ping fails for non root in trixie as cap_net_raw is obsolete and linux-sysctl-defaults is not installed due to debops apt config

running ping on a box that did not had linux-sysctl-defaults installed due to no-recommends being set for apt by debops (linux-sysctl-defaults is a recommends for systems, procps and iputils-ping . It is only a depends for debian-cloud-images-packages) as non root gives:

ping: socktype: SOCK_RAW
ping: socket: Opération non permise
ping: => missing cap_net_raw+p capability or setuid?

see https://askubuntu.com/questions/1537785/can-no-longer-ping-operation-not-permitted

Ping is no longer installed with access to the CAP_NET_RAW linux capability, but instead uses ICMP_PROTO datagram sockets for network communication. Access to these sockets is controlled by GID based on the net.ipv4.ping_group_range sysctl. In normal installations, the linux-sysctl-defaults package will set this variable to a broadly permissive value, allowing unprivileged users to use ping as expected. See /usr/lib/sysctl.d/50-default.conf and https://docs.kernel.org/networking/ip-sysctl.html#ip-sysctl for more information on the semantics of this variable.

The solution is therefore to simply run this:

$ sudo apt install linux-sysctl-defaults

I reported that the error message was misleading in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1084135, but the issue, even though acked is still unfixed see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1084135

Either way, I don't know where to add linux-sysctl-defaults in debops roles. Maybe we don't even want ping to be user accessible everywhere....

Start by locating the DebOps roles that configure apt and install Debian packages, then inspect how no-recommends affects the relevant package recommendations. Reproduce the non-root ping failure on trixie and determine whether linux-sysctl-defaults should be installed. Done means an agreed package-handling change with coverage for the affected configuration.