From Fedora Project Wiki
No edit summary
m (Add trackers)
 
(13 intermediate revisions by 2 users not shown)
Line 31: Line 31:
This should link to your home wiki page so we know who you are.  
This should link to your home wiki page so we know who you are.  
-->
-->
* Name: [[User:rishi|Debarshi Ray]]
* Name: [[User:rishi|Debarshi Ray]], [[User:zbyszek|Zbigniew Jędrzejewski-Szmek]]
<!-- Include you email address that you can be reached should people want to contact you about helping with your change, status is requested, or technical issues need to be resolved. If the change proposal is owned by a SIG, please also add a primary contact person. -->
<!-- Include you email address that you can be reached should people want to contact you about helping with your change, status is requested, or technical issues need to be resolved. If the change proposal is owned by a SIG, please also add a primary contact person. -->
* Email: debarshir@redhat.com
* Email: debarshir@redhat.com, zbyszek@in.waw.pl
<!--- UNCOMMENT only for Changes with assigned Shepherd (by FESCo)
<!--- UNCOMMENT only for Changes with assigned Shepherd (by FESCo)
* FESCo shepherd: [[User:FASAccountName| Shehperd name]] <email address>
* FESCo shepherd: [[User:FASAccountName| Shehperd name]] <email address>
Line 52: Line 52:
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
-->
-->
* Tracker bug: <will be assigned by the Wrangler>
* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=1740809 #1740809]
* Release notes tracker: <will be assigned by the Wrangler>
* Release notes tracker: [https://pagure.io/fedora-docs/release-notes/issue/376 #376]


== Detailed Description ==
== Detailed Description ==
Line 98: Line 98:
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->


* Other developers: Depending on which exact RPM will ship the <code>sysctl</code> snippet, the relevant package or upstream maintainer would need to review and merge the code changes.<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Other developers: Once this change is in place, the file capabilities should be removed from the <code>ping</code> binary because they would no longer be necessary. However, it's not a requirement for implementing this change.<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
<!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->


Line 167: Line 167:


<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "Revert the shipped configuration".  Or it might not (e.g. rebuilding a number of dependent packages).  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "Revert the shipped configuration".  Or it might not (e.g. rebuilding a number of dependent packages).  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
* Contingency mechanism: If <code>net.ipv4.ping_group_range</code> isn't enabled then status quo will be maintained. No explicit action needs to be taken. <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Contingency mechanism: If <code>net.ipv4.ping_group_range</code> isn't enabled then status quo will be maintained. No explicit action needs to be taken. Note that the <code>ping</code> binary should not be touched until this change is complete. Only then should be the file capabilities removed.<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
<!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
* Contingency deadline: N/A (not needed for this Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Contingency deadline: N/A (not needed for this Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Line 187: Line 187:
-->
-->


[[Category:ChangePageIncomplete]]
[[Category:ChangeAcceptedF31]]
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
Line 194: Line 194:


<!-- Select proper category, default is Self Contained Change -->
<!-- Select proper category, default is Self Contained Change -->
<!-- [[Category:SelfContainedChange]] -->
[[Category:SelfContainedChange]]
[[Category:SystemWideChange]]
<!-- [[Category:SystemWideChange]] -->

Latest revision as of 16:28, 13 August 2019


Enable net.ipv4.ping_group_range in the kernel

Summary

Enable the Linux kernel's net.ipv4.ping_group_range parameter to cover all groups.

Owner

Current status

Detailed Description

Enable the Linux kernel's net.ipv4.ping_group_range parameter to cover all groups. This will let all users on the operating system create ICMP Echo sockets without using setuid binaries, or having the CAP_NET_ADMIN and CAP_NET_RAW file capabilities.

Benefit to Fedora

This makes ping work inside rootless Podman containers. Currently it doesn't.

When the Linux kernel's net.ipv4.ping_group_range parameter is enabled for a group, users in that group can send ICMP Echo packets without using setuid binaries, or having the CAP_NET_ADMIN and CAP_NET_RAW file capabilities. This works by using ICMP Echo sockets instead of the more generic, and easier to abuse, raw sockets. For Fedora, this means that the file capabilities can be removed from the ping binary.

This is good for OSTree based Fedora variants like Silverblue, where development environments are often set up using rootless Podman containers with helpers like Toolbox. At present, ping doesn't work in those environments, and it's inconvenient to not be able to use such a basic network utility inside a development set-up.

Scope

  • Proposal owners: Enable net.ipv4.ping_group_range by adding it to one of the files shipped by the sytemd RPM in /usr/lib/sysctl.d or by creating a new file shipped by the podman or toolbox RPMs. Here is an upstream pull request against systemd.
  • Other developers: Once this change is in place, the file capabilities should be removed from the ping binary because they would no longer be necessary. However, it's not a requirement for implementing this change.
  • Release engineering: N/A (not needed for this Change)
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

Systems with a previous version of Fedora won't need manual intervention. They will inherit this change when updated.

How To Test

On a Fedora system containing this change, the following commands should work: 

$ podman run -it --rm registry.fedoraproject.org/fedora:latest
...
# dnf -y install iputils
...
# ping fedoraproject.org
...

User Experience

Users of rootless Podman, including those developing on Silverblue inside Toolbox containers, would now be able to use ping. Earlier, they weren't able to.

Dependencies

N/A (not needed for this Change)

Contingency Plan

  • Contingency mechanism: If net.ipv4.ping_group_range isn't enabled then status quo will be maintained. No explicit action needs to be taken. Note that the ping binary should not be touched until this change is complete. Only then should be the file capabilities removed.
  • Contingency deadline: N/A (not needed for this Change)
  • Blocks release? No
  • Blocks product? No

Documentation

There's no upstream documentation. There's some discussion on this systemd pull request.

Release Notes

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/EnableSysctlPingGroupRange&oldid=550095"