"include" directive should skip broken symlinks?
"Willow Barraco" <[email protected]> Sat, 28 Feb 2026 16:03:42 +0100
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hey there, At Alpine Linux, we embark a default nftables configurations containing this line: include "/etc/nftables.d/*.nft" Then, we have a meta package, and related sub-packages containing holes on the firewall, related to their package. By example, a user using nftables, and installing "nftables-rulesets" and "syncthing" would install a dedicated ruleset installed at this location "usr/share/nftables.avail/50_syncthing.nft". The users then can either copy or symlink this to /etc/nftables.d/. Now the problem: When the user symlink this, and then uninstall the package, the symlink is left broken. In that situation, nftables can't start, and the service generally silently remains as crashed on system restarts. I'm not sure what is the best way for nftables to handle this. Probably it should skip this included entry? But this could lead to unpredictable behaviors. Or maybe there should be a "include_if" alternative config entry, to skip unreadable files? Thanks, Willow