From faeace4a37d890e9bfa1bc6b4584d0994853fb37 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Tue, 1 Sep 2026 09:01:37 +0000 Subject: utils: T9269: do not leak sysctl(8) errors to stderr sysctl_write() reports success through its return code, but the underlying sysctl(8) call inherited stderr. net.ipv4.neigh.default.gc_thresh* is not network namespace aware, so a container printed six "cannot stat ... No such file or directory" lines on every boot. Capture the output and keep the return code as the only interface to the caller. --- python/vyos/utils/system.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'python') diff --git a/python/vyos/utils/system.py b/python/vyos/utils/system.py index fd32a486a..7cc6919a4 100644 --- a/python/vyos/utils/system.py +++ b/python/vyos/utils/system.py @@ -50,8 +50,12 @@ def sysctl_write(name: list[str], value: str | int) -> bool: # do not change anything if a value is already configured if sysctl_read(name) == value: return True - # return False if sysctl call failed - if run(['sysctl', '-wq', f'{key}={value}']).returncode != 0: + # return False if sysctl call failed - stderr is captured as the return + # code is the interface to the caller. A key may legitimately not exist, + # e.g. net.ipv4.neigh.default.gc_thresh* is not network namespace aware + # and thus not available when running inside a container + if run(['sysctl', '-wq', f'{key}={value}'], + capture_output=True).returncode != 0: return False # compare old and new values # sysctl may apply value, but its actual value will be -- cgit v1.2.3