Running nft --check as non-root

Running nft --check as non-root

[Peter Hoeg]

Hey all,

as part of deploying nftables rules on NixOS, I want to check the syntax before actually trying to deploy them.

Now, nft --check --file works fine when run as root but the builder used does not have root permissions (or access to sudo or anything like that). Is there any particular reason why nft --check needs to run as root or any way to make it work as !root?

$ nft --check --file foo; echo $?
1

$ sudo nft --check --file foo; echo $?
0

Thanks in advance,
Peter

Re: Running nft --check as non-root

[Florian Westphal]

Peter Hoeg <peter@hoeg.com> wrote:
> as part of deploying nftables rules on NixOS, I want to check the syntax before actually trying to deploy them.
> 
> Now, nft --check --file works fine when run as root but the builder used does not have root permissions (or access to sudo or anything like that). Is there any particular reason why nft --check needs to run as root or any way to make it work as !root?

Yes, this not a syntax check. The ruleset is passed to the kernel.

The only difference is the lack of the final 'commit' instruction to
activate the ruleset, this makes the kernel abort/unwind the entire
transaction.

Re: Running nft --check as non-root

[Peter Hoeg]

> Yes, this not a syntax check. The ruleset is passed to the kernel.

Is there any other way we can verify that at least the syntax is valid? Maybe have a --syntax flag that just invokes the scanner and parser without needing any privileged access?

I know nothing of the internals, so that might of course be completely impossible given the current architecture.