Subject: Re: [bug#73750] [PATCH] gnu: system: %default-privileged-programs: Set ping capabilities

From: Ludovic Courtès <[email-masked]>
Date: Sun, 03 Nov 2024 23:02:49 +0100

Rutherther <[email-masked]> skribis:

> Ping and ping6 don't need setuid, they can work with
> cap_net_raw capability only. This means that even if
> ping or ping6 had a vulnerability that could be
> used for execution as root, it can't anymore if
> the program is not setuid.
>
> * gnu/system.scm (%default-privileged-programs): Remove ping, ping6 setuid
> programs, add ping, ping6 programs with cap_net_raw=ep capabilities
>
> Change-Id: Ie409b477f548dbff3318eec33d0d2ca16a1b3209

Applied, thanks!

Indeed, that was the whole point of the work on privileged programs
carried out by Tobias.  Nice to see it in action!

Ludo’.