LOW RHCOS (Node) L2: Sysctl dmesg_restrict P4

Verified Compare Branch Scanned: 2026-01-14

FAIL on vanilla RHCOS 9.8. Remediation tested and works.

Overview

This remediation restricts access to kernel ring buffer messages (dmesg) to privileged users only, preventing information disclosure about kernel internals.

Settings

Setting	Value	Description
`kernel.dmesg_restrict`	`1`	Restrict kernel log access to privileged users

Implementation

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-sysctl-low
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    storage:
      files:
        - path: /etc/sysctl.d/75-dmesg-restrict.conf
          mode: 0644
          overwrite: true
          contents:
            inline: |
              # Restrict dmesg access to root
              kernel.dmesg_restrict = 1

Compliance Checks Remediated

Check	Profile	Docs
`rhcos4-e8-worker-sysctl-kernel-dmesg-restrict`	E8	📖
`rhcos4-e8-master-sysctl-kernel-dmesg-restrict`	E8	📖

Source Remediation Files

low/rhcos4-e8-worker-sysctl-kernel-dmesg-restrict.yaml
low/rhcos4-e8-master-sysctl-kernel-dmesg-restrict.yaml

Verification

After applying, verify the sysctl setting:

oc debug node/<node-name> -- chroot /host sysctl kernel.dmesg_restrict
# Expected: kernel.dmesg_restrict = 1

Security Impact

Restricting dmesg access prevents:

Information disclosure about kernel modules
Leaking kernel addresses useful for exploitation
Exposure of hardware configuration details
Reconnaissance by unprivileged users

When dmesg_restrict = 0

Unprivileged users can run:

dmesg

And see kernel messages including:

Loaded modules
Hardware detection
Kernel addresses (useful for ASLR bypass)

When dmesg_restrict = 1

Only root (CAP_SYSLOG) can access kernel logs via dmesg.

Upstream Proposal

The following changes could eliminate the need for MachineConfig remediation. Items are categorized by recommended scope:

kernel.dmesg_restrict=1 All OCP Low

openshift/os /usr/lib/sysctl.d/50-security-hardening.conf View Proposed Change

Restricts kernel log access to root. Prevents unprivileged users from reading kernel ring buffer for info leakage.
Scope: Unprivileged users have no legitimate need to read kernel ring buffer on any OCP node.

PR History

kernel.dmesg_restrict=1 Closed redirected

coreos/rhel-coreos-config#264 opened 2026-06-02, closed 2026-06-04

Maintainer (@dustymabe) prefers accepting RHEL defaults and changing at the RHEL level. dmesg_restrict is already CONFIG_SECURITY_DMESG_RESTRICT=y in kernel-ark but not enforced at runtime. Suggested proposing bpf_jit_harden further upstream. Fedora 44 Change Proposal may resolve bpf_jit_harden upstream. Hold and verify whether RHEL 10/RHCOS 10 inherits these defaults.

coreos/rhel-coreos-config/pull/264 www.mail-archive.com/devel@lists.fedoraproject.org/msg209291.html

← L1 All Groups MAN1 →