gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/networking-interfaces: fix rootless ping

Browse Source 
In 759ec111 the ping setuid wrapper was removed in favour of giving
permissions to perform ICMP echo requests to all users.
The problem is that the systemd file that was supposed to change the
`net.ipv4.ping_group_range` sysctl is not always installed, specifically
only if systemd.coredump.enable.
In that case the range is "0 1", which is effectively restricts ping to
only root.

This change explicitely sets the range to "0 2^31-1", as systemd does.
This commit is contained in:
rnhmjoj
2023-12-11 13:22:26 +01:00
parent 067ac02817
commit cdc24ab409
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/tasks/network-interfaces.nix
+2
View File
@@ -1396,6 +1396,8 @@ in
"net.ipv4.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
"net.ipv6.conf.all.disable_ipv6" = mkDefault (!cfg.enableIPv6);
"net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
# allow all users to do ICMP echo requests (ping)
"net.ipv4.ping_group_range" = mkDefault "0 2147483647";
# networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
"net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
} // listToAttrs (forEach interfaces