diff --git a/include/util.h b/include/util.h
index 3f7718a5c..2af679894 100644
--- a/include/util.h
+++ b/include/util.h
@@ -172,6 +172,8 @@ extern int is_anon_link_type(char *link, char *type);
 extern void *shmalloc(size_t bytes);
 extern void shfree_last(void *ptr);
 
+#define CRS_CAN_FAIL	0x1 /* cmd can validly exit with non zero code */
+
 extern int cr_system(int in, int out, int err, char *cmd, char *const argv[], unsigned flags);
 extern int cr_system_userns(int in, int out, int err, char *cmd,
 				char *const argv[], unsigned flags, int userns_pid);
diff --git a/net.c b/net.c
index f85a13c23..cca5ef884 100644
--- a/net.c
+++ b/net.c
@@ -602,7 +602,8 @@ static int run_ip_tool(char *arg1, char *arg2, char *arg3, int fdin, int fdout,
 	ret = cr_system(fdin, fdout, -1, ip_tool_cmd,
 				(char *[]) { "ip", arg1, arg2, arg3, NULL }, flags);
 	if (ret) {
-		pr_err("IP tool failed on %s %s\n", arg1, arg2);
+		if (!(flags & CRS_CAN_FAIL))
+			pr_err("IP tool failed on %s %s\n", arg1, arg2);
 		return -1;
 	}
 
@@ -663,7 +664,7 @@ static inline int dump_rule(struct cr_imgset *fds)
 	if (!path)
 		return -1;
 
-	if (run_ip_tool("rule", "save", NULL, -1, img_raw_fd(img), 0)) {
+	if (run_ip_tool("rule", "save", NULL, -1, img_raw_fd(img), CRS_CAN_FAIL)) {
 		pr_warn("Check if \"ip rule save\" is supported!\n");
 		unlinkat(get_service_fd(IMG_FD_OFF), path, 0);
 	}
diff --git a/util.c b/util.c
index 69b310209..c8dfaa37b 100644
--- a/util.c
+++ b/util.c
@@ -592,7 +592,7 @@ out_chld:
 		}
 
 		if (WIFEXITED(status)) {
-			if (WEXITSTATUS(status))
+			if (!(flags & CRS_CAN_FAIL) && WEXITSTATUS(status))
 				pr_err("exited, status=%d\n", WEXITSTATUS(status));
 			break;
 		} else if (WIFSIGNALED(status)) {