Re: [PATCH] RFC: Don't override system's default ping_group_range for pasta

[Stefano Brivio <sbrivio@redhat.com>]

On Thu, 20 Aug 2026 17:17:48 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl
> to 0 0, meaning only group 0 can use ping sockets within the namespace.
> Since group 0 is the only one we map in the userns, that's equivalent to
> anyone being able to use ping sockets.
> 
> Although the kernel default for this is 1 0 (nobody can use ping sockets),
> common distros - at least ones using systemd or even just systemd-udevd -
> appear to set it to "0	2147483647" meaning effectively anyone can use
> ping sockets.

This wasn't the case on CirrOS (https://github.com/cirros-dev/cirros)
and on some more common distributions. For example Alpine sets it to
"999 59999", so group 0 is excluded.

I haven't checked other distributions not running systemd, but I would
expect similar outcomes.

> There's no obvious reason that we need to override the system's default
> behaviour here.  The override was introduced in 32d07f5e5 ("passt, pasta:
> Completely avoid dynamic memory allocation") as part of a large chunk which
> kind of looks like it was meant to be in another patch, so the git history
> isn't particularly informative.

Kind of: the override was actually introduced by 089dec90ca99 ("pasta:
Set ping_group_range upon namespace creation"), which I dropped by mistake
(pasta.c not committed) in 675174d4ba25 ("conf, tap: Split netlink and
pasta functions, allow interface configuration"), and finally added back
by committing pasta.c in 32d07f5e59f2 ("passt, pasta: Completely avoid
dynamic memory allocation").

It's not really informative anyway. But, in any case, unless this does
any harm, I'd rather keep the override, because ping might otherwise
break on a number of distributions.

> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>  pasta.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/pasta.c b/pasta.c
> index 5aa56b78..4248b508 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg)
>  	if (mount("", "/proc", "proc", 0, NULL))
>  		warn_perror("Couldn't mount /proc");
>  
> -	if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0"))
> -		warn("Cannot set ping_group_range, ICMP requests might fail");
> -
>  	a = (const struct pasta_spawn_cmd_arg *)arg;
>  
>  	conf_hostname_len = strlen(a->c->hostname);

-- 
Stefano