Keep the kernel log for administrators

Why it matters

The kernel log records driver messages, hardware details and sometimes memory addresses. Any local user or program can normally read it with dmesg, so a compromised app can learn things that help it attack the kernel. Restricting it keeps that detail with administrators.

How it works

Sets kernel.dmesg_restrict to 1. Reading the kernel ring buffer with dmesg then requires the CAP_SYSLOG capability, which root has. Note that the same messages can still reach users who may read the system journal, for example members of the adm group.

Who should use it

Good for shared computers and for anyone who wants to limit what a hijacked program can learn. Leave it off if regular users on a development machine rely on running dmesg without sudo.

What you may notice

Running dmesg as a normal user fails with Operation not permitted. Use sudo dmesg, or journalctl -k if your account may read the journal.

Check it on your computer

Read the current value:

sysctl kernel.dmesg_restrict

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.dmesg_restrict=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-dmesg-restrict.conf <<'EOF'
kernel.dmesg_restrict = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Hide kernel addresses

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.dmesg_restrict