dmesg: read kernel buffer failed: Operation not permitted

[Skewray]

Run /bin/dmesg, get:

    dmesg: read kernel buffer failed: Operation not permitted

sudo dmesg works, but I should not have to do that.

ProblemType: Bug
DistroRelease: Ubuntu 21.10
Package: util-linux 2.36.1-8ubuntu2
ProcVersionSignature: Ubuntu 5.13.0-21.21-generic 5.13.18
Uname: Linux 5.13.0-21-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu71
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: XFCE
Date: Thu Nov 25 11:13:58 2021
ProcEnviron:
 LANGUAGE=en_US
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 SHELL=/bin/tcsh
SourcePackage: util-linux
UpgradeStatus: Upgraded to impish on 2021-11-21 (3 days ago)

[Mauricio Faria de Oliveira (mfo)]

This has been intentionally changed a while ago, please see [1]. Thanks!

[1] https://lists.ubuntu.com/archives/ubuntu-devel/2020-June/041063.html

[Skewray (ubuntu-skewray)]

And yet /var/log/dmesg is wide open. How entertaining!

[Mauricio Faria de Oliveira (mfo)]

That isn't the case, apparently.

The file is only readable by user/group, but not others, in Impish, at least.

Upgrade:

$ lsb_release -cs
impish

$ ls -l /var/log/dmesg
-rw-r----- 1 root adm 95595 Oct 28 11:46 /var/log/dmesg

Install:

$ lsb_release -cs
impish

$ ls -l /var/log/dmesg
-rw-r----- 1 root adm 45200 Dec 1 12:12 /var/log/dmesg

[Skewray (ubuntu-skewray)]

Apparently I am in the adm group. Who knew? Seems like dmesg could check the user for that.

[Marji Cermak (cermakm)]

I can confirm dmesg on Ubuntu 21.10 gives me "Operation not permitted", even though my user is in the "adm" group:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.10
Release: 21.10
Codename: impish

$ ls -l /var/log/dmesg*
-rw-r----- 1 root adm 100336 Mar 13 17:01 /var/log/dmesg
-rw-r----- 1 root adm 94365 Mar 13 16:40 /var/log/dmesg.0
-rw-r----- 1 root adm 23990 Mar 13 15:00 /var/log/dmesg.1.gz
-rw-r----- 1 root adm 23017 Mar 9 21:50 /var/log/dmesg.2.gz
-rw-r----- 1 root adm 23295 Mar 4 18:51 /var/log/dmesg.3.gz
-rw-r----- 1 root adm 23253 Feb 24 21:34 /var/log/dmesg.4.gz

$ id
uid=1000(marji) gid=1000(marji) groups=1000(marji),4(adm),5(tty),10(uucp),20(dialout),24(cdrom),27(sudo),30(dip),46(plugdev),121(lpadmin),132(lxd),133(sambashare),134(docker)

$ dmesg
dmesg: read kernel buffer failed: Operation not permitted

[Marji Cermak (cermakm)]

I can now see that the dmesg command - starting with Ubuntu 21.10 - is NOT meant to work for the users in "adm" group. It is now meant to be run as admin or with sudo. This is a security decision.
Described in here: https://ruffell.nz/programming/writeups/2020/10/24/getting-dmesg-restrict-enabled-in-ubuntu-groovy.html

[jglen490 (jglen490)]

Interesting that this was supposed to have been incorporated into Ubuntu, and therefore all the *buntu flavors since the end of 2021. Well, up until this evening (28 May 2024) i have been able the simply use dmesg, without sudo, in every Kubuntu distro I've used since then and of course before then. And also of course, Kubuntu IS Ubuntu with just a few different sparkly parts on UI end of things.

Well, if you all believe that limiting dmesg to only use with sudo is somehow more secure, then O.K. I'm just surprised that it took this long to be implemented.

Have a great day!!