Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was reading about LXC vs OpenVZ and was wondering if this issue has already been solved in more recent updates:

OpenVZ has done quite a good job at this, but LXC still has issues here. Even with AppArmor enabled, in Ubuntu you still have access to dmesg from the guests and /proc/kcore and /proc/sysrq-trigger are still accessible, so a root user in a guest VM could easily restart the host machine. Improvements are planned for Ubuntu version 13.04.

source: http://www.janoszen.com/2013/01/22/lxc-vs-openvz/

share|improve this question

By using echo 1 > /proc/sys/kernel/dmesg_restrict you can restrict the dmesg access to the root user of the host. Other users including the root user in the LXC have then no access.

share|improve this answer
This does not seem to work with linux 3.16.0 here. The setting is there, it is set to 1 afterwards, but the LXC-containers still show the dmesg output. – allo Sep 30 '15 at 21:29
@allo This works probably only for unprivileged container. – jofel Oct 1 '15 at 10:25
Ah, that makes sense. Still a problem, because other containers are isolating this better. – allo Oct 2 '15 at 19:51

To disable access to /proc/kcore:

lxc.cap.drop = sys_rawio

To disable access to dmesg load following file using lxc.seccomp option:

syslog errno 1

Works fine for me on LXC-1.0.6, kernel 4.3.0.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.