From ba3db389320f147e154f768af7eb7a45b4ed8a5c Mon Sep 17 00:00:00 2001 From: mlsmaycon Date: Tue, 4 Aug 2026 08:48:48 +0000 Subject: [PATCH] [client] Hint at sudo when the profile config is not readable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The agent-network commands dial management directly with the profile's WireGuard key, and the default profile config is root-owned — running unprivileged fails reading it. Surface a clear "re-run with sudo" message instead of a bare permission error. Linear: NET-1399 --- client/cmd/agentnetwork.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/client/cmd/agentnetwork.go b/client/cmd/agentnetwork.go index 0995e541b..cbd3d5610 100644 --- a/client/cmd/agentnetwork.go +++ b/client/cmd/agentnetwork.go @@ -2,7 +2,9 @@ package cmd import ( "context" + "errors" "fmt" + "io/fs" "strings" "time" @@ -82,6 +84,13 @@ func fetchAgentNetworkSetup(ctx context.Context) (*mgmProto.AgentNetworkSetupRes } config, err := profilemanager.ReadConfig(configFilePath) if err != nil { + // The default profile config (and its WireGuard key) is owned by + // root; dialing management directly therefore needs the same + // elevation the daemon has. Point at sudo instead of surfacing a + // bare permission error. + if errors.Is(err, fs.ErrPermission) { + return nil, fmt.Errorf("reading profile %s requires elevated permissions — re-run with sudo", configFilePath) + } return nil, fmt.Errorf("read config file %s: %v (run 'netbird up' first)", configFilePath, err) }