Hello *,
while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However, it seems as the capabilities set to /usr/bin/ping are not preserved that way.
Am I mistaken? Can we even use file capabilities in this environment?
Thanks, and best regards, Peter Müller
Hi Peter,
In the CHANGES file in the source tarball setcap is mentioned twice:-
===== s20200821 ===== released August 21, 2020
* arping - [security] disable setcap and setuid (prevent ARP Poisoning, issue: #203)
* Meson build system - Allow to set using setcap-setuid.sh per application (commit: 054670a)
The setcap-setuid.sh script is in the build-aux directory in the source tarball. Maybe this script is what needs to be used now.
Hope this helps.
Regards,
Adolf.
On 07/07/2021 20:26, Peter Müller wrote:
Hello *,
while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However, it seems as the capabilities set to /usr/bin/ping are not preserved that way.
Am I mistaken? Can we even use file capabilities in this environment?
Thanks, and best regards, Peter Müller
For completeness. This has been fixed in:
https://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff;h=37ef9fe4e07a97d3597b...
The capabilities where set correctly, but strip removed them later and so nothing landed in the ISO or updater.
Best, -Michael
On 7 Jul 2021, at 19:26, Peter Müller peter.mueller@ipfire.org wrote:
Hello *,
while working on bug #12652, I noticed we _did_ ship ping / iputils in Core Update 157. However, it seems as the capabilities set to /usr/bin/ping are not preserved that way.
Am I mistaken? Can we even use file capabilities in this environment?
Thanks, and best regards, Peter Müller
-
Adolf Belka -
Michael Tremer -
Peter Müller