ping: socket: Not owner

[Omar Alvi_1]

Hi,

When using the ping command as any non root user, the folloeing error is seen

ping: socket: Not owner

Thanks,

-Alvi

[James R. Ferguson · Accepted solution]

Hi Alvi:

Make sure the the 'ping' executable is owned by 'root' with the setuid bit on:

-r-sr-xr-x 1 root bin 36864 May 28 2001 /usr/sbin/ping

Regards!

...JRF...

[Steven E. Protter]

ping is a pretty powerful tool and should not be given for use to users other than root.

It was the ping command, from thousands of servers that was used in denial of service attacks on ebay and yahoo a few years ago.

Networking is the domain of the root user. The systems administrator is the only one that should need that tool.

SEP

[Mark Greene_1]

Steven,

Do you mean the "ping of death"?

http://www.insecure.org/sploits/ping-o-death.html

Is this still a problem? I would have expected every OS to have a patch for this by now.

mark

[Tal Drigov_2]

Hi Alvi,

Change the owner of the file /etc/ping from root to bin !

Cheers,
Tal.

[Omar Alvi_1]

Hi,

Thnanks JRF, permissions problem indeed.

About setuid the manpage for chmod says:

s Add or delete the set-owner-ID-on-file-execution or set-group-ID-on-file-execution permission for who. "Useful only if u or g is expressed or implied in who."

What does the line in "quotes" mean? What is who (the command?) and how do you imply u or g (obsolete number permissions?)

Is the effect of setting user id in fact like a "execute as root", or is it something else? Is setuid specific for root owned files?

What is the sticky bit?

Thanks for the help.

[U.SivaKumar_2]

Hi,

Case 1:
( Without sticky bit )
-r-xr-xr-x 1 root bin 36864 May 28
2001 /usr/sbin/ping

who is the owner of the file ? user root and group bin.

Executable permission is set for all.

But if i execute this file viz. continous ping as a normal user user A. Then open one more terminal

#ps -ef | grep ping

then you can see the effective user id of the ping process running in CPU will be user A.

But that is the real problem. In unix to create sockets ( UDP in our case - as ping uses ICMP - UDP ) a process has to run as a privileged user. So with the above permission you will get a error.

Case 2:
(With Sticky bit)

-r-sr-xr-x 1 root bin 36864 May 28 2001 /usr/sbin/ping

With sticky bit set , it means if any user executes the file , eventhough the user is not the owner of the file , the effective user of the running process will assume the user id of the owner of the file. viz. root in our case.

So now after sticky bit set the effective user of the running ping command will be the root. So the root is privileged to create the sockets now and will create the required udp sockets to send ICMP echo requests to the destination IP address.

regards,
U.SivaKumar

[Omar Alvi_1]

Thanks U. Siva,

Thats cleared my sticky bit concepts.

Regards
-Alvi

[James R. Ferguson]

Hi (again) Alvi:

The 'sticky' bit on an executable file causes the swap image of the program's text segments to be retained even when the last user's execution terminates. This results in a faster subsequent execution. When the sticky bit is set, a 't' appears thusly:

-r-xr-xr-t

The 'setuid' bit was the missing permission in your case. When set, the 'setuid' bit causes the process's effective uid to become that of the owner of the file. When the setuid bit is set, an 's' appears thusly:

-r-sr-xr-x

For more information, see the man pages for 'chmod(2)'.

Regards!

...JRF...