/*
 * Allows install ping with setuid bit cleared.
 *
 * Follow README file to make privileged non-setuid programs to be secure.
 */

/bin/ping {
	uid 0
	gid 0
	groups no
	
	cap set empty
	cap effective set { 
		raw
		broadcast	// root can use broadcasts, user - can't
	}
	
	uidcap default
	
	exec deny all
}

/bin/ping {
	uid any
	gid any
	
	cap effective set {
		raw
	}
	
	uidcap default

	exec deny all
}
