ping needs the capability CAP_NET_RAW. Suppose that the path to the binary is /usr/bin/ping, the capability can be set using the tool setcap:

setcap cap_net_raw+ep /usr/bin/ping

Use getcap to check the result:

getcap /usr/bin/ping

The output should be something like

/usr/bin/ping = cap_net_raw+ep

and ping should work now.

share|improve this answer

There shouldn't be a problem using ping or any other part of the gnu tool chain within a chroot, so long as these binaries are present in your path. If these commands cannot be accessed, perhaps you should check your environment variables.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .