Non-root read access to /dev/mem by kmem group members fails

Question

I'm trying to read physical memory as a non-root user using /dev/mem. Checking the permissions of /dev/mem:

~/w/e/setup ❯❯❯ ls -lha /dev/ | grep mem
crw-r-----   1 root kmem        1,     1 Oct 15 09:29 mem

From my understanding, a member of the kmem group should be allowed to read from /dev/mem. I check my group memberships:

~/w/e/setup ❯❯❯ groups
docker users video uucp kmem wheel autologin

The current user is a member of the kmem group, so I try to read a bit from /dev/mem:

~/w/e/setup ❯❯❯ head /dev/mem | hexdump -C
head: cannot open '/dev/mem' for reading: Operation not permitted

To my surprise, the operation is not permitted. The same operation works when I login as root.

Can someone explain, why I cannot read from /dev/mem as a member of group kmem? How can I enable non-root read-only access to /dev/mem for a specific user?

Answer 1

/dev/mem can only be opened by processes with CAP_SYS_RAWIO; head, not running as root, doesn’t have that capability. You can “fix” this using setcap (but only do this on a copy of the binary...):

cp /usr/bin/head .
sudo setcap cap_sys_rawio+ep head
./head /dev/mem | hexdump -C

Enabling access to /dev/mem for a specific user thus involves group membership (so that the device can be opened) and binary capabilities.