[PATCH] RFC: Don't override system's default ping_group_range for pasta

[PATCH] RFC: Don't override system's default ping_group_range for pasta

[David Gibson]

When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl
to 0 0, meaning only group 0 can use ping sockets within the namespace.
Since group 0 is the only one we map in the userns, that's equivalent to
anyone being able to use ping sockets.

Although the kernel default for this is 1 0 (nobody can use ping sockets),
common distros - at least ones using systemd or even just systemd-udevd -
appear to set it to "0	2147483647" meaning effectively anyone can use
ping sockets.

There's no obvious reason that we need to override the system's default
behaviour here.  The override was introduced in 32d07f5e5 ("passt, pasta:
Completely avoid dynamic memory allocation") as part of a large chunk which
kind of looks like it was meant to be in another patch, so the git history
isn't particularly informative.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 pasta.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pasta.c b/pasta.c
index 5aa56b78..4248b508 100644
--- a/pasta.c
+++ b/pasta.c
@@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg)
 	if (mount("", "/proc", "proc", 0, NULL))
 		warn_perror("Couldn't mount /proc");
 
-	if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0"))
-		warn("Cannot set ping_group_range, ICMP requests might fail");
-
 	a = (const struct pasta_spawn_cmd_arg *)arg;
 
 	conf_hostname_len = strlen(a->c->hostname);
-- 
2.55.0

Re: [PATCH] RFC: Don't override system's default ping_group_range for pasta

[Stefano Brivio]

On Thu, 20 Aug 2026 17:17:48 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl
> to 0 0, meaning only group 0 can use ping sockets within the namespace.
> Since group 0 is the only one we map in the userns, that's equivalent to
> anyone being able to use ping sockets.
> 
> Although the kernel default for this is 1 0 (nobody can use ping sockets),
> common distros - at least ones using systemd or even just systemd-udevd -
> appear to set it to "0	2147483647" meaning effectively anyone can use
> ping sockets.

This wasn't the case on CirrOS (https://github.com/cirros-dev/cirros)
and on some more common distributions. For example Alpine sets it to
"999 59999", so group 0 is excluded.

I haven't checked other distributions not running systemd, but I would
expect similar outcomes.

> There's no obvious reason that we need to override the system's default
> behaviour here.  The override was introduced in 32d07f5e5 ("passt, pasta:
> Completely avoid dynamic memory allocation") as part of a large chunk which
> kind of looks like it was meant to be in another patch, so the git history
> isn't particularly informative.

Kind of: the override was actually introduced by 089dec90ca99 ("pasta:
Set ping_group_range upon namespace creation"), which I dropped by mistake
(pasta.c not committed) in 675174d4ba25 ("conf, tap: Split netlink and
pasta functions, allow interface configuration"), and finally added back
by committing pasta.c in 32d07f5e59f2 ("passt, pasta: Completely avoid
dynamic memory allocation").

It's not really informative anyway. But, in any case, unless this does
any harm, I'd rather keep the override, because ping might otherwise
break on a number of distributions.

> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>  pasta.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/pasta.c b/pasta.c
> index 5aa56b78..4248b508 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg)
>  	if (mount("", "/proc", "proc", 0, NULL))
>  		warn_perror("Couldn't mount /proc");
>  
> -	if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0"))
> -		warn("Cannot set ping_group_range, ICMP requests might fail");
> -
>  	a = (const struct pasta_spawn_cmd_arg *)arg;
>  
>  	conf_hostname_len = strlen(a->c->hostname);

-- 
Stefano