Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I use the ping command in a chroot environment?

$ ping
ping: icmp open socket: Operation not permitted

Currently I am using CentOs, but ideally there must be a solution that works in all chrooted environments.

share|improve this question

migrated from May 16 '11 at 19:45

This question came from our site for professional and enthusiast programmers.

What happens when you try? – Gilles May 16 '11 at 20:06
i get: "ping: icmp open socket: Operation not permitted" – kamal May 16 '11 at 21:10

3 Answers 3

up vote 1 down vote accepted

Under Linux, ping needs to run as root (because it needs to bind a raw IP socket; ordinary users can only do UDP and TCP). It's designed to be setuid root. It looks like your copy in the chroot isn't setuid root. Fix the permissions:

chown root:root /bin/ping; chmod u+srwx,go=rx /bin/ping

Note that there may be other commands in the chroot that need to be setuid (or setgid), in particular su and sudo.

Note that this answers assumes a chroot, not something with more restrictions like a jail.

share|improve this answer

As have been pointed out, ping needs the permission to bind a raw IP socket. Traditionally setuid has been used to allow normal users to use it. However, using capabilities (POSIX 1003.1e, capabilities(7)), a minimal set of capabilities can be selectively enabled, limiting the security consequences of potential vulnerabilities.

ping needs the capability CAP_NET_RAW. Suppose that the path to the binary is /usr/bin/ping, the capability can be set using the tool setcap:

setcap cap_net_raw+ep /usr/bin/ping

Use getcap to check the result:

getcap /usr/bin/ping

The output should be something like

/usr/bin/ping = cap_net_raw+ep

and ping should work now.

share|improve this answer

There shouldn't be a problem using ping or any other part of the gnu tool chain within a chroot, so long as these binaries are present in your path. If these commands cannot be accessed, perhaps you should check your environment variables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.