AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

[madaidan]

@madaidan

I couldn’t restrict just dmesg either. It doesn’t seem to read stuff from a file but use some kernel magic to get the logs.

It might be better to just fix this directly in the kernel with a patch adding a kernel.dmesg_restrict=2 sysctl rather than trying to hack our way around it.