Synapse: how to use its PING feature without needing root rights (Linux)? lazarus / 32-Linux ---------------------------------------------------------------------- Hartmut · 2025-08-20 11:07 I want to use the PING feature of package Synapse, which resides in unit pingsend, e.g. in function PingHost http://synapse.ararat.cz/doc/help/pingsend.html#PingHost Unfortunately then my program needs sudo to work (which makes it very uncomfortable for me and others). The beginning of unit pingsend.pas contains: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i This unit using IpHlpApi (on WinXP or higher) if available. Otherwise it trying to use RAW sockets.Warning: For use of RAW sockets you must have some special rights on some systems. So, it working allways when you have administator/root rights.I use Ubuntu 24.04. There are some other things, which normally require sudo for a program to use it, but which can be avoided by only adding the current user to a certain user group:  - to use WebDAV without sudo, simple add the current user to the "davfs2" group or  - to use serial devices (rs232), simple add the current user to the "dialout" group. My question is: does a certain user group exist, where I only have to add the current user, so that sudo is not longer required for programs using the PING feature of Synapse? Thanks in advance. ---------------------------------------------------------------------- cdbc · 2025-08-20 12:04 Hi IIRC you have to include your user in the "DialOut" group or something like that, to avoid having to have 'root'-privileges... Regards Benny ---------------------------------------------------------------------- Hartmut · 2025-08-20 12:37 Thanks cdbc. The current user was already in group "dialout": Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@i3300:/media/D/Tst$ groupshg6 adm dialout cdrom sudo dip plugdev lpadmin sambashare davfs2hg6@i3300:/media/D/Tst$but this doesn't help. So if this way (adding the current user to the right group) is possible, then it must be another group. Which group could it be? ---------------------------------------------------------------------- Thausand · 2025-08-20 12:57 Raw socket not work that way for Linux. I not know group that have default no root access for raw socket. If want ping no root then have use capability (setcap). Always you can make group that have raw socket capability but normal is have grant program raw socket capability. To make setcap must use root one time for setting capability. PS: I just read, trixie make change again and not use raw-socket but now use proto capability. So look like depends distribution and version. I not have maked test with trixie (I no have trixie). ---------------------------------------------------------------------- rvk · 2025-08-20 13:04 Quote from: Hartmut on August 20, 2025, 01:07:58 pmMy question is: does a certain user group exist, where I only have to add the current user, so that sudo is not longer required for programs using the PING feature of Synapse? Couldn't you do it like it's done for the ping command itself. There the /bin/ping is just set as setuid root. chown root:root /path/yourapp; chmod u+srwx,go=rx /path/yourapp Edit: I see indeed that this is changed again since Debian 13 "Trixie". https://stackoverflow.com/a/79734658/1037511 5.1.15. Ping no longer runs with elevated privileges https://www.debian.org/releases/trixie/release- notes/issues.en.html#ping-no-longer-runs-with-elevated-privileges ---------------------------------------------------------------------- rvk · 2025-08-20 13:15 Quote from: Thausand on August 20, 2025, 02:57:43 pmPS: I just read, trixie make change again and not use raw-socket but now use proto capability. So look like depends distribution and version. I not have maked test with trixie (I no have trixie). Aren't SOCK_DGRAM and IPPROTO_ICMP already available on older versions? And isn't it just that Trixie is only implementing this now in ping versions? In that case you could create your own ping function with SOCK_DGRAM and IPPROTO_ICMP without needing privileges. https://stackoverflow.com/questions/8290046/icmp-sockets-linux ---------------------------------------------------------------------- Jurassic Pork · 2025-08-20 13:16 Hello, Raw socket access is required for tools like ping, traceroute etc to send ICMP packets on Linux. Only root user can use Raw socket access. If you want just use ping to see if a server is alive, try to use a tcp connection with an opened port on the server. Friendly, J.P ---------------------------------------------------------------------- Thausand · 2025-08-20 13:19 Quote from: rvk on August 20, 2025, 03:15:05 pmAren't SOCK_DGRAM and IPPROTO_ICMP already available on older versions? And isn't it just that Trixie is only implementing this now in ping versions? Yes, that true. QuoteIn that case you could create your own ping function with SOCK_DGRAM and IPPROTO_ICMP without needing privileges. Yes, also true. If make ping self then works and no have use privilege. But if want use ping then I understand (maybe I wrong?) need PROTO capability enable for ping. PS: change with trixie new for me, I did not know and just read. I not read what all change are so I maybe wrong and not understand correct. ---------------------------------------------------------------------- rvk · 2025-08-20 13:27 Quote from: Thausand on August 20, 2025, 03:19:56 pmBut if want use ping then I understand (maybe I wrong?) need PROTO capability enable for ping. The default ping in Linux (before Trixie) uses RAW sockets. They always need priveliges. If you do ls /bin/ping -ltr you see that it has a "s" in user permission (setuid). That means it runs as that user (in the case of ping it runs as root). That's why you don't need to do sudo ping ip. The new ping in Trixie uses SOCK_DGRAM and IPPROTO_ICMP. The privileges of that is regulated by net.ipv4.ping_group_range. But apparently this is already set very liberal in the new Debian version so unprivileged users already have permissions there. I just checked in Bookworm and got this: Quote$ sudo sysctl -a | grep ping net.ipv4.ping_group_range = 0   2147483647 net.ipv4.tcp_pingpong_thresh = 1 So my guess is that it's allowed there too for unprivileged users. ---------------------------------------------------------------------- Hartmut · 2025-08-20 14:06 Quote from: Thausand on August 20, 2025, 02:57:43 pmIf want ping no root then have use capability (setcap). Always you can make group that have raw socket capability but normal is have grant program raw socket capability. Thank you Thausand. I'm aware that I can set 'net_raw' capability to my program. But this has 2 disadvantages:  - after each new compile (and that can be many times a day) I have to repeat that step and this step needs sudo  - the users of my program must repeat this step after every program- update and this step needs sudo Both makes this solution quiet uncomfortable. But you wrote: QuoteAlways you can make group that have raw socket capability Does that mean:  - I create a new group and give it raw socket capability  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? This would be a great solution! Did you mean this? QuoteI just read, trixie make change again and not use raw-socket but now use proto capability. So look like depends distribution and version. I not have maked test with trixie (I no have trixie). With trixie you mean Debian 13 "Trixie"? Quote from: rvk on August 20, 2025, 03:04:42 pmCouldn't you do it like it's done for the ping command itself. There the /bin/ping is just set as setuid root. chown root:root /path/yourapp; chmod u+srwx,go=rx /path/yourapp Thanks rvk too. I'm aware of this possibility. But this has 3 disadvantages:  - after each new compile (and that can be many times a day) I have to repeat that 2 steps and this steps needs sudo  - the users of my program must repeat this 2 steps after every program-update and this steps needs sudo Both makes this solution quiet uncomfortable. And AFAIK GUI-programs should not run with root privileges. Quote from: rvk on August 20, 2025, 03:15:05 pmAren't SOCK_DGRAM and IPPROTO_ICMP already available on older versions? And isn't it just that Trixie is only implementing this now in ping versions? In that case you could create your own ping function with SOCK_DGRAM and IPPROTO_ICMP without needing privileges. I'm a bloody beginner to all that network stuff. The above would be very far beyond my horizon. I would like to use Synapse for PING, because then I have to code everything only once and it works for Linux + Windows. Quote from: Jurassic Pork on August 20, 2025, 03:16:21 pmRaw socket access is required for tools like ping, traceroute etc to send ICMP packets on Linux. Only root user can use Raw socket access. If you want just use ping to see if a server is alive, try to use a tcp connection with an opened port on the server. Thank you Jurassic Pork. To "use a tcp connection with an opened port on the server" would be very difficult for me as a bloody beginner to all that network stuff. In this case it would be easier for me:  - for Windows to use PING via Synapse  - and for Linux to call /usr/bin/ping from my program. Therefore I had to use "sudo chmod u+s /usr/bin/ping" only once. Conclusion: The only left possible solution seems to be from Thausand to create a new group and give it raw socket capability and to add the current user to this group (as I described at the beginning of this post), If I understood him correctly. Did I? Thanks again for all your help. ---------------------------------------------------------------------- rvk · 2025-08-20 14:15 Quote from: Hartmut on August 20, 2025, 04:06:57 pmQuote from: rvk on August 20, 2025, 03:15:05 pmAren't SOCK_DGRAM and IPPROTO_ICMP already available on older versions? And isn't it just that Trixie is only implementing this now in ping versions? In that case you could create your own ping function with SOCK_DGRAM and IPPROTO_ICMP without needing privileges. I'm a bloody beginner to all that network stuff. The above would be very far beyond my horizon. I would like to use Synapse for PING, because then I have to code everything only once and it works for Linux + Windows. Of course we could help craft a function (using Synapse) to use. I would have to dive into this. Quote from: Hartmut on August 20, 2025, 04:06:57 pmThank you Jurassic Pork. To "use a tcp connection with an opened port on the server" would be very difficult for me as a bloody beginner to all that network stuff. In this case it would be easier for me:  - for Windows to use PING via Synapse  - and for Linux to call /usr/bin/ping from my program. Therefore I had to use "sudo chmod u+s /usr/bin/ping" only once.If you use the ping command as external program then you would never need to do sudo /bin/ping because on all Linux versions, ping already has setuid root set for /bin/ping. That's normally already set so unprivileged users can use the ping command. ---------------------------------------------------------------------- Jurassic Pork · 2025-08-20 14:33 Quote from: Hartmut on August 20, 2025, 04:06:57 pmThank you Jurassic Pork. To "use a tcp connection with an opened port on the server" would be very difficult for me as a bloody beginner to all that network stuff. In this case it would be easier for me: it isn't very difficult with synapse. Exemple to check if the freepascal server is alive ( test the port 443 (https) ) : Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program checktcpConnection;{$mode objfpc}{$H+}uses sysutils, laz_synapse, blcksock, synsock; function IsServerAlive(const Hostname: string; Port: Integer; TimeoutMS: Integer = 3000): Boolean;var  Sock: TTCPBlockSocket;begin  Result := False;  Sock := TTCPBlockSocket.Create;  try    Sock.ConnectionTimeout := TimeoutMS;  Sock.Connect(Hostname, IntToStr(Port));    Result := Sock.LastError = 0;  finally    Sock.Free;  end;end; begin    if IsServerAlive('lazarus.freepascal.org', 443) then  // 443 https       WriteLn('Server is alive!')    else       WriteLn('Server is unreachable.');   end;end. ---------------------------------------------------------------------- rvk · 2025-08-20 14:39 Quote from: Jurassic Pork on August 20, 2025, 04:33:03 pmExemple to check if the freepascal server is alive ( test the port 443 (https) ) : Assuming you just want to test for a server (with an open port) and not just for the presence of a computer ---------------------------------------------------------------------- Jurassic Pork · 2025-08-20 14:46 Quote from: rvk on August 20, 2025, 04:39:11 pmQuote from: Jurassic Pork on August 20, 2025, 04:33:03 pmExemple to check if the freepascal server is alive ( test the port 443 (https) ) : Assuming you just want to test for a server (with an open port) and not just for the presence of a computer  Hello Rvk yes !    what kind of target hartmut want to check ? ---------------------------------------------------------------------- rvk · 2025-08-20 16:12 BTW. I see that the ping in Debian Bookworm already works with SOCK_DGRAM and IPPROTO_ICMP. The s (setuid) is still set on the ping binary but it's not needed anymore. (copying the ping and stripping the capabilities works just fine) So... setuid or set capabilities isn't needed for ping binary anymore (RAW isn't used here). Quote$ strace -e socket ping 1.1.1.1 socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = 3 socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5 PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. 64 bytes from 1.1.1.1: icmp_seq=1 ttl=59 time=8.80 ms 64 bytes from 1.1.1.1: icmp_seq=2 ttl=59 time=10.1 ms 64 bytes from 1.1.1.1: icmp_seq=3 ttl=59 time=8.86 ms ^C --- 1.1.1.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 8.804/9.245/10.075/0.587 ms strace: Process 683431 detached ---------------------------------------------------------------------- Hartmut · 2025-08-20 16:53 Thanks a lot to rvk and Jurassic Pork for your help. Quote from: Jurassic Pork on August 20, 2025, 04:46:58 pmwhat kind of target hartmut want to check ? For the long run I would like to have a common general PING feature, because I guess I can use this in several projects. In my current project I want to create a common test function (for various projects) to check, if internet is available, to be able, to write a dedicated error message in my programs, if not. For this I wanted to use above PING feature to check 1) for some common IP-adresses (e.g. 37.97.187.115 - because they don't need a working DNS-Server) and 2) after that check some common websites (e.g. lazarus.freepascal.org) to check for a working DNS-Server too. I tested the demo from Jurassic Pork (many thanks for that) and on the 1st view it works. But I tested it with 2 FTP servers and it returned "Server is unreachable", but both are available via /usr/bin/ping. In one project I want to test via "ping" for these FTP servers (e.g. before I try to connect to them). And you used '443' as port. Is this value always to use for everything? Or are there cases, where another value must be used? Sorry, I'm a bloody beginner to this network stuff and my knowledge about "ports" is near zero. ---------------------------------------------------------------------- rvk · 2025-08-20 17:27 Quote from: Hartmut on August 20, 2025, 06:53:09 pmI tested the demo from Jurassic Pork (many thanks for that) and on the 1st view it works. But I tested it with 2 FTP servers and it returned "Server is unreachable", but both are available via /usr/bin/ping. In one project I want to test via "ping" for these FTP servers (e.g. before I try to connect to them). And you used '443' as port. Is this value always to use for everything? Or are there cases, where another value must be used? Sorry, I'm a bloody beginner to this network stuff and my knowledge about "ports" is near zero. FTP is on another port. HTTP is on 80 HTTPS is on 443 FTP is normally on 21 (control) and 20 (data) So yes, if you used 443 for the ftp server it probably would fail (unless there is also a webserver on the same address). ---------------------------------------------------------------------- Jurassic Pork · 2025-08-20 22:11 if you are on a linux Gnome environment, you can use the ports scanner of the gnome-nettool to see all the opened tcp ports of a server. ---------------------------------------------------------------------- Hartmut · 2025-08-21 07:40 Quote from: rvk on August 20, 2025, 07:27:00 pmHTTP is on 80 HTTPS is on 443 FTP is normally on 21 (control) and 20 (data) Thanks, that helped. With port 21 I could reach my 2 FTP servers. Quote from: Jurassic Pork on August 21, 2025, 12:11:33 amif you are on a linux Gnome environment, you can use the ports scanner of the gnome- nettool to see all the opened tcp ports of a server. Although I'm on KDE-Plasma Desktop I could install the gnome-nettool. For me as a beginner it is a great tool for investigation without having to fight with many unknown command line parameters. Thanks a lot. I'm still hoping to get an answer from Thausand (or someone else) regarding what he wrote: Quote from: Thausand on August 20, 2025, 02:57:43 pmIf want ping no root then have use capability (setcap). Always you can make group that have raw socket capability but normal is have grant program raw socket capability. Does that mean:  - I can create a new group and give it "raw socket capability" (how to do this?)  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? This would be a great solution! Did you mean this? ---------------------------------------------------------------------- MarkMLl · 2025-08-21 07:46 Quote from: Hartmut on August 21, 2025, 09:40:10 am - I can create a new group and give it "raw socket capability" (how to do this?)  