[PATCH nft,v2 1/5] main: consolidate EPERM to non-root users

[PATCH nft,v2 1/5] main: consolidate EPERM to non-root users

[Pablo Neira Ayuso]

Move the check added by 3cfb9e4b3e40 ("src: report EPERM for non-root users")
to the main function.

EPERM is also possible when removing a ruleset that is owned by a
process, tone it down to suggest that root is maybe needed.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v2: handle EPERM from main, per Florian.
    I'm not resending the entire series at this stage,
    patch 2/5, 3/5, 4/5 and 5/5 got no changes.

 src/libnftables.c | 7 +------
 src/main.c        | 2 ++
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/libnftables.c b/src/libnftables.c
index 66b03a1170bb..bc42c32de889 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -630,13 +630,8 @@ int nft_run_cmd_from_buffer(struct nft_ctx *nft, const char *buf)
 	parser_rc = rc;
 
 	rc = nft_evaluate(nft, &msgs, &cmds);
-	if (rc < 0) {
-		if (errno == EPERM) {
-			fprintf(stderr, "%s (you must be root)\n",
-				strerror(errno));
-		}
+	if (rc < 0)
 		goto err;
-	}
 
 	if (parser_rc) {
 		rc = parser_rc;
diff --git a/src/main.c b/src/main.c
index 29b0533dee7c..4cb51ff7f5fe 100644
--- a/src/main.c
+++ b/src/main.c
@@ -548,6 +548,8 @@ int main(int argc, char * const *argv)
 		goto out_fail;
 	}
 
+	if (rc && errno == EPERM)
+		 fprintf(stderr, "Error: %s (perhaps you must be root?)\n", strerror(errno));
 out:
 	nft_ctx_free(nft);
 	return rc;
-- 
2.47.3

Re: [PATCH nft,v2 1/5] main: consolidate EPERM to non-root users

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Move the check added by 3cfb9e4b3e40 ("src: report EPERM for non-root users")
> to the main function.

Thanks!