3

I'm using Alpine (which uses busybox), and trying to get ping to work. First I tried installing iputils per https://serverfault.com/a/1001312 . No dice.

Then I found something that said I need to set the sticky bit, but it's already set.

What's going on?

/ # ping www.google.com
PING www.google.com (172.217.5.100): 56 data bytes
ping: permission denied (are you root?)
/ # which ping
/bin/ping
/ # ls -al /bin/ping
lrwxrwxrwx    1 root     root            12 Jan 16  2020 /bin/ping -> /bin/busybox
/ # whoami
root
/ # apk add iputils
fetch https://alpine.global.ssl.fastly.net/alpine/v3.11/main/x86_64/APKINDEX.tar.gz
fetch https://alpine.global.ssl.fastly.net/alpine/v3.11/community/x86_64/APKINDEX.tar.gz
fetch https://alpine.global.ssl.fastly.net/alpine/edge/testing/x86_64/APKINDEX.tar.gz
(1/2) Installing libcap (2.27-r0)
(2/2) Installing iputils (20190709-r0)
Executing busybox-1.31.1-r9.trigger
Executing glibc-bin-2.28-r0.trigger
OK: 49 MiB in 32 packages
/ # ping www.google.com
ping: socket: Operation not permitted
/ # which ping
/bin/ping
/ # ls -al /bin/ping
-rwsr-xr-x    1 root     root         60232 Oct 22  2019 /bin/ping
/ # chmod u+s /bin/ping
/ # ping www.google.com
ping: socket: Operation not permitted
/ # cat etc/os-release
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.11.3
PRETTY_NAME="Alpine Linux v3.11"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://bugs.alpinelinux.org/"
Eddified
  • 213
  • 3
  • 7

1 Answers1

2

This is a sysctl setting that restricts the user ID range allowed to ping on Alpine. To let all users ping,

echo "0 2147483647" > /proc/sys/net/ipv4/ping_group_range

and to make it permanent,

echo "net.ipv4.ping_group_range = 0 2147483647" >> /etc/sysctl.conf
tater
  • 1,445
  • 2
  • 10
  • 12
  • Thanks, but I'm getting: bash-5.0# echo "0 2147483647" > /proc/sys/net/ipv4/ping_group_range bash: /proc/sys/net/ipv4/ping_group_range: Read-only file system – Eddified Oct 26 '20 at 18:51
  • The other suggestion might work -- haven't been able to try that yet. – Eddified Oct 26 '20 at 18:58
  • Are you trying to do it inside a container? Please add some info to the question in that case and say what container system, host distro etc. as the problem is more likely on the host, could be `cgroups` etc. – tater Oct 26 '20 at 22:43
  • 1
    Yes, sorry, I did not realize at the time I wrote this question, that the problem could be external to the docker container. We found the problem, the issue was not within the docker container; the problem was a restriction in permissions, as set by Kubernetes on the docker host. – Eddified Oct 27 '20 at 19:54