Hi Folks.

How to gain temporarily root privileges in a pascal program ? I need to 'ping' an IP address and for ping to work (Indy 10) I need to be root.
Usage of another TCP component is not an option.
Another way is to execute a shell and intertpret the results but I'd to avoid it if possible.
It is on Linux system.

Thanks

---
Ce courrier ?lectronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

You can't do this. Strictly forbidden.

The usual way to do this is to make the program setuid root, do the ping, and then setuid() to some normal user ASAP.

If you need to do it at regular intervals, then you must execute a separate program.

Michael.

Le 4/06/2014 16:54, Michael Van Canneyt a ?crit :

Like a service ?
OK, that's what I suspected. Thanks.

Antonio.

---
Ce courrier ?lectronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

Michael Van Canneyt wrote

On Wed, 4 Jun 2014, A. Fortuny wrote: > How to gain temporarily root privileges in a pascal program ? I > need to 'ping' an IP address and for ping to work (Indy 10) I need > to be root.

Why do you need root to ping? You could set up sudo to allow regular/specific users to ping; perhaps there's something with this new-fangled capabilities thing etc.

By defautl, perhaps. See the rest of my post.

Otherwise, how do you explain this (Debian):
pascaldev at debianlaz:~/papertiger$ whoami
pascaldev
pascaldev at debianlaz:~/papertiger$ ping www.freepascal.org PING www.freepascal.org (81.82.199.218) 56(84) bytes of data. 64 bytes from d5152C7DA.static.telenet.be (81.82.199.218): icmp_seq=1 ttl=51 time=21.5 ms
...

All ports less than 1024 are only usable by the root user.

Michael.

Maybe on your machine.
pascaldev at debianlaz:~/papertiger$ which ping
/bin/ping
pascaldev at debianlaz:~/papertiger$ ls -al /bin/ping -rwxr-xr-x 1 root root 44080 Feb 1 22:18 /bin/ping

Anyway, see my first post.

Ts ts ts

home: >which ping
/bin/ping
home: >ls -l /bin/ping
-rwsr-xr-x 1 root root 35712 Nov 8 2011 /bin/ping*

ping is setuid root.

Michael.

You want to use a lightweight UDP packet above 1024 instead of PING to accomplish the same mission.

You need to have something on the other side to ACK your UDP "PING"

md

Le 4/06/2014 17:01, Reinier Olislagers a ?crit :

The program I intend to make will be developed as a service "pinging" on a regular basis remote stations just to see if they are alive. The way that Indy implements ICMP protocol means that "pinger" socket is available only under root permission. The same test programs which fails under normal user succeeds under root.
This is clearly stated in Indy FAQ. Read http://www.indyproject.org/KB/ for this subject and associated questions.

Antonio.

---
Ce courrier ?lectronique ne contient aucun virus ou logiciel malveillant parce que la protection avast! Antivirus est active. http://www.avast.com

I'll take your word for it that Indy states that.

As I tried to indicate though, the time that you only had root and non root in *nix is over.
Perhaps this
http://linux.die.net/man/7/capabilities
could help.

I haven't kept up with this (currently only involved with Linux as a personal user), don't know if/how SELinux etc influence this

If you look at the page, you'll see that not all kernels have this. None of the mechanisms on that page seem to work on my Ubuntu 10.04.

Reinier:
It would be interesting to know what getcap `which ping` does on your system.

I dare say that it depends on the distribution (worse, the version), in which case it's better not to rely too heavily on this. It's also not POSIX (states so in the page you refer to), so it probably wouldn't work on BSD either.

The bottom line is, as far as I can make out:

ping won't work without extra capabilities.
These capabilities must be set somehow on the binary, they cannot be set from inside the program if it didn't initially have them. Old versions require setuid root, newer versions may use setcap() to set these capabilities on the program.

Michael.