Allow Wine ICMP/ping without running as root

[Scott Ritchie]

Binary package hint: wine1.2

The program Ping Plotter is a network analysis tool that works under Wine, but only when run as root. Running Wine as root is something that should be avoided, both for security and usability reasons (sudo can mess up the ownership of files in the Wine folder).

One option is to use an SELinux feature and give Wine CAP_NET_RAW capability, which is something that should be done for the system ping as well (which I believe currently runs setuid root). The downside would be that any Windows program could then open raw sockets.

An old mail suggests another possibility: http://www.winehq.org/pipermail/wine-devel/2007-December/061479.html -- splitting Wine into different binaries with different permissions levels. I'm not sure how viable this is, as it would depend on splitting off different parts of the Windows API into secured and non-secured functions and then moving those functions into separate binaries. That would only be useful if there was an actual restricted (non-general) use of raw sockets in the API.

[Ken Sharp (kennybobs)]

$man ping

"SECURITY
       ping requires CAP_NET_RAWIO capability to be executed. It may be used as set-uid root."

[Dmitry-codeweavers (dmitry-codeweavers)]

This is a Linux kernel limitation not a Wine one.

[Dmitry-codeweavers (dmitry-codeweavers)]

Closing invalid.

[Austin English (austinenglish)]

I tried testing a couple batch scripts I use at work on wine. Since batch doesn't have a 'sleep command', the common workaround is to use ping several times instead, which works fine on windows. Wine, however, lacks ping, so it fails miserably.

Implementing our own ping.exe shouldn't be too terribly hard. There are several open source versions floating around to base the work off of. Hell, here's the original public domain source:
http://www.ping127001.com/pingpage/ping.text

[Vitaliy-bugzilla (vitaliy-bugzilla)]

(In reply to comment #0)
> Implementing our own ping.exe shouldn't be too terribly hard.
But it will require root privileges to run...

[Austin English (austinenglish)]

(In reply to comment #1)
> (In reply to comment #0)
> > Implementing our own ping.exe shouldn't be too terribly hard.
> But it will require root privileges to run...

Could perhaps just use a wrapper around the system's ping.

[Scott Ritchie (scottritchie)]

Binary package hint: wine1.2

The program Ping Plotter is a network analysis tool that works under Wine, but only when run as root. Running Wine as root is something that should be avoided, both for security and usability reasons (sudo can mess up the ownership of files in the Wine folder).

One option is to use an SELinux feature and give Wine CAP_NET_RAW capability, which is something that should be done for the system ping as well (which I believe currently runs setuid root). The downside would be that any Windows program could then open raw sockets.

An old mail suggests another possibility: http://www.winehq.org/pipermail/wine-devel/2007-December/061479.html -- splitting Wine into different binaries with different permissions levels. I'm not sure how viable this is, as it would depend on splitting off different parts of the Windows API into secured and non-secured functions and then moving those functions into separate binaries. That would only be useful if there was an actual restricted (non-general) use of raw sockets in the API.

[Steve Dodier-Lazaro (sidi)]

I think a solution could be to set the correct capability in the binary that does the ping itself, which could be done in Wine's Makefile (unless the app Daniel K. Attling uses is trying to send the ping packet on it's own, in which case there is nothing to do to workaround this bug).

[Pa78 (pa78)]

No matter if it's a bug or a linux kernel security limitation. There must be a proper solution!

I would need it for eMule's UploadSpeedSense feature... :(((

[Peter-Alexander (pp78)]

No matter if it's a bug or a linux kernel security limitation. There must be a proper solution!

I would need it for eMule's UploadSpeedSense feature... :(((

[Sergiy Zuban (s-zuban)]

try sudo setcap cap_net_raw+epi /usr/bin/wine-preloader

[rusivi2 (rusivi2-deactivatedaccount)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!

[rusivi2 (rusivi2-deactivatedaccount)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. My apologies as I should not have marked this Invalid. The issue that you reported is one that should be reproducible with the live environment of the Desktop CD of the development release - Maverick Meerkat. It would help us greatly if you could test with it so we can work on getting it fixed in the next release of Ubuntu. You can find out more about the development release at http://www.ubuntu.com/testing/ . Thanks again and we appreciate your help.

[Scott Ritchie (scottritchie)]

rusivi1 please read the bug reports more carefully before giving automated responses.

CAP_NET_RAW on the Wine binary is not the correct solution, as that gives all Windows programs raw socket capability (which they no longer expect, as Windows itself disabled this around XP service pack 2)

The real solution (also at http://bugs.winehq.org/show_bug.cgi?id=20854) is to have a Wine version of Windows ping.exe, and to give THAT program CAP_NET_RAW. It's possible this can be done by just wrapping the existing system ping program.

[Austin English (austinenglish)]

Fixed a long time ago :)

http://source.winehq.org/git/wine.git/commitdiff/5e3e2ca7ffcd9d8c7e47da30eae7780349ba6add

[Alexandre Julliard (julliard)]

Closing bugs fixed in 1.3.20.

[Ken Sharp (kennybobs)]

Even when this is fixed, it is unlikely to make the Wine1.2 branch in Ubuntu.

[dino99 (9d9)]

this is no more a supported version