python non-privileged ICMP

Question

While trying to figure out the best method to ping (ICMP) something from python, I came across these questions:

The answers generally boil down to "use this third party module with root privileges" or "use the system's ping command and parse the output". Of the native methods, icmplib and M. Cowles and J. Diemer's ping.py explicitly mention the need for root privileges, as does the scapy manual.

So from that front, natively sending ICMP pings without special privileges seems impossible. The system ping command does manage somehow, but its man page doesn't shed any light on how. The man page for icmp, on the other hand, seems to say it's possible:

Non-privileged ICMP
     ICMP sockets can be opened with the SOCK_DGRAM socket type without
     requiring root privileges. The synopsis is the following:

     socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)

     Datagram oriented ICMP sockets offer a subset of the functionality avail-
     able to raw ICMP sockets. Only IMCP request messages of the following
     types can be sent: ICMP_ECHO, ICMP_TSTAMP or ICMP_MASKREQ.

So it would seem that, at least according to icmp, it's allowed. So why is it that all the python tools are unable to do this? Are the python tools too general and expect any work on privileged sockets to be privileged? Would it be possible to write a ping function in C that can ping without root privileges, and extend python with this? Has anyone done this? Have I just misunderstood the problem?

What operating system are you using? [Recent Linux kernels](https://lkml.org/lkml/2011/5/10/389) and Mac OS X ones are known to have non-privileged ICMP sockets. The man page you've found are from OS X, and it should work. I've succeeded with a non-privileged pure-Python [ping program](https://github.com/lilydjwg/winterpy/blob/master/pylib/icmplib.py) which works on Linux (with a kernel setting change) but may need some adjustments on OS X. — lilydjwg, Oct 27 '13 at 10:03
For Linuix, see here http://stackoverflow.com/questions/8290046/icmp-sockets-linux/20105379#20105379 , you need a special sysctl to be able to use `socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)` — nos, Nov 20 '13 at 19:57

score 15 · Accepted Answer · answered Jul 27 '09 at 17:17

15

The ping program is installed setuid root. This allows any user to use the program, and still be able to open a raw socket.

After it opens the raw socket, it typically drops root privs.

You generally need a raw socket to do ICMP correctly, and raw sockets are usually restricted. So it's not really python's fault at all.

Regarding the bit about ICMP above, apparently many implementations don't really support those combinations of flags well. So it is likely that most implmentations just use the way they "know" works on most / all architectures.

answered Jul 27 '09 at 17:17

Christopher

8,815
2
32
41

Ah, that's one mystery less - since short intervals on ping still require sudo, I didn't think it had setuid root, but you're clearly right about that. – Markus Jul 29 '09 at 08:12
Ping doesn't necessarily use ICMP probes, nor raw sockets nor needs root privileges. – jean-loup Mar 27 '15 at 14:52

score 14 · Answer 2 · answered Jul 27 '09 at 17:18

14

Here's how /sbin/ping "somehow manages" (on most Unix-y systems):

$ ls -l /sbin/ping
-r-sr-xr-x  1 root  wheel  68448 Jan 26 10:00 /sbin/ping

See? It's owned by root and has that crucial s bit in the permission -- setuserid. So, no matter what user is running it, ping runs as root.

If you're using a BSD Kernel with the new "non-privileged ICMP sockets" it would be interesting to see what's needed to use that functionality to ping from Python (but that won't help any user that's on a less advanced kernel, of course).

answered Jul 27 '09 at 17:18

Alex Martelli

854,459
170
1,222
1,395

1

Interesting, so non-privileged ICMP sockets are new? Perhaps I'll attempt to get that working from python when I have some time, mostly out of curiosity. – Markus Jul 29 '09 at 08:17
1

Not all that new **as a spec** (I believe it goes all the way back to good old glorious BSD 4.3!-), but a _working_ implementation of that spec would be pretty new (and very good news indeed, IMHO). – Alex Martelli Jul 29 '09 at 14:20
1

My ping in Arch Linux does not have that bit. – FelipeC Feb 28 '21 at 08:54

score 6 · Answer 3 · answered Aug 05 '10 at 12:40

I'm not sure if it is OK to post something in a question that seems it has already been answered a while ago.

I have been searching for the same implementation and found a way to do ICMP via Python with non-root privileges.

python-ping uses the same 'need-root' way to do a ping, but came across a bug report where a user suggested changing SOCK_RAW to SOCK_DGRAM when calling sock :

http://hg.io/delroth/python-ping/issue/1/icmp-without-root-privilege

The dev explains this will be a "WONT-FIX" situation because it is a UDP ping rather.

Since I really do not care if ICMP is going out via UDP, I went ahead and got the code and made the proposed changed.

I am now able to do a ping without calling subprocess or needing root!

Again, not sure if posting here after such a long time is OK, but thought this was a better thing!

