Conversation

Notices

1. Embed this notice
   Thorsten Leemhuis (acct. 1/4) (kernellogger@fosstodon.org)'s status on Saturday, 30-Dec-2023 03:19:55 JST Thorsten Leemhuis (acct. 1/4)

   Annoyed by having to put #sudo in front on #dmesg[1]?

   Then use this instead[2]:

   $ journalctl -k

   It should work if the user executing this is a member of the groups "systemd-journal", "adm", or "wheel".

   [1] which is the case if CONFIG_SECURITY_DMESG_RESTRICT is turned on in your #Linux #kernel's .config – which #Fedora recently switched on, something many other distros did already a while ago.

   [2] works for the common case, for some fancier stuff you might still need dmesg #LinuxKernel

   • Embed this notice
     Rui Seabra (ruiseabra@mastodon.social)'s status on Saturday, 30-Dec-2023 03:19:54 JST Rui Seabra

     in reply to

     @kernellogger
     So people in enterprise world will now need to do sudo journalctl -k because FreeIPA (which they likely should use) doesn't support external group memberships instead of typing less characters in sudo dmesg? :) Please note that it's not a good idea to have adm, wheel, or even systemd-journal in FreeIPA.

   • Embed this notice
     Thorsten Leemhuis (acct. 1/4) (kernellogger@fosstodon.org)'s status on Tuesday, 02-Jan-2024 21:22:31 JST Thorsten Leemhuis (acct. 1/4)

     in reply to

     • Rui Seabra

     @RuiSeabra

     Well, sounds like in that use-case that trick might not make sense. But that's how it sometimes is with such tricks.

   • Embed this notice
     Rui Seabra (ruiseabra@mastodon.social)'s status on Tuesday, 02-Jan-2024 21:22:31 JST Rui Seabra

     in reply to

     @kernellogger Yup, but it's a common problem with centralized identity in enterprise environments, it should be possible to give access do logs without local groups, or to manage addition to local groups via FreeIPA hosts/hostgroups ldap attributes.