From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202608 header.b=KF83S4Fz; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 1B7C85A0265 for ; Thu, 20 Aug 2026 09:17:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202608; t=1787210274; bh=Ht1BdU8Dk/M2IU5ldrc6YX5x+NPNeyO+GEjSLFjwbHs=; h=From:To:Cc:Subject:Date:From; b=KF83S4FzslrwTmO6fbLn7e93gA+QFS8Ju+S68dcRXB7s+tdWQyG8hAfteqkP4cE73 SHxNaeTAzmNhMQcD06AOeXvIdNiuWJgxymZLFrX0ngcM98dnPjAg7PVVFGaj2D/Jmy BBCmb26ALf5PaLF7PTkZsEAQ99OTHPZJpHqv4Kelop8mPHMrcPTjbEZ6NgroRtpqjp eC+Jhzt4VBn5dxPn/YMpRbAMc+nrdoRv0MWZs5wQxvjGs7rN7FvbgwNTVlgVsyJWgW bCSVHiLji7abG9y3Mx5MqDhkaYJjPvgG7cmdBMg1fUIfM/Vm8U07C7PyrWdA3znAzR A3nn73iZWz4+g== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4hQZXL52dmz4wHY; Thu, 20 Aug 2026 17:17:54 +1000 (AEST) From: David Gibson To: passt-dev@passt.top, Laurent Vivier , Stefano Brivio Subject: [PATCH] RFC: Don't override system's default ping_group_range for pasta Date: Thu, 20 Aug 2026 17:17:48 +1000 Message-ID: <20260820071748.1014070-1-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: YDM5QFLCZBTWCOISOZ2YGPCX2HUJLB7Q X-Message-ID-Hash: YDM5QFLCZBTWCOISOZ2YGPCX2HUJLB7Q X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl to 0 0, meaning only group 0 can use ping sockets within the namespace. Since group 0 is the only one we map in the userns, that's equivalent to anyone being able to use ping sockets. Although the kernel default for this is 1 0 (nobody can use ping sockets), common distros - at least ones using systemd or even just systemd-udevd - appear to set it to "0 2147483647" meaning effectively anyone can use ping sockets. There's no obvious reason that we need to override the system's default behaviour here. The override was introduced in 32d07f5e5 ("passt, pasta: Completely avoid dynamic memory allocation") as part of a large chunk which kind of looks like it was meant to be in another patch, so the git history isn't particularly informative. Signed-off-by: David Gibson --- pasta.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/pasta.c b/pasta.c index 5aa56b78..4248b508 100644 --- a/pasta.c +++ b/pasta.c @@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg) if (mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc"); - if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) - warn("Cannot set ping_group_range, ICMP requests might fail"); - a = (const struct pasta_spawn_cmd_arg *)arg; conf_hostname_len = strlen(a->c->hostname); -- 2.55.0