I turned on CONFIG_GRKERNSEC_DMESG=y and grsec sysctl settings of my hardened kernel.
Any idea why this is not restricted?
I can't say for sure but dmesg_restrict is set by CONFIG_SECURITY_DMESG_RESTRICT, so perhaps these both need to be enabled for grsecurity.dmesg to come into effect.
unless the dmesg_restrict sysctl is explicitly set to (1).
That would suggest that this is normally disabled but can also be enabled by setting it via sysctl, which i'm doing right now.
Anyway, thx for the suggestion. Will give it a try and report back.
yzh ... yes, thats how I read it also, but my thought was that, like other items in menuconfig, it may be badly worded. If the above were true then "[t]his enforces restrictions on unprivileged users reading the kernel syslog via dmesg" would not what the option does, it simply set it to 'on'.
I too have noticed the same problem with the latest stable hardened sources. With my previous kernel 3.4.5-hardened, dmesg restriction where enforced.
This seems to be a bug..
Good to know it's not only me I'll see if I can make a bug report later.
With new version of hardened sources the dmesg output is again restricted.