Description
The Firewall Escape Test (discussion #54993, SECURE, no exploitable gap found) discovered that ping and mtr-packet in the sandbox container image carry cap_net_raw=ep file capabilities via getcap, but the container's effective capability bounding set has no cap_net_raw, so the capability is inert (confirmed via a live raw-ICMP exploitation attempt that failed with "Operation not permitted"). This is not an exploitable vulnerability today, but stale, unusable setcap bits are unnecessary attack surface that a future bounding-set misconfiguration could reactivate.
Expected Impact
Reduces attack-surface noise and removes a false signal for future security audits/escape tests.
Suggested Fix
Strip the cap_net_raw file capability from ping and mtr-packet in the sandbox container image (e.g. setcap -r), since the bounding set already prevents it from being exercised.
Estimated Effort
Quick (< 1 hour)
Data Source
DeepReport analysis, 2026-08-23, based on discussion #54993 (Firewall Escape Test Report).
Generated by 🔬 Deep Report · agent · 175.4 AIC · ⌖ 12 AIC · ⊞ 12.4K · ◷
Description
The Firewall Escape Test (discussion #54993, SECURE, no exploitable gap found) discovered that
pingandmtr-packetin the sandbox container image carrycap_net_raw=epfile capabilities viagetcap, but the container's effective capability bounding set has nocap_net_raw, so the capability is inert (confirmed via a live raw-ICMP exploitation attempt that failed with "Operation not permitted"). This is not an exploitable vulnerability today, but stale, unusable setcap bits are unnecessary attack surface that a future bounding-set misconfiguration could reactivate.Expected Impact
Reduces attack-surface noise and removes a false signal for future security audits/escape tests.
Suggested Fix
Strip the
cap_net_rawfile capability frompingandmtr-packetin the sandbox container image (e.g.setcap -r), since the bounding set already prevents it from being exercised.Estimated Effort
Quick (< 1 hour)
Data Source
DeepReport analysis, 2026-08-23, based on discussion #54993 (Firewall Escape Test Report).