Unprivileged ICMP sockets on Linux
While working on a cheap Network Scanner app for Ubuntu Touch I ran into the following problem.
A Network Scanner needs to ping hosts. Pinging means sending ICMP ECHO and receiving ICMP ECHOREPLY packets, and traditionally one can only create the necessary raw ICMP socket if one has root privileges or somehow got hold of the CAP_NET_RAW capability. Unprivileged users can usually ping hosts using a setuid
/bin/ping from Qt/QML and parsing its output (see the code) does work on my Ubuntu 15.04 development desktop (Kernel 3.18.0-9-generic), but doesn’t when the app runs in confined mode on the Ubuntu Touch phone (Nexus 4, Ubuntu Touch r14, Kernel 3.4.0-5-mako). Why? Because you can’t execute binaries that haven’t been shipped with your app, and you obviously can’t ship setuid binaries with your app. Luckily I stumbled across a Linux kernel patch from 2010 which allows unprivileged users to create an ICMP datagram socket that is restricted to sending and receiving ICMP ECHO packets.
The necessary code to send an ICMP ECHO packet to localhost is as follows (see also):
So everything is fine now, right? Well, no. It works, but now the situation is the other way around: It works on the phone, while the
socket() call fails with EACCES on the desktop. It took me a while to find out why.
The original patch was modified to only allow access to unprivileged ICMP sockets to a range of group ids. The range can be configured via sysctl and differs across devices and distributions:
So the current setting on Ubuntu Touch is to allow access to every user, while the desktop distributions seem to disable the feature completely.
It would be nice if the feature was enabled on all distributions and devices, otherwise I have to build multiple code paths and let the application find out which one (unprivileged ICMP sockets or a call to
/bin/ping) works in the given environment.
If you have any ideas, you can usually find me on the FreeNode IRC.