65

Since recently Debian has changed the default behavior for dmesg and I cannot use it simply from my local user.

% dmesg
dmesg: read kernel buffer failed: Operation not permitted

Same goes for:

% cat /dev/kmsg                      
cat: /dev/kmsg: Operation not permitted

Starring at the bug tracker this lead to:

How do I change this behavior back to the previous one, where local user are allowed to use dmesg. I could not find a particular group for it (eg. sudoers or something like that).

1 Answer 1

82

So it was actually trivial, looking at the very last message from the bug report:

Part of the changelog from the aforementioned kernel:

  • security,printk: Enable SECURITY_DMESG_RESTRICT, preventing non-root users reading the kernel log by default (sysctl: kernel.dmesg_restrict)

So the solution is simply to run once:

% sudo sysctl kernel.dmesg_restrict=0
kernel.dmesg_restrict = 0

Then your local user can start using dmesg again. This apply to any user, instead of a group which I initially assumed.

Everything is back to what I wanted:

% dmesg|wc
   1307   11745   93652

and

% cat /dev/kmsg|head|wc
     10      82     857

And to make it persists across reboots, simply save it as conf file:

$ echo kernel.dmesg_restrict = 0 | sudo tee -a /etc/sysctl.d/10-local.conf >/dev/null
$ cat /etc/sysctl.d/10-local.conf 
kernel.dmesg_restrict = 0

If you are on Ubuntu, for release 20.10 onwards there is already a line to persist this setting in /etc/sysctl.d/10-kernel-hardening.conf. After changing the file, to make the changes effective the user either needs to reboot or run sudo service procps restart .

4
  • Are you able to execute this command: cat /dev/kmesg as a regular user?
    – direprobs
    Sep 4, 2017 at 9:47
  • It should be /dev/kmsg in the first comment that was a typo.
    – direprobs
    Sep 4, 2017 at 9:58
  • 2
    Easier to make it permanent by adding kernel.dmesg_restrict = 0 to /etc/sysctl.conf
    – Knobee
    Jul 25, 2019 at 20:10
  • 8
    In Ubuntu 20.10, there is already a line for this in /etc/sysctl.d/10-kernel-hardening.conf. After changing the file, the user should run sudo service procps restart to allow dmesg viewing again.
    – scruss
    Jan 25, 2021 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .