I understand that, for security reasons (like address randomization), it makes some sense to not let every user be able to read the kernel's dmesg. Linux allows one to restrict dmesg to the root user using:
sysctl -w kernel.dmesg_restrict = 1.
That sysctl forces everyone who wants to use dmesg to prepend
sudo, which is a problem for me.¹
I would like something in between. I want some user accounts on my machines to have sudoless access to dmesg, but not daemons like apache or non-users like www-data.
Ideally, dmesg access would be restricted to a certain group (say,
What is the cleanest² way to do this?
¹ While I like sudo in concept, I believe it should be a four-letter word: used judiciously by the wise as a perfect epithet for the rare occasions when nothing else would suffice. Unfortunately, I see people using sudo for many mundane tasks nowadays without thinking twice. Getting people into the habit of overusing sudo is a worse security problem than potential address leaks from the kernel.
² I mention "cleanest", because I suspect that some solutions, like
chmod 4750 /bin/dmesg, might have potentially hairy security implications.
Update: I've accepted Ikkachu's
setcap solution, but I hope that in future versions of Linux there will be a cleaner, more general answer. Perhaps a third sysctl setting for dmesg_restrict that is between 0 (everybody) and 1 (root only), that would let sysadmins specify trusted groups.