That's an interesting approach. Should work well, but strictly speaking, it's not a ping any more. That means firewalls and such that have special ping handling may end up behaving differently. — DonGar, Jan 15 '12 at 22:06
That approach does not work at all. You can’t create an UDP type socket with protocol ICMP. I got an EPROTONOSUPPORT (Protocol not supported). – The reason is simple: such a protocol combination does not exist. (Response testing is possible unprivileged with UDP/TCP, but that needs more then subtle changes like this.) — Robert Siemer, Feb 08 '12 at 10:20

score 5 · Answer 4 · edited Mar 21 '15 at 10:37

Modern Linuxes ping uses libcap and asks libcap to do the work.This checks (capget/set funcitons) and manage permissions:

linux@jacax:~/WORK$ ldd /bin/ping  
    linux-gate.so.1 =>  (0xb77b6000)  
    libcap.so.2 => /lib/i386-linux-gnu/libcap.so.2 (0xb7796000)  
    libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb75e7000)  
    /lib/ld-linux.so.2 (0xb77b7000)

Lets say you have a "myping" program:

linux@jacax:~/WORK$ getcap ./myping    
linux@jacax:~/WORK$   (-> nothing! )  
linux@jacax:~/WORK$ setcap cap_net_raw=ep ./myping  
unable to set CAP_SETFCAP effective capability: Operation not permitted  
linux@jacax:~/WORK$ sudo setcap cap_net_raw=ep ./myping

Now do:

linux@jacax:~/WORK$ getcap ./myping  
./ping = cap_net_raw+ep

Now, your "myping" will work without root. That is, as long as myping is in fact a binary program. If it is a script, this capability has to be set on the script interpreter instead.

excellent point, I was almost in despair that no one had mentioned capabilities. However, it has to be noted that if your "program" is a script, the capability has to be set in the script interpreter rather than the script. — 0xC0000022L, Mar 21 '15 at 10:36

score 3 · Answer 5 · answered Oct 27 '21 at 23:31

3

icmplib module helped me with ping without running whole django app as root: https://pypi.org/project/icmplib/

answered Oct 27 '21 at 23:31

mkonstanty

125
1
6

this works nicely for me `result = ping("1.1.1.1", privileged=False)` – Simon Nov 25 '22 at 17:12

score 2 · Answer 6 · edited Nov 27 '11 at 03:08

2

Actually, on Windows 7 and Vista you do need to 'Run as Administrator' to do:

my_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, icmp)

and as you note, doing it over a datagram socket causes an error.

edited Nov 27 '11 at 03:08

canadian_scholar

1,315
12
26

answered Apr 06 '11 at 19:51

Oli

21
1

score 0 · Answer 7 · answered Jan 23 '14 at 12:23

The man page you're reading is about "BSD Kernel Interfaces Manual" and seems to come from "Mac OS X 10.9". I don't have a Mac OS X machine to try, but under Linux, as root or as user I get a permission denied error when I try to open such an ICMP:

$ strace -e trace=socket python
Python 2.7.5+ (default, Sep 19 2013, 13:48:49) 
[GCC 4.8.1] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_ICMP)
socket(PF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCES (Permission denied)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/socket.py", line 187, in __init__
    _sock = _realsocket(family, type, proto)
socket.error: [Errno 13] Permission denied

Under OpenBSD I get a "Protocol not supported" error:

>>> import socket
>>> socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_ICMP)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/socket.py", line 187, in __init__
    _sock = _realsocket(family, type, proto)
socket.error: [Errno 43] Protocol not supported

May be someone could try under MacOS X or other BSDs, but anyway this socket type does not look like portable, to say the least!

You are doing it wrong, ICMP messages are fetched by DGRAM sockets as error messages. Specifying ICMP as socket protocol on DGRAM is just wrong. — jean-loup, Mar 27 '15 at 14:54

score -1 · Answer 8 · answered Mar 19 '11 at 13:18

I was also looking for an implementation of ping without using subprocess or needing root to ping. My solution needed to be cross-platform, namely Windows and Linux.

Changing the socket on Windows to SOCK_DGRAM results in a "protocol not supported 100043" exception. So it looks like Windows correctly checks to see if icmp is being sent out on TCP rather than UDP. However, windows does not care if it is running as "root" since that is a Linux concept.

if os.name == 'nt':
    #no root on windows
    my_socket = socket.socket(socket.AF_INET, socket.SOCK_RAW, icmp)
else:
    #changed to UDP socket...gets around ROOT priv issue
    my_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, icmp)

score -9 · Answer 9 · answered Jun 08 '11 at 15:18

-9

I am running python under windows 7 , Since i am editing and "compiling" the code under Eclipse pydev plugin, My solution was : Running the eclipse.exe as an administrator : this solved the problem,

This solution is similar to running the cmd as an administrator.

answered Jun 08 '11 at 15:18

Michael

1

10

Please don't suggest people run arbitrary programs as Administrator. That's how UAC got a bad rap in the first place. Your answer also doesn't help for a program deployed into production. – AdmiralNemo Sep 15 '11 at 02:34

python non-privileged ICMP

9 Answers9

Linked