68

Since recently Debian has changed the default behavior for dmesg and I cannot use it simply from my local user.

% dmesg
dmesg: read kernel buffer failed: Operation not permitted

Same goes for:

% cat /dev/kmsg                      
cat: /dev/kmsg: Operation not permitted

Starring at the bug tracker this lead to:

How do I change this behavior back to the previous one, where local user are allowed to use dmesg. I could not find a particular group for it (eg. sudoers or something like that).

malat
  • 2,708
  • 4
  • 27
  • 47

1 Answers1

87

So it was actually trivial, looking at the very last message from the bug report:

Part of the changelog from the aforementioned kernel:

  • security,printk: Enable SECURITY_DMESG_RESTRICT, preventing non-root users reading the kernel log by default (sysctl: kernel.dmesg_restrict)

So the solution is simply to run once:

% sudo sysctl kernel.dmesg_restrict=0
kernel.dmesg_restrict = 0

Then your local user can start using dmesg again. This apply to any user, instead of a group which I initially assumed.

Everything is back to what I wanted:

% dmesg|wc
   1307   11745   93652

and

% cat /dev/kmsg|head|wc
     10      82     857

And to make it persists across reboots, simply save it as conf file:

$ echo kernel.dmesg_restrict = 0 | sudo tee -a /etc/sysctl.d/10-local.conf >/dev/null
$ cat /etc/sysctl.d/10-local.conf 
kernel.dmesg_restrict = 0

If you are on Ubuntu, for release 20.10 onwards there is already a line to persist this setting in /etc/sysctl.d/10-kernel-hardening.conf. After changing the file, to make the changes effective the user either needs to reboot or run sudo service procps restart .

SebMa
  • 1,941
  • 4
  • 22
  • 37
malat
  • 2,708
  • 4
  • 27
  • 47
  • Are you able to execute this command: `cat /dev/kmesg` as a regular user? – direprobs Sep 04 '17 at 09:47
  • It should be `/dev/kmsg` in the first comment that was a typo. – direprobs Sep 04 '17 at 09:58
  • 2
    Easier to make it permanent by adding `kernel.dmesg_restrict = 0` to `/etc/sysctl.conf` – Knobee Jul 25 '19 at 20:10
  • 10
    In Ubuntu 20.10, there is already a line for this in `/etc/sysctl.d/10-kernel-hardening.conf`. After changing the file, the user should run `sudo service procps restart` to allow dmesg viewing again. – scruss Jan 25 '21 at 14:47