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? I believe that's wrong. Capabilities are an attribute of a specific program, and for security reasons are lost if e.g. the program is copied from one place to another. Ages ago I uploaded a Lazarus patch to Mantis which allowed the "run after" command to be given root privilege specifically to do this. I haven't a clue how to find it in the new bugtracker. MarkMLl ---------------------------------------------------------------------- Hartmut · 2025-08-21 08:40 Quote from: MarkMLl on August 21, 2025, 09:46:44 amAges ago I uploaded a Lazarus patch to Mantis which allowed the "run after" command to be given root privilege specifically to do this. I haven't a clue how to find it in the new bugtracker. I think I found it in https://gitlab.com/freepascal.org/lazarus/lazarus/-/issues/38608 It's still open. ---------------------------------------------------------------------- MarkMLl · 2025-08-21 09:06 Quote from: Hartmut on August 21, 2025, 10:40:14 amQuote from: MarkMLl on August 21, 2025, 09:46:44 amAges ago I uploaded a Lazarus patch to Mantis which allowed the "run after" command to be given root privilege specifically to do this. I haven't a clue how to find it in the new bugtracker. I think I found it in https://gitlab.com/freepascal.org/lazarus/lazarus/-/issues/38608 It's still open. Yes, that looks right. It works (at least through Lazarus v2), and relies on whatever the current desktop environment is using to get at sudo. IIRC the maintainers didn't like it since it wasn't portable to Windows... However there's a problem here. It would be desirable if the IDE itself had the capability to set capabilities without needing to get authorisation via sudo. There's a capability which allows that, but since it can also propagate itself applying it to something like a development environment basically leaves the system wide-open. Fixing that would mean engaging with the overall POSIX standards- setters, and I've got enough issues of my own without trying to convince them that there's a potential improvement to be made. So, capability flags are (AIUI) set in the executable program's inode (filesystem structure), and are very much not saved if it's archived or moved: if you want a binary which can e.g. listen to a low-numbered socket or generate pings (ICMP echo requests) then it's necessary to bless it every time. MarkMLl ---------------------------------------------------------------------- Hartmut · 2025-08-21 10:46 Quote from: MarkMLl on August 21, 2025, 11:06:07 amIt would be desirable if the IDE itself had the capability to set capabilities without needing to get authorisation via sudo. There's a capability which allows that, but since it can also propagate itself applying it to something like a development environment basically leaves the system wide-open. Can you explain that capability please? Maybe it would be useful for my personal use. ---------------------------------------------------------------------- MarkMLl · 2025-08-21 11:23 Quote from: Hartmut on August 21, 2025, 12:46:11 pmQuote from: MarkMLl on August 21, 2025, 11:06:07 amIt would be desirable if the IDE itself had the capability to set capabilities without needing to get authorisation via sudo. There's a capability which allows that, but since it can also propagate itself applying it to something like a development environment basically leaves the system wide-open. Can you explain that capability please? Maybe it would be useful for my personal use. I suggest  man 7 capabilities  to start with, but also see https://for um.lazarus.freepascal.org/index.php/topic,47970.msg345641.html#msg3456 41 for examples. Basically "POSIX Capabilities" (as a specific term) allow a binary to be "blessed" with most if not all of the abilities that it would have if it were being run by the root user (i.e.  setuid root  etc.). However this is fairly fine-grained, so you can give the binary permission to e.g. listen on UDP port 79 without also giving the user running it to manipulate /bin and (in general) other privileged storage areas. So I've got one specific program which does a lot of monitoring of the "next hop" router, the DNS server and so on, which is blessed using something like: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i #!/bin/sh sudo -A -n -k setcap CAP_DAC_OVERRIDE,CAP_NET_BIND_SERVICE,CAP_NET_RAW=p+e  WatchP0x-x86_64-linux-gtk2  and can be inspected: Code: [Select]/usr/local/bin$ sudo getcap * WatchP0x-x86_64-linux-gtk2 cap_dac_override,cap_net_bind_service,cap_net_raw=ep Working from memory, that leaves the binary in the state where it can both benefit from and control e.g. cap_net_raw. However it is good practice to relinquish the capability as soon as it is no longer needed, so that if somebody were able to take control of the program by e.g. a buffer overflow he'd not be able to wereak havoc: Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i (* Relinquish the capabilities which allowed a non-root user to create a socket  in /var/run or with a port number < 1024.*)procedure RelinquishCapabilities; var  cap: boolean; begin (* When not running as root, relinquish any capabilities we've been granted.    *)(* Even if running as root do this silently, to allow for the case where a    *)(* capability has been explicitly added. Note that I'm avoiding "permissions"   *)(* etc. here as ambiguous, I don't think there's any need to translate          *)(* "capability" etc. in this context.                                         *) (* WARNING: visibility of capabilities might be modified if running under the   *)(* control of the debugger. Always test outside the debugger before jumping to  *)(* any conclusions.                                                           *)   if (FpGetgid <> 0) or (FpGetuid <> 0) then begin      (* Give up capability   *)...    if GetCapability(cap, CAP_NET_RAW) then      if cap then begin        Write(StdErr, 'Relinquishing NET_RAW capability... ');        if SetCapability(false, CAP_NET_RAW) then        WriteLn(StdErr, 'OK')        else          WriteLn(StdErr, 'failed')      end else begin end;    if GetCapability(cap, CAP_NET_RAW, CAP_PERMITTED) then      if cap then begin        Write(StdErr, 'Relinquishing NET_RAW permittivity... ');        if SetCapability(false, CAP_NET_RAW, CAP_PERMITTED) then          WriteLn(StdErr, 'OK')        else          WriteLn(StdErr, 'failed')    end else begin end  end else begin...    SetCapability(false, CAP_NET_RAW);    SetCapability(false, CAP_NET_RAW, CAP_PERMITTED)  endend { RelinquishCapabilities } ;  And so on. MarkMLl ---------------------------------------------------------------------- Hartmut · 2025-08-21 13:53 Thank you MarkMLl for your reply. I have great difficulties to understand what you mean. All this stuff about capabilities is completely new to me. And you "use" / premise a lot of things I don't know. And my English is not the best. Did I guess this correctly:  - you make or have a copy of 'setcap' which is named 'setcap2'  - then only once you need sudo to give the capability 'CAP_SETFCAP' to 'setcap2' via "sudo setcap CAP_SETFCAP=p+e ./setcap2"  - after that you can use 'setcap2' to set any wanted capability (e.g. 'cap_net_raw') to any executable, but without needing sudo for that Is this correct? ---------------------------------------------------------------------- MarkMLl · 2025-08-21 17:00 Quote from: Hartmut on August 21, 2025, 03:53:12 pmThank you MarkMLl for your reply. I have great difficulties to understand what you mean. All this stuff about capabilities is completely new to me. And you "use" / premise a lot of things I don't know. And my English is not the best. Did I guess this correctly:  - you make or have a copy of 'setcap' which is named 'setcap2'  - then only once you need sudo to give the capability 'CAP_SETFCAP' to 'setcap2' via "sudo setcap CAP_SETFCAP=p+e ./setcap2"  - after that you can use 'setcap2' to set any wanted capability (e.g. 'cap_net_raw') to any executable, but without needing sudo for that Is this correct? Yes, but that was purely a proof-of-concept when I was investigating what the IDE could potentially do: I strongly advise you to not try abusing Linux's robustness in that way. MarkMLl ---------------------------------------------------------------------- Hartmut · 2025-08-21 17:15 Quote from: MarkMLl on August 21, 2025, 07:00:28 pmYes, but that was purely a proof-of-concept when I was investigating what the IDE could potentially do: I strongly advise you to not try abusing Linux's robustness in that way. Thanks. I only wanted to understand what you meant. I agree that it would be dangerous. ---------------------------------------------------------------------- MarkMLl · 2025-08-21 20:13 Quote from: Hartmut on August 21, 2025, 07:15:05 pmThanks. I only wanted to understand what you meant. I agree that it would be dangerous. The bottom line is that lots of things have been added to unix and Linux to prevent one from doing things that are dangerous, but this has been added to /allow/ one to do things that are dangerous: albeit in a more controlled way than  setuid root  and so on. As a side note, Larry Wall has been criticised for using "blessed" to indicate the conversion of (in Pascal terms) a record into a class that could be instantiated, since people accuse him of trying to introduce his Christian inclinations into programming. However, he worked for Unisys and before that (I believe) Burroughs, who at one time had a single-bit flag in the header of a program which indicated whether it was allowed to perform privileged operations. In principle, that flag could only be set by a special mc ("make compiler") utility, which was kept under lock and key by the site manager. However, multiple groups of academics and students (including Knuth and Wirth at Stanford and Kildall at Washington) worked out that if you compiled a program (typically, an experimental compiler) to tape, then asked an inattentive operator to remount the tape as a raw medium, you could trivially set that flag, basically blowing holes in the system's security. Hence I am very, very cautious with things like POSIX capabilities, in case they are invoked by somebody with ulterior motives. MarkMLl ---------------------------------------------------------------------- Thausand · 2025-08-21 23:37 Quote from: rvk on August 20, 2025, 03:27:31 pm... So my guess is that it's allowed there too for unprivileged users. Thank you very much rvk for explain. Yes, you correct (I make test for trixie vm). First I did not understand correct (Before I think trixie more restrictive but your example tell other way around and make logic). Is now better control with trixie (but also work for bookworm). ---------------------------------------------------------------------- Thausand · 2025-08-21 23:45 Quote from: Hartmut on August 20, 2025, 04:06:57 pmThank you Thausand. I'm aware that I can set 'net_raw' capability to my program. But this has 2 disadvantages:  - after each new compile (and that can be many times a day) I have to repeat that step and this step needs sudo  - the users of my program must repeat this step after every program- update and this step needs sudo Both makes this solution quiet uncomfortable. Yes, that is negative drawback. QuoteDoes that mean:  - I create a new group and give it raw socket capability  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? This would be a great solution! Did you mean this? Yes, if understand correct then solution sysctl by rvk make possible and have that. Not have tested myself. If need help I need read instruction first  QuoteWith trixie you mean Debian 13 "Trixie"? Yes, correct. Trixie = Debian 13 Trixie (then also ubuntu etc but not know distribution name for Debian 13 base ubuntu etc distribution). Sorry for delay. MarkMLI write better English for detail explain security topic. ---------------------------------------------------------------------- Jurassic Pork · 2025-08-22 01:06 hello, may be the better solution is to use the system ping of your O.S because often you can execute it with any user. With Tprocess or better TprocessEx  from processutils unit of the fpcupdeluxe project because you can display output in RealTime , you can easily launch the system ping and get output to see if it is OK. in attachments : 1 - project to launch a console command from Lazarus GUI and display the output in a Tmemo. 2 - Animated Gif of execution of this project on Xubuntu 22.04 and Windows 11 code using TProcessEx in the project : Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i procedure TForm1.Bt_GoExClick(Sender: TObject);var  Command: String;  Param : String;  ParamStr : String;  Params : TStringArray;begin  if pos(' ',Ed_Cmd.text) = 0 then     Command := Ed_Cmd.Text  else   begin     Command := LeftStr(Ed_Cmd.Text,pos(' ',Ed_Cmd.text)- 1);     ParamStr := RightStr(Ed_Cmd.Text, length(Ed_Cmd.text) - pos(' ',Ed_Cmd.text));   end;  try    Proc := TProcessEx.Create(nil);    Proc.Executable :=  Command;    if Length(ParamStr) > 0  then       begin          Params := ParamStr.Split(' ');          For Param in Params do  Proc.Parameters.Add(Param);       end;    Proc.OnErrorM:=@(ProcessError);    Proc.OnOutputM:=@(ProcessOutput);  Proc.Execute();  finally     Proc.Free;     Proc := nil;   end;end; Friendly, J.P ---------------------------------------------------------------------- MarkMLl · 2025-08-22 07:14 Quote from: Jurassic Pork on August 22, 2025, 03:06:27 ammay be the better solution is to use the system ping of your O.S because often you can execute it with any user. If that is precisely what's needed then I agree, since the binary normally has the appropriate capabilities set when it was installed (historically, it was setuid root). Code: [Select]/usr//bin$ sudo getcap * kwin_wayland cap_sys_resource=ep ping cap_net_raw=ep MarkMLl ---------------------------------------------------------------------- Jurassic Pork · 2025-08-22 07:25 here is a code to run a ping with one request and timeout of 1 second on Windows and linux  using TProcess . The function RunPing return True if ping is OK  : Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program pingTprocess;{$mode objfpc}{$H+}uses Classes,sysutils, Process; Function RunPing(const Host: string) : Boolean;var  Proc: TProcess;  SL_stdout: TStringList;  SL_stderr: TStringList;begin  RunPing := False;  Proc := TProcess.Create(nil);  SL_stdout := TStringList.Create;  SL_stderr := TStringList.Create;  try    // Command    : one request , max response time  1 second   {$IFDEF LINUX}      Proc.Executable :=  '/bin/ping';      Proc.Parameters.AddCommaText('-c,1,-W,1,' + Host);   {$ELSE}      Proc.Executable :=  'ping.exe';      Proc.Parameters.AddCommaText('/n,1,/w,1000,' + Host);   {$ENDIF}      // Options      Proc.Options := Proc.Options + [poUsePipes, poWaitOnExit];      Proc.Execute();      // Read Output      SL_stdout.LoadFromStream(Proc.Output);      SL_stderr.LoadFromStream(Proc.StdErr);      writeln(SL_stdout.Text);    if SL_stderr.Text <> '' then  writeln(SL_stderr.Text);      {$IFDEF LINUX}  // to be adjust with ping local language setting      if pos('rtt', SL_stdout.Text) > 0 then RunPing := True;      {$ELSE}     // to be adjust with ping local language setting      if pos('Dur', SL_stdout.Text) > 0 then RunPing := True;      {$ENDIF}   finally    Proc.Free;      SL_stdout.Free;      SL_stderr.Free;      Proc := nil;   end;end; var res : Boolean;begin    // use first parameter for host  if ParamCount > 0 then     begin     res :=  RunPing(ParamStr(1));     writeln('Ping Result : ', res)     end  else     Writeln('No Host passed.');end. ---------------------------------------------------------------------- rvk · 2025-08-22 08:44 Quote from: rvk on August 20, 2025, 03:15:05 pmAren't SOCK_DGRAM and IPPROTO_ICMP already available on older versions? And isn't it just that Trixie is only implementing this now in ping versions? In that case you could create your own ping function with SOCK_DGRAM and IPPROTO_ICMP without needing privileges. https://stackoverflow.com/questions/8290046/icmp-sockets-linux Like I stated before... wouldn't it be more useful to just create a ping procedure yourself which uses the SOCK_DGRAM and IPPROTO_ICMP ?? Because the netroup_range is normally set very wide, all users have access. (test with sysctl net.ipv4.ping_group_range) Here is a minimalistic ping program (uses just fpc functions). It just uses IP but you could easily expand it to also take host-names and resolve those to IPs). Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program minimalping; {$mode objfpc}uses  SysUtils, Sockets, BaseUnix, DateUtils; const  ICMP_ECHO      = 8;  ICMP_ECHOREPLY = 0;  TIMEOUT_SEC    = 2; type  TICMPHeader = packed record    icmp_type   : byte;    icmp_code   : byte;    icmp_cksum  : word;    icmp_id     : word;    icmp_seq    : word;  end; function Checksum(const Buf; Len: integer): word;var  sum: cardinal = 0;  i: integer;  p: PByte;begin  p := @Buf;  i := 0;  while i < Len - 1 do  begin    sum := sum + (p[i] shl 8 + p[i + 1]);    Inc(i,2);  end;  if (Len mod 2) <> 0 then    sum := sum + (p[Len-1] shl 8);   sum := (sum shr 16) + (sum and $FFFF);  sum := sum + (sum shr 16);  Result := not word(sum);end; procedure Ping(const Host: string);var  sock: cint;  sa: TInetSockAddr;  icmp: TICMPHeader;  buf: array[0..63] of byte;  n: integer;  id, seq: word;  sendTime, recvTime: TDateTime;  ms: integer;  fdset: TFDSet;  timeout: TTimeVal;begin  FillChar(sa, SizeOf(sa), 0);  sa.sin_family := AF_INET;  sa.sin_addr := StrToNetAddr(Host);   sock := fpSocket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);  if sock = -1 then    raise Exception.Create('Socket error');   id := word(FpGetPid);  seq := 1;  FillChar(icmp, SizeOf(icmp), 0);  icmp.icmp_type := ICMP_ECHO;  icmp.icmp_code := 0;  icmp.icmp_id := htons(id);  icmp.icmp_seq := htons(seq);  icmp.icmp_cksum := 0;  icmp.icmp_cksum := Checksum(icmp, SizeOf(icmp));   Move(icmp, buf, SizeOf(icmp));  sendTime := Now;  n := fpSendTo(sock, @buf, SizeOf(icmp), 0, @sa, SizeOf(sa));  if n < SizeOf(icmp) then    raise Exception.Create('Send error');   fpFD_ZERO(fdset);  fpFD_SET(sock, fdset);  timeout.tv_sec := TIMEOUT_SEC;  timeout.tv_usec := 0;  n := fpSelect(sock+1, @fdset, nil, nil, @timeout);  if n > 0 then  begin    n := fpRecv(sock, @buf, SizeOf(buf), 0);    recvTime := Now;    ms := MilliSecondsBetween(sendTime, recvTime);    WriteLn('Reply received! time=', ms, ' ms');  end  else  begin    WriteLn('Request timed out after ', TIMEOUT_SEC, ' seconds.');  end;  fpClose(sock);end; begin  if ParamCount <> 1 then  begin    WriteLn('Usage: minimalping ');    Halt(1);  end;  Ping(ParamStr(1));end. Quote$ ./minimalping 1.1.1.1 Reply received! time=9 ms $ ./minimalping 1.1.2.1 Request timed out after 2 seconds. $ ./minimalping google.com    # hostnames not yet implemented Reply received! time=0 ms $ sysctl net.ipv4.ping_group_range net.ipv4.ping_group_range = 0   2147483647 $ ---------------------------------------------------------------------- Dzandaa · 2025-08-22 09:41 Hi, @rvk: Thank you for the code. I will test it in one of my programs. B-> ---------------------------------------------------------------------- Hartmut · 2025-08-22 10:33 Quote from: Jurassic Pork on August 22, 2025, 03:06:27 ammay be the better solution is to use the system ping of your O.S because often you can execute it with any user. With Tprocess or better TprocessEx  from processutils unit of the fpcupdeluxe project because you can display output in RealTime , you can easily launch the system ping and get output to see if it is OK. Thanks a lot Jurassic Pork for that demo and for including unit 'processutils' from the fpcupdeluxe project because I did not have it before. I tested it and it works great. I included your code to my collection of useful sources. Quote from: Jurassic Pork on August 22, 2025, 09:25:12 amhere is a code to run a ping with one request and timeout of 1 second on Windows and linux  using TProcess . The function RunPing return True if ping is OK Thanks again. I learned something new because you used some features of TProcess I was not aware of. Quote from: rvk on August 22, 2025, 10:44:39 amwouldn't it be more useful to just create a ping procedure yourself which uses the SOCK_DGRAM and IPPROTO_ICMP ?? ... Here is a minimalistic ping program (uses just fpc functions). Thank you too rvk for this code. It's good to have an alternative. As a beginner to all this network stuff I understand nothing what you are doing there. Please: what are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results? Quote from: Thausand on August 22, 2025, 01:45:55 amQuote from: Hartmut on August 20, 2025, 04:06:57 pmDoes that mean:  - I create a new group and give it raw socket capability  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? This would be a great solution! Did you mean this? Yes, if understand correct then solution sysctl by rvk make possible and have that. Not have tested myself. If need help I need read instruction first Thanks Thausand for your reply. If I understand you correctly, it is possible to create a new group and give raw socket capability to this group. Your mentioned 'sysctl' I found only in reply #8 by rvk: Quote from: rvk on August 20, 2025, 03:27:31 pmI just checked in Bookworm and got this: Quote$ sudo sysctl -a | grep ping net.ipv4.ping_group_range = 0   2147483647 net.ipv4.tcp_pingpong_thresh = 1 Please can you tell me how to give raw socket capability to the new group? ---------------------------------------------------------------------- Thausand · 2025-08-22 11:56 Quote from: Hartmut on August 22, 2025, 12:33:31 pmThank you too rvk for this code. It's good to have an alternative. As a beginner to all this network stuff I understand nothing what you are doing there. Please: what are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results? Not name rvk but advantage rvk code is have all control (in code) and not rely 3th party executable (maybe some distribution/user not install ping). QuoteThanks Thausand for your reply. If I understand you correctly, it is possible to create a new group and give raw socket capability to this group. Your mentioned 'sysctl' I found only in reply #8 by rvk: Yes, correct but not exact. Have note I have not test. Make change option net.ipv4.ping_group_range make possible to have set groupID to restrict to GID. So make group, write groupIDd to option net.ipv4.ping_group_range , example group network have GID 100 then: Code: [Select]echo 'net.ipv4.ping_group_range = 100 100' | sudo tee -a /etc/sysctl.conf sudo sysctl -p But have seen f.e. fedora set for all user and groupID (range 0..2147483647). ---------------------------------------------------------------------- Hartmut · 2025-08-22 14:07 Quote from: Thausand on August 22, 2025, 01:56:00 pmQuote from: Hartmut on August 22, 2025, 12:33:31 pmThank you too rvk for this code. It's good to have an alternative. As a beginner to all this network stuff I understand nothing what you are doing there. Please: what are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results? Not name rvk but advantage rvk code is have all control (in code) and not rely 3th party executable (maybe some distribution/user not install ping). I think you misunderstood. The simple code of Jurassic Pork in reply #11 does not rely on 3th party executable (as far as I can see). Only his demos in reply #30 and #32 do call 3th party executable. QuoteQuoteThanks Thausand for your reply. If I understand you correctly, it is possible to create a new group and give raw socket capability to this group. Your mentioned 'sysctl' I found only in reply #8 by rvk: Yes, correct but not exact. Have note I have not test. Make change option net.ipv4.ping_group_range make possible to have set groupID to restrict to GID. So make group, write groupIDd to option net.ipv4.ping_group_range , example group network have GID 100 then: Code: [Select]echo 'net.ipv4.ping_group_range = 100 100' | sudo tee -a /etc/sysctl.conf sudo sysctl -p But have seen f.e. fedora set for all user and groupID (range 0..2147483647). Thanks a lot Thausand. I tried this, but unfortunately it did not work: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i # create a new group:hg6@a2100:/media/D/Tst$ sudo addgroup newgroup1info: Lege Gruppe »newgroup1« (GID 1002) an … # add current user to this group:sudo usermod -aG newgroup1 $USER # did logoff + logon so that last command works # check GID of new group:hg6@a2100:/media/D/Tst$ getent group newgroup1newgroup1:x:1002:hg6 # show current setting of net.ipv4.ping_group_range:hg6@a2100:/media/D/Tst$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1   0 # allow new group temporary:hg6@a2100:/media/D/Tst$ sudo sysctl net.ipv4.ping_group_range='1002 1002'[sudo] Passwort für hg6:net.ipv4.ping_group_range = 1002 1002 # verify new setting:hg6@a2100:/media/D/Tst$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1002        1002 But when I start now a program, which uses the PING feature of FPC package Synapse (which uses RAW sockets, for more details please see my very 1st post) it does not work. My goal is not enabling /usr/bin/ping, my goal is enabling  the PING feature of FPC package Synapse in a self written program, as I asked for: Quote from: Hartmut on August 22, 2025, 12:33:31 pmDoes that mean:  - I create a new group and give it raw socket capability  - then I add the current user to this group  - after this, all programs which are started by the current user, do not need sudo any longer to use the PING feature of Synapse? This would be a great solution! Did you mean this? Did we misunderstood? Or did I something wrong? ---------------------------------------------------------------------- rvk · 2025-08-22 14:29 Quote from: Hartmut on August 22, 2025, 04:07:23 pmDid we misunderstood? Or did I something wrong? net.ipv4.ping_group_range doesn't control the SOCK_RAW. It controls the  SOCK_DGRAM and capability to use IPPROTO_ICMP on that (it's via SOCK_DGRAM, so UDP). Some time ago... original ping used SOCK_RAW+IPPROTO_ICMP to send pings. Because RAW sockets where only for admin/root access, the ping program was tagged +s (setuid) so it executed as user root. Even if it was executed by a random non privileged user. There is an option to allow RAW for users (with groups and maybe for