dmesg: read kernel buffer failed: Permission denied

Question

Since recently Debian has changed the default behavior for dmesg and I cannot use it simply from my local user.

% dmesg
dmesg: read kernel buffer failed: Operation not permitted

Same goes for:

% cat /dev/kmsg                      
cat: /dev/kmsg: Operation not permitted

Starring at the bug tracker this lead to:

• dmesg: read kernel buffer failed: Operation not permitted

How do I change this behavior back to the previous one, where local user are allowed to use dmesg. I could not find a particular group for it (eg. sudoers or something like that).

Solution

So it was actually trivial, looking at the very last message from the bug report:

• Re: Bug#842226: dmesg: read kernel buffer failed: Operation not permitted

Part of the changelog from the aforementioned kernel: * security,printk: Enable SECURITY_DMESG_RESTRICT, preventing non-root users reading the kernel log by default (sysctl: kernel.dmesg_restrict)

So the solution is simply to run once:

% sudo sysctl kernel.dmesg_restrict=0
kernel.dmesg_restrict = 0

Then your local user can start using dmesg again. This apply to any user, instead of a group which I initially assumed.

Everything is back to what I wanted:

% dmesg|wc
   1307   11745   93652

and

% cat /dev/kmsg|head|wc
     10      82     857

And to make it persists across reboots, simply save it as conf file:

$ cat /etc/sysctl.d/10-local.conf 
kernel.dmesg_restrict = 0

Comments

[direprobs]

Are you able to execute this command: cat /dev/kmesg as a regular user?

[direprobs]

It should be /dev/kmsg in the first comment that was a typo.

[Knobee]

Easier to make it permanent by adding kernel.dmesg_restrict = 0 to /etc/sysctl.conf

[scruss]

In Ubuntu 20.10, there is already a line for this in /etc/sysctl.d/10-kernel-hardening.conf. After changing the file, the user should run sudo service procps restart to allow dmesg viewing again.