We directly refer you to the man page on proc(5) – very valuable! – to glean information on these two security-related tunables:
- dmesg_restrict
- kptr_restrict
First, dmesg_restrict:
dmesg_restrict
/proc/sys/kernel/dmesg_restrict (since Linux 2.6.37)
The value in this file determines who can see kernel syslog contents. A value of 0 in this file imposes no restrictions. If the value is 1, only privileged users can read the kernel syslog. (See syslog(2) for more details.) Since Linux 3.4, only users with the CAP_SYS_ADMIN capability may change the value in this file.
The default (on both our Ubuntu and Fedora platforms) is 0:
$ cat /proc/sys/kernel/dmesg_restrict
0
Linux kernels use the powerful fine-granularity POSIX capabilities model. The CAP_SYS_ADMIN capability essentially is a catch-all for what is traditionally root (superuser/sysadmin) access. The CAP_SYSLOG capability gives the...