executable via setcap) but I'm not familiar with that. Later on... ping switched to SOCK_DGRAM+IPPROTO_ICMP, so no RAW sockets where needed. The ability of sending ICMP via SOCK_DGRAM is regulated by that sysctl net.ipv4.ping_group_range. (That's how I understand it now, but I could be wrong) For a raspberry pi it's standard set as net.ipv4.ping_group_range = 0   2147483647 Is this for you 0 1 ? What Linux are you running and what version?? On raspberry pi I can't even change the net.ipv4.ping_group_range. So could you test this app on a non privileged user with net.ipv4.ping_group_range set as 0 1 and as 0   2147483647 ?? (For this one you can pass hostnames like google.com etc.) Code: Pascal  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i program minimalping; {$mode objfpc}{$H+} uses  SysUtils, Sockets, BaseUnix, netdb, Unix, DateUtils; const  ICMP_ECHO = 8;  TIMEOUT_SEC = 2; type  TICMPHeader = packed record    icmp_type: byte;    icmp_code: byte;  icmp_cksum: word;    icmp_id: word;    icmp_seq: word;  end;   function myGetTickCount: qword;  var    tv: ttimeval;  begin    fpgettimeofday(@tv, nil);    Result := Int64(tv.tv_sec) * 1000000 + tv.tv_usec;  end;   function Checksum(const Buf; Len: integer): word;  var    sum: cardinal = 0;    i: integer;    p: pbyte;  begin    p := @Buf;    i := 0;    while i < Len - 1 do    begin      sum := sum + (p[i] shl 8 + p[i + 1]);      Inc(i, 2);    end;    if (Len mod 2) <> 0 then      sum := sum + (p[Len - 1] shl 8);     sum := (sum shr 16) + (sum and $FFFF);    sum := sum + (sum shr 16);    Result := not word(sum);  end;   function IsValidIP(IP: string): boolean;  var    H: THostEntry;  begin    Result := ResolveHostByAddr(StrToHostAddr(IP), H);  end;   function GetHostIP(HostName: string): string;  var    H: THostEntry;  begin    if ResolveHostByName(HostName, H) then      Result := HostAddrToStr(NetToHost(H.Addr))    else      Result := '';  end;   function PingHost(const Host: string; var IP: string): double;  var    sock: cint;    sa: TInetSockAddr;    icmp: TICMPHeader;    buf: array[0..63] of byte;    n: integer;    id, seq: word;    sendTime, recvTime: qword;    ms: double;    fdset: TFDSet;    timeout: TTimeVal;  begin    Result := -99;     ip := host;    if not IsValidIP(ip) then    begin      ip := GetHostIP(host);      if ip = '' then        exit(-1); // WriteLn('Could not resolve ', host);    end;    writeln('ip ', ip);     FillChar(sa, SizeOf(sa), 0);    sa.sin_family := AF_INET;    sa.sin_addr := StrToNetAddr(ip);     sock := fpSocket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);    if sock = -1 then    exit(-2); // Socket error     id := word(FpGetPid);    seq := 1;  FillChar(icmp, SizeOf(icmp), 0);    icmp.icmp_type := ICMP_ECHO;    icmp.icmp_code := 0;    icmp.icmp_id := htons(id);    icmp.icmp_seq := htons(seq);    icmp.icmp_cksum := 0;    icmp.icmp_cksum := Checksum(icmp, SizeOf(icmp));     Move(icmp, buf, SizeOf(icmp));    sendTime := myGetTickCount;    n := fpSendTo(sock, @buf, SizeOf(icmp), 0, @sa, SizeOf(sa));    if n < SizeOf(icmp) then    begin      fpClose(sock);      exit(-3); // unknown error, reply smaller than icmp    end;     fpFD_ZERO(fdset);    fpFD_SET(sock, fdset);    timeout.tv_sec := TIMEOUT_SEC;    timeout.tv_usec := 0;    n := fpSelect(sock + 1, @fdset, nil, nil, @timeout);    if n > 0 then    begin      n := fpRecv(sock, @buf, SizeOf(buf), 0);      recvTime := myGetTickCount;      ms := (recvTime - sendTime) / 1000;      Result := ms;    end;    fpClose(sock);  end; var  host, ip: string;  ms: double;begin  if ParamCount <> 1 then  begin    WriteLn('Usage: minimalping ');    Halt(1);  end;  host := ParamStr(1);  WriteLn('Pinging: ', host);  ms := PingHost(host, ip);  WriteLn('Result: ', ip, ' = ', ms: 0: 3, ' ms');end. Quote# ./minimalping google.com Pinging: google.com ip 172.217.23.206 Result: 172.217.23.206 = 9.418 ms ---------------------------------------------------------------------- Thausand · 2025-08-22 15:50 Quote from: rvk on August 22, 2025, 04:29:46 pm... (That's how I understand it now, but I could be wrong) ... After read I have same understanding. Have raw socket can do when use setcap. When use sysctl then use IPPROTO and have other implementation not use raw socket. @Hartmut I have look for setcap with group but think is not common and have look other solution jurrassic pork because I look for wrong example and wrong replied. ---------------------------------------------------------------------- Dzandaa · 2025-08-22 16:28 Hi, @rvk: For info: I tried your last version on Linux Mint 22.1 Lazarus 3.8 FPC 3.2.2 and it always return -2. B-> ---------------------------------------------------------------------- rvk · 2025-08-22 16:32 Quote from: Thausand on August 22, 2025, 05:50:07 pmI have look for setcap with group but think is not common and have look other solution jurrassic pork because I look for wrong example and wrong replied. The setcap command in Linux is intended to add or remove file capabilities from a binary, and is not directly meant for setting capabilities for a group. AFAIK there is no group-based mechanism in Linux for allowing raw socket access. Quote from: Dzandaa on August 22, 2025, 06:28:03 pmI tried your last version on Linux Mint 22.1 Lazarus 3.8 FPC 3.2.2 and it always return -2. Does it work with root? I'll try it later in a VM. ---------------------------------------------------------------------- Hartmut · 2025-08-22 16:34 Quote from: rvk on August 22, 2025, 04:29:46 pmnet.ipv4.ping_group_range doesn't control the SOCK_RAW. It controls the  SOCK_DGRAM and capability to use IPPROTO_ICMP on that (it's via SOCK_DGRAM, so UDP). Ok, I understand. Then it won't help for to use the PING feature of Synapse. Thanks for clarification. QuoteThere is an option to allow RAW for users (with groups and maybe for executable via setcap) but I'm not familiar with that. If someone else is familiar with how to allow RAW sockets by groups I would be very interested. QuoteFor a raspberry pi it's standard set as net.ipv4.ping_group_range = 0   2147483647 Is this for you 0 1 ? What Linux are you running and what version?? My standard for net.ipv4.ping_group_range is: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:/media/D/Tst$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1   0 I use Ubuntu 24.04 with KDE-Desktop. QuoteSo could you test this app on a non privileged user with net.ipv4.ping_group_range set as 0 1 and as 0   2147483647 ?? Here are the results for standard net.ipv4.ping_group_range with FPC 3.2.2: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:~$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1   0 hg6@a2100:~$ miniping google.dePinging: google.deip 142.250.186.131Result: 142.250.186.131 = -2.000 ms hg6@a2100:~$ ping google.de -4 -c 4PING google.de (142.250.186.131) 56(84) bytes of data.64 bytes from fra24s07-in-f3.1e100.net (142.250.186.131): icmp_seq=1 ttl=119 time=13.4 ms64 bytes from fra24s07-in-f3.1e100.net (142.250.186.131): icmp_seq=2 ttl=119 time=12.9 ms64 bytes from fra24s07-in-f3.1e100.net (142.250.186.131): icmp_seq=3 ttl=119 time=12.9 ms64 bytes from fra24s07-in-f3.1e100.net (142.250.186.131): icmp_seq=4 ttl=119 time=12.9 ms --- google.de ping statistics ---4 packets transmitted, 4 received, 0% packet loss, time 3004msrtt min/avg/max/mdev = 12.900/13.045/13.433/0.224 mshg6@a2100:~$You see that result 'ms' is negative... (but the ip-address is correct). Here are the results for net.ipv4.ping_group_range of 0 2147483647: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:~$ sudo sysctl net.ipv4.ping_group_range='0 2147483647'[sudo] Passwort für hg6:net.ipv4.ping_group_range = 0 2147483647hg6@a2100:~$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 0   2147483647 hg6@a2100:~$ miniping google.dePinging: google.deip 142.250.74.195Result: 142.250.74.195 = 17.600 mshg6@a2100:~$ May I ask again: What are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results (beside that your's can resolve a hostname to it's ip-address)? Quote from: Thausand on August 22, 2025, 05:50:07 pmI have look for setcap with group but think is not common and have look other solution jurrassic pork because I look for wrong example and wrong replied. Ok. ---------------------------------------------------------------------- Hartmut · 2025-08-22 16:49 Quote from: rvk on August 22, 2025, 06:32:25 pmQuote from: Dzandaa on August 22, 2025, 06:28:03 pmI tried your last version on Linux Mint 22.1 Lazarus 3.8 FPC 3.2.2 and it always return -2. Does it work with root? If I start your code with setting net.ipv4.ping_group_range = '1 0' then I always get 'ms' = -2 ms (also with sudo). If I start your code with setting net.ipv4.ping_group_range = '0 2147483647' then I always get a 'ms' near 17 ms (with and without sudo). ---------------------------------------------------------------------- rvk · 2025-08-22 16:50 Quote from: Hartmut on August 22, 2025, 06:34:24 pmHere are the results for net.ipv4.ping_group_range of 0 2147483647: Ok, then it works. That confirms that SOCK_DGRAM, IPPROTO_ICMP works with net.ipv4.ping_group_range set correctly (to include the wide range). Quote from: Hartmut on August 22, 2025, 06:34:24 pmMay I ask again: What are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results (beside that your's can resolve a hostname to it's ip-address)?Well, code in #11 uses TCP/port combination. So you need to know which port the server has open (http, https, ftp, VoIP etc). But... not all services listen to the TCP protocol. You also have UDP protocol. A VoIP server for instance is normally listening on UDP (sometimes both UDP and TCP). The code in #11 doesn't check for UDP ports. ICMP PING (Echo Request) is just another method of checking for presence on the network. But... not all servers or computers have to respond to ICMP PING requests. Servers on the internet normally do (because it's a usual way of checking if the server is up). But for example lots of consumer routers (for example your own router) could have ICMP reply set to off (usually this is an option to set on or off in the router). So ICMP is not guaranteed but it is very common under open servers on the internet. So ICMP PING could just be one of the mechanisms you use to check if a server is up. For actual internet servers is the easiest because you don't have to know what service and ports you need to check. But if you want to know if a HTTPS (web-server) is up, you can directly check for TCP/443 or TCP/80. Quote from: Hartmut on August 22, 2025, 06:49:11 pmIf I start your code with setting net.ipv4.ping_group_range = '1 0' then I always get 'ms' = -2 ms (also with sudo). If I start your code with setting net.ipv4.ping_group_range = '0 2147483647' then I always get a 'ms' near 17 ms (with and without sudo). 1 to 0 seems like nobody can use SOCK_DGRAM, IPPROTO_ICMP. Not even root. 0 to 0 or 0 to 1 would include root (0). But 1 to 0 is nothing. I wonder if that's the default setting in that distro? ---------------------------------------------------------------------- Hartmut · 2025-08-22 17:05 Quote from: rvk on August 22, 2025, 06:50:58 pmQuote from: Hartmut on August 22, 2025, 06:34:24 pmMay I ask again: What are the advantages of using your code compared with the very simple code of Jurassic Pork in reply #11? In which cases would your code give better results (beside that your's can resolve a hostname to it's ip-address)?Well, code in #11 uses TCP/port combination. So you need to know which port the server has open (http, https, ftp, VoIP etc). But... not all services listen to the TCP protocol. You also have UDP protocol. A VoIP server for instance is normally listening on UDP (sometimes both UDP and TCP). The code in #11 doesn't check for UDP ports. ICMP PING (Echo Request) is just another method of checking for presence on the network. But... not all servers or computers have to respond to ICMP PING requests. Servers on the internet normally do (because it's a usual way of checking if the server is up). But for example lots of consumer routers (for example your own router) could have ICMP reply set to off (usually this is an option to set on or off in the router). So ICMP is not guaranteed but it is very common under open servers on the internet. Thanks for clarification. Again I learned something :-) QuoteQuote from: Hartmut on August 22, 2025, 06:49:11 pmIf I start your code with setting net.ipv4.ping_group_range = '1 0' then I always get 'ms' = -2 ms (also with sudo). If I start your code with setting net.ipv4.ping_group_range = '0 2147483647' then I always get a 'ms' near 17 ms (with and without sudo). 1 to 0 seems like nobody can use SOCK_DGRAM, IPPROTO_ICMP. Not even root. I wonder if that's the default setting in that distro? I'm 100% sure that I never touched this setting before, because I was faced with this setting now the very 1st time. ---------------------------------------------------------------------- rvk · 2025-08-22 17:14 Quote from: Hartmut on August 22, 2025, 06:49:11 pmIf I start your code with setting net.ipv4.ping_group_range = '1 0' then I always get 'ms' = -2 ms (also with sudo). If I start your code with setting net.ipv4.ping_group_range = '0 2147483647' then I always get a 'ms' near 17 ms (with and without sudo). 1 to 0 seems like nobody can use SOCK_DGRAM, IPPROTO_ICMP. Not even root. 0 to 0 or 0 to 1 would include root (0). But 1 to 0 is nothing. I wonder if that's the default setting in that distro? It seems 1 to 0 is indeed default on some systems. Meaning not even root can do ping trough SOCK_DGRAM, IPPROTO_ICMP. Can you check what ping does if it is set to 1 to 0? Did it revert back to RAW sockets? You can check with strace -e socket ping google.com ---------------------------------------------------------------------- Hartmut · 2025-08-22 17:40 Quote from: rvk on August 22, 2025, 07:14:09 pmCan you check what ping does if it is set to 1 to 0? Did it revert back to RAW sockets? You can check with strace -e socket ping google.com Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:~$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1   0hg6@a2100:~$ hg6@a2100:~$ strace -e socket ping google.comsocket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCES (Keine Berechtigung)socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Vorgang nicht zulässig)socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6) = -1 EACCES (Keine Berechtigung)socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6) = -1 EPERM (Vorgang nicht zulässig)ping: socktype: SOCK_RAWping: socket: Vorgang nicht zulässigping: => missing cap_net_raw+p capability or setuid?+++ exited with 2 +++hg6@a2100:~$"Keine Berechtigung" means "No permission". "Vorgang nicht zulässig" means "transaction not allowed". Then I set range to '0 2147483647' and then it worked: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:~$ sudo sysctl net.ipv4.ping_group_range='0 2147483647'net.ipv4.ping_group_range = 0 2147483647 hg6@a2100:~$ strace -e socket ping google.comsocket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = 3socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6) = 4socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 5socket(AF_NETLINK, SOCK_RAW|SOCK_CLOEXEC, NETLINK_ROUTE) = 5socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 5socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 5socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = 5PING google.com (2a00:1450:4001:828::200e) 56 data bytessocket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, IPPROTO_IP) = 564 bytes from fra24s05-in-x0e.1e100.net (2a00:1450:4001:828::200e): icmp_seq=1 ttl=119 time=13.6 ms64 bytes from fra24s05-in-x0e.1e100.net (2a00:1450:4001:828::200e): icmp_seq=2 ttl=119 time=13.0 ms64 bytes from fra24s05-in-x0e.1e100.net (2a00:1450:4001:828::200e): icmp_seq=3 ttl=119 time=13.3 ms...^Cstrace: Process 6628 detached --- google.com ping statistics ---8 packets transmitted, 8 received, 0% packet loss, time 7005msrtt min/avg/max/mdev = 12.808/13.095/13.642/0.279 mshg6@a2100:~$ Must now stop for today. ---------------------------------------------------------------------- rvk · 2025-08-22 17:47 Quote from: Hartmut on August 22, 2025, 07:40:15 pm"Keine Berechtigung" means "No permission". "Vorgang nicht zulässig" means "transaction not allowed". Then I set range to '0 2147483647' and then it worked: I assume running ping doesn't work at all as user? That confirms that ping first tries SOCK_DGRAM+IPPROTO_ICMP. If that doesn't work, because 0 (root group) is excluded from net.ipv4.ping_group_range (because 1 to 0 doesn't include 0), then it tries SOCK_RAW. But you tried this as user which fails because user does not have RAW socket access. Running this as root probably should have worked (with SOCK_RAW). ---------------------------------------------------------------------- MarkMLl · 2025-08-22 18:12 I must admit that I wasn't aware of the net.ipv4.ping_group_range facility, hence was possibly excessively critical of the idea of using an appropriate group earlier in the thread for which I apologise. In the general case though, I don't know how many of the POSIX capabilities can also be controlled by groups in this manner: a quick reading of earlier messages suggests that even in the case of the network it's by no means complete, so having a basic understanding of the POSIX capabilities is useful. On a more positive note, while setting up a group and including it in the net.ipv4.ping_group_range list needs appropriate permission (i.e. in practice the user has to be root, or has to have an appropriately blessed script): * setting the group of a freshly-compiled binary and setting its