0

I'm trying to read physical memory as a non-root user using /dev/mem. Checking the permissions of /dev/mem:

~/w/e/setup ❯❯❯ ls -lha /dev/ | grep mem
crw-r-----   1 root kmem        1,     1 Oct 15 09:29 mem

From my understanding, a member of the kmem group should be allowed to read from /dev/mem. I check my group memberships:

~/w/e/setup ❯❯❯ groups
docker users video uucp kmem wheel autologin

The current user is a member of the kmem group, so I try to read a bit from /dev/mem:

~/w/e/setup ❯❯❯ head /dev/mem | hexdump -C
head: cannot open '/dev/mem' for reading: Operation not permitted

To my surprise, the operation is not permitted. The same operation works when I login as root.

Can someone explain, why I cannot read from /dev/mem as a member of group kmem? How can I enable non-root read-only access to /dev/mem for a specific user?

2

/dev/mem can only be opened by processes with CAP_SYS_RAWIO; head, not running as root, doesn’t have that capability. You can “fix” this using setcap (but only do this on a copy of the binary...):

cp /usr/bin/head .
sudo setcap cap_sys_rawio+ep head
./head /dev/mem | hexdump -C

Enabling access to /dev/mem for a specific user thus involves group membership (so that the device can be opened) and binary capabilities.

  • Thanks. This works on my development machine (Arch, Linux 4.18) with the copy of head as well as the actual target executable. On the target machine however (Arm Cortex-A8, Debian 9, Linux 4.9) it throws Failed to set capabilities on file `./head' (Operation not supported) The value of the capability argument is not permitted for a file. Or the file is not a regular (non-symlink) file. Any ideas? – Peter Power Oct 16 '18 at 13:40
  • 1
    What file system are you using on the ARM system? – Stephen Kitt Oct 16 '18 at 13:49
  • 2
    It was an nfs mount. Everything works on the local file system! – Peter Power Oct 16 '18 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.