Unable to send ICMP (ping) on latest images

[jaraco]

Description

In jaraco/jaraco.net#9, I've encountered a problem where since about 5 months ago, the ubuntu-latest images no longer allow ICMP packets to be constructed (example). I'm guessing sometime in the past 5 months is when ubuntu-latest switched to 24.04.

I'm using Python's icmplib, which has documented that prior to Ubuntu 20.04, a special privilege had to be granted to allow for unprivileged ping to be constructed, but that privilege shouldn't be necessary on Ubuntu 24.04.

I've confirmed in a Docker image (with an unprivileged account), that the library's tests run and pass, so the issue seems to be unique to the GitHub environment.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Image version and build link

  Image: ubuntu-24.04
  Version: 20250209.1.0
  Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20250209.1/images/ubuntu/Ubuntu2404-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20250209.1

Is it regression?

Yes

Expected behavior

It should be possible to construct ping packets on every platform.

Actual behavior

Attempting to construct a ping packet on Ubuntu runners fails.

Repro steps

1. pip install icmplib
2. python -c "import icmplib; icmplib.ping('google.com', privileged=False)"

[jaraco]

I decided to try testing on 22.04, but the tests also fail there. I'm beginning to think the issue lies with icmplib and not GitHub Actions.

I can see there have been no changes to icmplib for years. Also, there were no significant changes to jaraco.net during the period between the last known good and the first confirmed failure.

[jaraco]

The last known good is here, and earliest confirmed failure I have is for Dec 23 during the rollout of Ubuntu 24.04, which I'm to understand was Dec 5 - Jan 17.

[Prabhatkumar59]

Hi @jaraco - Thank you for bringing this issue to our attention. We will look into this issue and will update you after investigating.

[vidyasagarnimmagaddi]

Hi , @jaraco , We have forked your repo and tried to rectify the error.
Succeeded build:
Adding dependencies will resolve the issue:

# Install required dependencies for building lxml
      - name: Install libxml2 and libxslt development packages
        if: matrix.python == '3.14' && matrix.platform == 'ubuntu-latest'
        run: |
          sudo apt-get update
          sudo apt-get install -y libxml2-dev libxslt-dev

Kindly please confirm. thanks

[vidyasagarnimmagaddi]

Hi @jaraco , Adding the above steps, will resolve the issue. Kindly do the needful closing this issue. thanks.

[jaraco]

I think you mis-understood the problem.

I did link to a project where the Python 3.14 tests are failing due to lack of build dependencies for lxml. So thank you for that. I'll be able to use that idea in this project and others to get the Python 3.14 tests to pass sooner.

However, the issue I've reported has nothing to do with those failing tests, which are allowed to pass. The failing tests are in the linked builds and the failure is with a specific test for ICMP. See the aforementioned test for a less distracting example.

The other factor that makes things more complicated is in jaraco/jaraco.net@f9968b5, I've disabled the failing tests in CI so that I can unblock the CI. To see a version of the repo where the tests fail, look at the parent of that commit, jaraco/jaraco.net@359ee74.

Can you please reopen?

[jaraco]

I've created jaraco/jaraco.net@fb6b89d to repro the issue minimally.

[jaraco]

@vidyasagarnimmagaddi Pinging in case you missed it. Please re-open. Thanks.

[shamil-mubarakshin]

Hey @jaraco. I ran provided repro steps on ubuntu runners and found only ubuntu-24.04 being affected.
It seems that default value of net.ipv4.ping_group_range (this was also mentioned in icmplib docs) has been changed from net.ipv4.ping_group_range = 0 2147483647 on ubuntu-22.04 to net.ipv4.ping_group_range = 1 0 on ubuntu-24.04 (confirmed on unmodified Azure Marketplace ubuntu images), restricting ping socket creation.
We are currently checking if we can find the reasoning of such default changes in ubuntu-24.04 and whether we want to bake the fix on the image generation side.
You can add the following step to your workflow as a workaround in the meantime:

      - name: Enable unprivileged ping sockets
        shell: bash
        run: |
          echo 'net.ipv4.ping_group_range = 0 2147483647' | sudo tee -a /etc/sysctl.conf
          sudo sysctl -p