Re: [PATCH nft 1/5] libnftables: report EPERM to non-root users with -f/--filename

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Apr 08, 2026 at 02:03:24PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Similar to 3cfb9e4b3e40 ("src: report EPERM for non-root users").
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> >  src/libnftables.c | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> > 
> > diff --git a/src/libnftables.c b/src/libnftables.c
> > index 66b03a1170bb..e3218da9f48f 100644
> > --- a/src/libnftables.c
> > +++ b/src/libnftables.c
> > @@ -767,8 +767,13 @@ static int __nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename
> >  		nft_optimize(nft, &cmds);
> >  
> >  	rc = nft_evaluate(nft, &msgs, &cmds);
> > -	if (rc < 0)
> > +	if (rc < 0) {
> > +		if (errno == EPERM) {
> > +			fprintf(stderr, "%s (you must be root)\n",
> > +				strerror(errno));
> > +		}
> >  		goto err;
> > +	}
> 
> Hmm, should the library leave stderr alone?

This can be handled instead from src/main.c