setgid flag is unprivileged, * moving a binary or copying it with  cp -p  preserves its group and setgid state. So /if/ it's a capability which can be mimicked by group membership, and /if/ the system owner is prepared to risk compromising robustness, then this is something which is within the scope of an unmodified (and unprivileged) development environment. MarkMLl ---------------------------------------------------------------------- rvk · 2025-08-22 18:37 From our AI friend: QuoteThe default value for net.ipv4.ping_group_range is typically 1 0, which means no groups are allowed to create ICMP echo sockets, effectively preventing unprivileged users from pinging. Some distributions and newer kernel versions, like Fedora, have started enabling this setting by default to a broad range (e.g., 0 2147483647) to allow unprivileged users to use ping in scenarios like rootless containers. To change it, you can add the sysctl setting to a file in /etc/sysctl.d/ and then run sudo sysctl --system. So I guess it's just a matter of time before 0 2147483647 is standard. ---------------------------------------------------------------------- MarkMLl · 2025-08-22 20:10 Quote from: rvk on August 22, 2025, 08:37:03 pmSo I guess it's just a matter of time before 0 2147483647 is standard. Taking quips like "Well /you/ might have an AI friend but I prefer the cuddly kind..." as read, I think the problem here is that even if that range is not the distro's standard there's a real risk that installation of e.g. a network monitoring package injects a file into /etc/sysctl.d which potentially weakens system robustness for everybody: note that the parameters are a range, and that there's no provision for selecting individual groups or for having multiple ranges. There's a problem here. Programs such as a network monitor (Nagios or similar) are encouraged to run as their own user rather than root, which encourages the use of special-purpose groups... no, I'm sorry but I think POSIX capabilities applied to individual binaries are preferable, even if applying the blessing requires root privilege and even if tinkering with the binary obliterates the extra capabilities. MarkMLl ---------------------------------------------------------------------- rvk · 2025-08-22 20:20 Quote from: MarkMLl on August 22, 2025, 10:10:21 pmThere's a problem here. Programs such as a network monitor (Nagios or similar) are encouraged to run as their own user rather than root, which encourages the use of special-purpose groups... no, I'm sorry but I think POSIX capabilities applied to individual binaries are preferable, even if applying the blessing requires root privilege and even if tinkering with the binary obliterates the extra capabilities. So what's the harm for a distro to preset the net.ipv4.ping_group_range to a wide range like 0 2147483647? It only effects ICMP. And it can only be set and changed by root. Setting it to 1 0 might be more dangerous as installers need (or want) to change it and can only do that as root. So it might be better to just directly set it correctly in the distro. Or am I wrong? And sure, there might always be distros which are more restricted and might have blocked this. Running ping as user isn't allowed then (which seems the default now). That's the reason you could build in more methods for detecting a servers presence. ---------------------------------------------------------------------- MarkMLl · 2025-08-23 07:09 Quote from: rvk on August 22, 2025, 10:20:49 pmSo what's the harm for a distro to preset the net.ipv4.ping_group_range to a wide range like 0 2147483647? It only effects ICMP. And it can only be set and changed by root. What precise facilities are checked and blocked by the kernel? If arbitrary programs were allowed to do this, could somebody find a way of e.g. spoofing error reports which normally come over ICMP? Even if it's only "ICMP Echo"?, could it be used for a DoS of DDoS? The prohibition on arbitrary programs doing this must have been put in for some reason, and by and large history shows that unix's approach to this sort of thing has been fairly good in system stability terms. MarkMLl ---------------------------------------------------------------------- Hartmut · 2025-08-23 07:21 Quote from: rvk on August 22, 2025, 07:47:39 pmQuote from: Hartmut on August 22, 2025, 07:40:15 pm"Keine Berechtigung" means "No permission". "Vorgang nicht zulässig" means "transaction not allowed". Then I set range to '0 2147483647' and then it worked: I assume running ping doesn't work at all as user? No. As you can see in reply #42, ping works without problems as unprivileged user, even if net.ipv4.ping_group_range is set to '1 0'. The reason is, that ping in Kubuntu 24.04 has 'cap_net_raw' capability set: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@i3300:~$ which ping/usr/bin/pinghg6@i3300:~$ getcap /usr/bin/ping/usr/bin/ping cap_net_raw=ephg6@i3300:~$ ---------------------------------------------------------------------- rvk · 2025-08-23 07:25 Quote from: Hartmut on August 23, 2025, 09:21:43 amQuote from: rvk on August 22, 2025, 07:47:39 pmI assume running ping doesn't work at all as user? No. As you can see in reply #42, ping works without problems as unprivileged user, even if net.ipv4.ping_group_range is set to '1 0'. The reason is, that ping in Kubuntu 24.04 has 'cap_net_raw' capability set: Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@i3300:~$ which ping/usr/bin/pinghg6@i3300:~$ getcap /usr/bin/ping/usr/bin/ping cap_net_raw=ephg6@i3300:~$Then why did your strace ping command in #47 +++ exited with 2 +++ ?? Quote from: Hartmut on August 22, 2025, 07:40:15 pmCode: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i hg6@a2100:~$ sysctl net.ipv4.ping_group_rangenet.ipv4.ping_group_range = 1   0hg6@a2100:~$ hg6@a2100:~$ strace -e socket ping google.comsocket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCES (Keine Berechtigung)socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = -1 EPERM (Vorgang nicht zulässig)socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6) = -1 EACCES (Keine Berechtigung)socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6) = -1 EPERM (Vorgang nicht zulässig)ping: socktype: SOCK_RAWping: socket: Vorgang nicht zulässigping: => missing cap_net_raw+p capability or setuid?+++ exited with 2 +++hg6@a2100:~$"Keine Berechtigung" means "No permission". "Vorgang nicht zulässig" means "transaction not allowed". ---------------------------------------------------------------------- Hartmut · 2025-08-23 07:46 Quote from: rvk on August 23, 2025, 09:25:12 amThen why did your strace ping command in #47 +++ exited with 2 +++ ?? I have absolute no idea, sorry. I repeated both and got the same results as before: ping without strace works, ping with strace works not. I don't know strace, I used it now for the very 1st time. Seems that it calls ping in a way, that it's 'cap_net_raw' capability does not work...? ---------------------------------------------------------------------- rvk · 2025-08-23 08:00 Quote from: Hartmut on August 23, 2025, 09:46:06 amQuote from: rvk on August 23, 2025, 09:25:12 amThen why did your strace ping command in #47 +++ exited with 2 +++ ?? I have absolute no idea, sorry. I repeated both and got the same results as before: ping without strace works, ping with strace works not. I don't know strace, I used it now for the very 1st time. Seems that it calls ping in a way, that it's 'cap_net_raw' capability does not work...? Ok, yes, that might be a possibility. Also see https://superuser.com/questions/1219283/is-it-possible-to- strace-pinging-a-host Same goes for the setguid (which ping used before the cap_net_raw and sudo still uses). https://superuser.com/questions/1059198/why-strace-sudo-command-bombs- when-sudo-command-works So, in the past ping first used the setuid root method. Later on, it switched to capability (with cap_net_raw). After that, it switched to SOCK_DGRAM + IPPROTO_ICMP and net.ipv4.ping_group_range ---------------------------------------------------------------------- MarkMLl · 2025-08-23 08:01 Quote from: Hartmut on August 23, 2025, 09:46:06 amQuote from: rvk on August 23, 2025, 09:25:12 amThen why did your strace ping command in #47 +++ exited with 2 +++ ?? I have absolute no idea, sorry. I repeated both and got the same results as before: ping without strace works, ping with strace works not. I don't know strace, I used it now for the very 1st time. Seems that it calls ping in a way, that it's 'cap_net_raw' capability does not work...? Capabilities are revoked if running under a debugger. When debugging this sort of thing I've generally had to run the program as root under gdbserver, then connect to that from the IDE... I can't remember whether the IDE's facility to connect to an already- running program also works. MarkMLl