Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As I can find in Mac OS X

smarek:~ marekseberaold$ dmesg
Unable to obtain kernel buffer: Operation not permitted
usage: sudo dmesg

Is this really important, to disable access to dmesg output for non-root / non-administrative users? Why is Apple doing this at all?

share|improve this question
    
Apparently, the need to run as root comes from the original BSD command. I think that modern FreeBSD has abandoned the need for root dmesg. –  new123456 Jan 26 '12 at 12:15

1 Answer 1

A clear "yes" from my side:

An attacker can use it to snoop kernel messages, e.g. about segfaults, kernel errors and thus use it as feedback loop for exploit optimization. Another usecase: the iptables LOG target will write to same buffer, information about connections of other users can then be misused to spoof packets with better chance for success.

I guess someone skilled will find even more ways to use dmesg to aid in privilege escalation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.