Debian Bug report logs - #509813
iputils-ping: please do not ship SUID binaries (capabilities)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Laurent Bonnaud <Laurent.Bonnaud@inpg.fr>

To: Debian BTS submission <submit@bugs.debian.org>

Subject: iputils-ping: please do not ship SUID binaries (capabilities)

Date: Fri, 26 Dec 2008 18:39:40 +0100

Package: iputils-ping
Version: 3:20071127-1
Severity: wishlist


Hi,

I would like to reduce the number of SUID binaries on my systems.
The /bin/ping and /bin/ping6 binaries are easy targets.  I did what is
written in /usr/share/doc/libcap2-bin/README.Debian and it works well.
It would be interesting to benefit from this security improvement in
standard Debian systems.  So could you please implement it the iputils
package ?

Here are some random implementation thoughts:

 - extended attributes on the file system seem to be a precondition
 - would it be possible to have dpkg support file capabilities or
extended attributes ?
 - if not how about setting the necessary capability bits in the
postinst script ?


-- System Information:
Debian Release: 5.0
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages iputils-ping depends on:
ii  libc6                     2.8+20080809-1 GNU C Library: Shared libraries

iputils-ping recommends no packages.

iputils-ping suggests no packages.

-- no debconf information

-- 
Laurent Bonnaud.
http://www.lis.inpg.fr/pages_perso/bonnaud/

Message #12 received at 509813-done@bugs.debian.org (full text, mbox, reply):

From: Noah Meyerhans <noahm@debian.org>

To: 509813-done@bugs.debian.org

Cc: control@bugs.debian.org

Subject: done

Date: Sat, 1 Feb 2014 11:46:37 -0500

[Message part 1 (text/plain, inline)]

fixed 509813 3:20121221-2
thanks

Since 3:20121221-2, iputils packages try to make use of capabilities
instead of setuid if possible.

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.