Subject: [alpine-devel] ping: ping is not a valid applet

From: Alba Pompeo <[email-masked]>
Date: Sun, 8 May 2016 13:36:17 -0300

I'm on edge and receive this message when trying to ping an IP.
ping: ping is not a valid applet
Is there a fix?
Thanks.
Ciao.

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Isaac Dunham <[email-masked]>
Date: Sun, 8 May 2016 13:07:58 -0700

> ping: ping is not a valid applet

This is an issue I mentioned previously, where bbsuid no longer recognizes
ping as a valid command, but the symlink has not been updated to point to
busybox.

Workaround:
rm -f /bin/ping && /bin/busybox --install -s

Fix:
See attached patch.

The sysctl settings shown are disabled/netdev (gid=28) only/everyone.

HTH,
Isaac Dunham
>From be58791fd2d2149288352b6793ccf6675ab2c3e1 Mon Sep 17 00:00:00 2001
From: Isaac Dunham <[email-masked]>
Date: Sun, 8 May 2016 12:47:15 -0700
Subject: [PATCH] main/busybox: fix ping on upgrades

ping was a symlink to bbsuid to allow non-root pings, but the support for
ping in bbsuid was dropped when ICMP_ECHO support was patched in.
So the old ping symlink needs to be deleted.

This patch is not a complete fix: non-root ping requires setting a sysctl
to allow the appropriate groups to access ping.
This sysctl is a range, specifying the minimum and maximum gid allowed.
Example settings:
net.ipv4.ping_group_range=1 0
net.ipv4.ping_group_range=28 28
net.ipv4.ping_group_range=0 4294967295
---
 main/busybox/APKBUILD             | 2 +-
 main/busybox/busybox.post-upgrade | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/main/busybox/APKBUILD b/main/busybox/APKBUILD
index 02303ea..91f2d01 100644
--- a/main/busybox/APKBUILD
+++ b/main/busybox/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <[email-masked]>
 pkgname=busybox
 pkgver=1.24.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Size optimized toolbox of many common UNIX utilities"
 url=http://busybox.net
 arch="all"
diff --git a/main/busybox/busybox.post-upgrade b/main/busybox/busybox.post-upgrade
index 268f22d..f972562 100644
--- a/main/busybox/busybox.post-upgrade
+++ b/main/busybox/busybox.post-upgrade
@@ -7,5 +7,9 @@ for link in /bin/install /bin/ip /bin/vi /usr/bin/lspci; do
 	fi
 done
 
+if [ -L "/bin/ping" ] && [ "$(readlink /bin/ping)" = "/bin/bbsuid" ]; then
+	rm /bin/ping
+fi
+
 # We need the symlinks early
 exec /bin/busybox --install -s
-- 
2.8.1

---

From: Alba Pompeo <[email-masked]>
Date: Sun, 8 May 2016 17:30:54 -0300

Nice workaround for now, thanks.
I hope in the future it works on non-root user accounts too.

---

---

From: Christian Kampka <[email-masked]>
Date: Sun, 08 May 2016 20:58:06 +0000

You should be able to use ping as a non-root user by setting
the ping_group_range in sys/net/ipv4 to the appropriate group(s).
See 'man 7 icmp' for details.

Maybe we should figure out a sensible default we can supply with an
alpine-base installation.

---

From: Isaac Dunham <[email-masked]>
Date: Sun, 8 May 2016 14:42:32 -0700

> See 'man 7 icmp' for details.

Some settings are also shown in the comment in the patch.

> alpine-base installation.

My initial suggestion (based on what I do locally) was to allow group
'netdev' alone to use ICMP_ECHO.
ncopa suggested adding a 'ping' group with gid=999, and allow 999+ to
use ping.
The one caveat here is that some daemons use groups nobody/nogroup
(gid=65533/65534), and it seems rather senseless for a daemon to *gain*
the ability to use ICMP_ECHO by dropping privileges if there does turn
out to be a vulnerability there; nobody:nogroup is supposed to indicate
that a daemon has no need for any extra privileges.
Similarly, 4294967294 is used as the anonymous unauthenticated user in
some NFS implementations, so permitting that might be undesireable.

For reference, on Debian, gids from 60,000 to 64,999 are reserved for
packages; if we were to parallel Debian's policy, a sensible default
would be 999-59999.

---