utils: T9269: do not leak sysctl(8) errors to stderr

sysctl_write() reports success through its return code, but the underlying
sysctl(8) call inherited stderr. net.ipv4.neigh.default.gc_thresh* is not
network namespace aware, so a container printed six "cannot stat ... No such
file or directory" lines on every boot.

Capture the output and keep the return code as the only interface to the
caller.

1 files changed, 6 insertions, 2 deletions

diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py
index fd32a486a..7cc6919a4 100644
--- a/python/vyos/utils/system.py
+++ b/python/vyos/utils/system.py
@@ -50,8 +50,12 @@ def sysctl_write(name: list[str], value: str | int) -> bool:
     # do not change anything if a value is already configured
     if sysctl_read(name) == value:
         return True
-    # return False if sysctl call failed
-    if run(['sysctl', '-wq', f'{key}={value}']).returncode != 0:
+    # return False if sysctl call failed - stderr is captured as the return
+    # code is the interface to the caller. A key may legitimately not exist,
+    # e.g. net.ipv4.neigh.default.gc_thresh* is not network namespace aware
+    # and thus not available when running inside a container
+    if run(['sysctl', '-wq', f'{key}={value}'],
+           capture_output=True).returncode != 0:
         return False
     # compare old and new values
     # sysctl may apply value, but its actual value will be