ProtectKernelLogs setting

This systemd unit setting was added since systemd 244.

Purpose: define if service may read or write to the kernel log ring buffer

Background

The Linux kernel exposes its kernel log ring buffer to userspace via /dev/kmsg and /proc/kmsg.

When this setting is defined as yes, the capability CAP_SYS_MODULE will be removed from the capability bounding set. This means that all processes in the unit will no longer have access to the kernel log ring buffer.

Generic advice

For most common services access to the kernel log ring buffer is not need, therefore safe to disable (ProtectKernelLogs=yes).

Values

This setting expects a boolean (yes or no).

• no: access to kernel log ring buffer allowed - default
• yes: access to kernel log ring buffer will be denied

Example to show the current value of ProtectKernelLogs for the dmesg service: