No ping from non root user in Debian Buster LXC

[ulvida]

When installing a Debian 10 container in a Proxmox VE 6.1 (with the nested option needed), I have no ping from any non root user in the container:

ulvida@anacahuita:~$ ping che
ping: socket: Operación no permitida

This problem was indirectly addressed in this forum thread (which is tagged as solved, and that's why I'm opening a new one). However, AMHO, it was quite misinterpreted (I think it is an OS problem, not an Apache one, as it happens for any non-pribilegied user, not only www-data) and can have better solutions.

Consulting several sources, particularly this forum post, to solve that recent linux distribution do no longer use the setuid bit (which provoques ping to be executed as the program's owner, root, an not the user who runs the command), but kernel capabilities. In a Debian or an Ubuntu installed from official ISOs, when I run getcap /bin/ping, it returns: /bin/ping = cap_net_raw+ep. Which is not the case with PVE LXC Debian Buster templates.

It's easy to solve. You just have to run as root:

setcap cap_net_raw+ep /bin/ping

Or, more elegant, re-install iputils-ping package.

Ping is clearly a basic network tool that should be available for all linux users, which is the case in usual linux distros.

This forum post just to contribute for other users, and to insist that PVE Staff Member take it into account in templates' configuration.

 

[wolfgang]

Hi,

from the manpage

SECURITY
       ping requires CAP_NET_RAW capability to be executed 1) if the program is used for non-echo queries (See -N option), or 2) if kernel does not
       support non-raw ICMP sockets, or 3) if the user is not allowed to create an ICMP echo socket. The program may be used as set-uid root.

 

[ulvida]

Thanks for your answer.

from the manpage

Yes ping's manpage documents that it requires this capability.

But why the capability is not set for non root users of proxmox debian templates while it is in a standard debian installation? I understand that these templates should have a behaviour as near as possible from a standard template. And here it is possible: jist run a re-install of iputils-ping package.

 

[TomFreudenberg]

Hi

on my containers I just reinstall all packages containing setcap command and be already installed by the image.

That works in any way - hope useful for others too.

Here is a command which look at all installed packages and reinstall those ...

cd /var/lib/dpkg/info/ && apt install --reinstall $(grep -l 'setcap' * | sed -e 's/\.[^.]*$//g' | sort --unique)

 

[Thomas Stone]

This still happens on the Debian 12 container template. I agree with the OP and found Tom's one-liner above to work to 'fix the problem'. Thanks!

 

[scatman93]

Yep, have the same issue, Tom's one-liner is a brilliant and fast fix. Thanks!