Restrict the kernel log buffer to privileged users

Description

The kernel.dmesg_restrict sysctl controls who can read the kernel ring buffer with dmesg or /dev/kmsg. With 1, only processes with the CAP_SYSLOG capability can read it.

Debian kernels are built with this restriction on by default, so the check usually passes on a fresh install. The control guards against it being turned off.

Rationale

Kernel messages often contain memory addresses, driver and firmware versions, and traces of failed operations. Reading them helps a local attacker tune a kernel exploit.

Impact

Unprivileged users can no longer run dmesg. Administrators use sudo dmesg or journalctl -k, which needs membership of the adm or systemd-journal group.

Setting

Audit

Run sysctl kernel.dmesg_restrict. The value must be 1. Then check that no sysctl configuration file sets it to 0.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of kernel.dmesg_restrict.

key: kernel.dmesg_restrict
value: 1

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing kernel.dmesg_restrict = 1, remove any other assignment of this key, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl -w kernel.dmesg_restrict=0.

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - Documentation for /proc/sys/kernel/ (dmesg_restrict) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R9) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle