Messages in this thread | | | Date | Tue, 21 Dec 2010 13:46:41 -0500 | Subject | Re: [RFC] ipv4: add ICMP socket kind | From | Colin Walters <> |
| |
On Tue, Dec 21, 2010 at 1:18 PM, Vasiliy Kulikov <segooon@gmail.com> wrote: > Hi, > > This patch adds IPPROTO_ICMP socket kind. It makes it possible to send > ICMP_ECHO messages and receive corresponding ICMP_ECHOREPLY messages > without any special privileges. In other words, the patch makes it > possible to implement setuid-less /bin/ping. > > A new ping socket is created with > > socket(PF_INET, SOCK_DGRAM, IPPROTO_ICMP)
And the default is to allow any uid to do this (modulo LSM)?
If you really have a burning desire to get rid of setuid /bin/ping, why not just do it in userspace via message passing to/from a privileged process, and avoid a lot of code in the kernel? It's much more flexible. You could, for example, limit it to once a second by default, allow only one process doing this per uid, etc. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |