Users of the Network group are not permitted to execute the iptables command

[aadi58002]

Hello,

I am attempting to use Podman in rootless mode. When creating networks for these containers, it requires permissions to use the iptables command to retrieve rules from the nat table. However, when I try to execute the iptables command, I encounter an error (shown below).

Here are the groups my user belongs to: wheel audio video network dbus kvm input plugdev _seatd _pipewire _dhcpcd. The output from the fd --owner :network command returned no files.

1. Is the network group still necessary for legacy reasons?
2. Can permissions for the iptables package be modified to allow the network user to make changes to it?

Podman Error:
WARN[0000] 1 error occurred:

• plugin type="portmap" failed (delete): cni plugin portmap failed: neither iptables nor ip6tables is usable, (iptables) running [/usr/bin/iptables -t nat -S OUTPUT --wait]: exit status 3: modprobe: ERROR: could not insert 'ip_tables': Operation not permitted

[classabbyamp]

the network group is only used by networkmanager: https://docs.voidlinux.org/config/network/networkmanager.html#configuring-networkmanager

[aadi58002]

Is the network group use strictly defined by network manager maintainers or by distro maintainers ?

If it is decided by distro maintainers i believe it would make a lot of sense to include other network related tooling under the network group.

[classabbyamp]

its usage is from NetworkManager upstream in their polkit rules

[aadi58002]

Thanks for the information.

Also thanks for maintaining a great project.