Limiting access to SysRq

[curmudgeon]

On a machine that I manage, one user has just discovered the Alt+SysRq+F sequence, and has used it to kill programs of other users (something I most definitely do NOT want). It surprises me somewhat that SysRq apparently has no access controls or restrictions on which programs SysRq can kill. Does some way exist to restrict certain users from running SysRq sequences, or do I just have to disable SysRq completely (and hope that I can reenable it by writing to /proc/sys/kernel/sysrq if / when needed)?

[Hu]

There are two ways to restrict which users can use sysrq. The first option is to ban the offending user(s) from keyboard access to the affected systems. The second, slightly less strict approach, is to establish that inappropriate use of sysrq is a termination offense (in the corporate/government world, fire the user; in the academic world, expel them). In both cases, the kernel cannot know who is pressing the key, so it cannot tell whether this is an authorized user. All users with physical access are presumed authorized.

On the technical side, as I read Documentation/admin-guide/sysrq.rst, you can configure which sysrq features are enabled: