{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/3326","labels_url":"https://api.github.com/repos/openshift/origin/issues/3326/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3326/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/3326/events","html_url":"https://github.com/openshift/origin/issues/3326","id":89417349,"number":3326,"title":"Cannot use ping via 'oc exec'","user":{"login":"sdodson","id":48161,"avatar_url":"https://avatars.githubusercontent.com/u/48161?v=3","gravatar_id":"","url":"https://api.github.com/users/sdodson","html_url":"https://github.com/sdodson","followers_url":"https://api.github.com/users/sdodson/followers","following_url":"https://api.github.com/users/sdodson/following{/other_user}","gists_url":"https://api.github.com/users/sdodson/gists{/gist_id}","starred_url":"https://api.github.com/users/sdodson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sdodson/subscriptions","organizations_url":"https://api.github.com/users/sdodson/orgs","repos_url":"https://api.github.com/users/sdodson/repos","events_url":"https://api.github.com/users/sdodson/events{/privacy}","received_events_url":"https://api.github.com/users/sdodson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-06-18T22:56:41Z","updated_at":"2015-06-24T20:16:44Z","closed_at":"2015-06-23T20:52:58Z","body":"This used to work a week ago as that's how I was testing the SDN.\r\n\r\n```\r\n[root@ose3-master ~]# oc exec -p fedora-net ping www.google.com\r\nping: icmp open socket: Operation not permitted\r\nerror: Error executing remote command: Error executing command in container: Error executing in Docker Container: 2\r\n```\r\n\r\nThe image I'm using is docker.io/dcbw/fedora-net id a1eff209999c  @mrunalp mentioned that perhaps ping didn't have the correct capabilities set but I'm wondering why this worked a week ago but not now."},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/114997749","html_url":"https://github.com/openshift/origin/issues/3326#issuecomment-114997749","issue_url":"https://api.github.com/repos/openshift/origin/issues/3326","id":114997749,"user":{"login":"mrunalp","id":53798,"avatar_url":"https://avatars.githubusercontent.com/u/53798?v=3","gravatar_id":"","url":"https://api.github.com/users/mrunalp","html_url":"https://github.com/mrunalp","followers_url":"https://api.github.com/users/mrunalp/followers","following_url":"https://api.github.com/users/mrunalp/following{/other_user}","gists_url":"https://api.github.com/users/mrunalp/gists{/gist_id}","starred_url":"https://api.github.com/users/mrunalp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrunalp/subscriptions","organizations_url":"https://api.github.com/users/mrunalp/orgs","repos_url":"https://api.github.com/users/mrunalp/repos","events_url":"https://api.github.com/users/mrunalp/events{/privacy}","received_events_url":"https://api.github.com/users/mrunalp/received_events","type":"User","site_admin":false},"created_at":"2015-06-24T20:16:44Z","updated_at":"2015-06-24T20:16:44Z","body":"That's what I suspected when I first discussed with sdodson. Fedora images had this issue.\n\nSent from my iPhone\n\n> On Jun 24, 2015, at 12:50 PM, Paul Weil <notifications@github.com> wrote:\n> \n> This is actually not an SCC capabilities problem in this case but it did point out an interesting issue.\n> \n> To run as a non-root with special caps you must request the cap (SCC/SC) AND have fcaps set on the file (that's the interesting part)\n> Docker provides cap_net_raw by default\n> This image is a bit out of date, the ping command does not have fcaps set\n> [vagrant@openshiftdev ping]$ docker run -it docker.io/dcbw/fedora-net getcap /usr/bin/ping\n> /usr/bin/ping =\n> \n> \n> [vagrant@openshiftdev ping]$ docker run -it fedora:latest /bin/bash\n> [root@43935663d8b1 /]# yum install -y iputils\n> [root@43935663d8b1 /]# getcap /usr/bin/ping\n> /usr/bin/ping = cap_net_admin,cap_net_raw+ep\n> Running setcap cap_net_raw,cap_net_admin+p /usr/bin/ping fixes this. Ping should work OOTB for updated Fedora images, no SC request necessary.\n> \n> The interesting part is that you must have the container capability and fcaps in order to work properly with the non-root user. Using --cap-drop NET_RAW confirmed that you cannot rely only on the fcaps.\n> \n> I am going to add a new How-To on how to allow someone to add a cap for the issue that was opened and note that the fcap is still a requirement.\n> \n> —\n> Reply to this email directly or view it on GitHub.\n> \n"}}