Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As I can find in Mac OS X

smarek:~ marekseberaold$ dmesg
Unable to obtain kernel buffer: Operation not permitted
usage: sudo dmesg

Is this really important, to disable access to dmesg output for non-root / non-administrative users? Why is Apple doing this at all?

share|improve this question
Apparently, the need to run as root comes from the original BSD command. I think that modern FreeBSD has abandoned the need for root dmesg. – new123456 Jan 26 '12 at 12:15
up vote 1 down vote accepted

A clear "yes" from my side:

An attacker can use it to snoop kernel messages, e.g. about segfaults, kernel errors and thus use it as feedback loop for exploit optimization. Another usecase: the iptables LOG target will write to same buffer, information about connections of other users can then be misused to spoof packets with better chance for success.

I guess someone skilled will find even more ways to use dmesg to aid in privilege escalation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.