Skip to main content

NFT100 - Failed to Remove the Address from the Set

Uploading...Agent error code #NFT100 indicates that nft delete element failed while revoking a grant. The address is likely still in the set, which means access that should have been withdrawn is still in place.

An element that is already gone is not this error. The kernel drops a timeout-stamped element the moment it expires, often before the server's revoke arrives, so the agent treats "element does not exist" as the revoke having succeeded. It also tries both renderings of the address, bare and as a prefix, in case the set changed shape since the grant. This code is only raised when a delete fails for some other reason.

A revoke against a set or table that is gone entirely is reported separately, as the ACL no longer existing.

Common causes include:

    The privileged call was refused. nft exits with "Operation not permitted" when the escalation rule was changed, or the sudoers file removed, after the grant was applied The ruleset was being replaced by another tool at that moment The command outran its 15 second limit because the ruleset is locked by another process The kernel rejected the delete for a reason specific to the local ruleset

    Steps to Resolve

    Confirm Whether the Address Is Still Allowed

      Print the set contents: sudo nft list set <family> <table> <set> Look for the address from the failed revoke. Treat a stale entry as live access until it is gone

      Remove the Entry by Hand

      sudo nft delete element <family> <table> <set> { 192.0.2.1 }

      The agent does not retry a failed revoke on a timer. A leftover element clears on its own only if the set has flags timeout, in which case the kernel expires it at the grant's original expiry, or when the agent next receives a full ACL update from the server and sweeps entries the server no longer wants. Neither is immediate, so remove it by hand when the access matters.

      Check the Agent Can Still Escalate

      A revoke needs the same privilege as a grant, so a rule changed since the grant was applied breaks revocation while older entries remain in place. Confirm as the service account:

      sudo -l -U knocknoc-agent | grep nft
sudo -u knocknoc-agent sudo -n nft --version

      Run knocker enable nftables to restore the shipped rule if it has been removed.

      Add flags timeout to the Set

      A set declared with flags timeout carries the grant expiry in the kernel, so access lapses on time even when a revoke fails or the agent cannot reach the server. Sets created by knocker enable nftables already have it. Flags cannot be changed in place, so adding it means recreating the set, which empties it.

      Back to top