pasta: Set ping_group_range upon namespace creation

...this allows processes running as the only group available in the
namespace to create ICMP Echo sockets.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/passt.c b/passt.c
index 8bed7bb..dfd2f9d 100644
--- a/passt.c
+++ b/passt.c
@@ -216,6 +216,10 @@ static void pasta_start_ns(struct ctx *c)
 	write(fd, buf, strlen(buf));
 	close(fd);
 
+	fd = open("/proc/sys/net/ipv4/ping_group_range", O_WRONLY);
+	write(fd, "0 0", strlen("0 0"));
+	close(fd);
+
 	shell = getenv("SHELL") ? getenv("SHELL") : "/bin/sh";
 	if (strstr(shell, "/bash"))
 		execve(shell, ((char *[]) { shell, "-l", NULL }), environ);