Turn off the SysRq emergency keys

Why it matters

The magic SysRq key combination talks directly to the kernel and works even when the screen is locked. Anyone at the keyboard can use it to reboot immediately, kill every process or force other actions without logging in. Turning it off closes that keyboard shortcut.

How it works

Sets kernel.sysrq to 0, which switches off all SysRq functions invoked from the keyboard. The kernel documentation notes that writing to /proc/sysrq-trigger as an administrator is still allowed, since this setting only affects the keyboard.

Who should use it

Useful for shared or public computers and laptops left unattended. Leave it on if you value the REISUB emergency sequence for recovering from a frozen desktop. Some prefer a middle value that allows only sync and reboot.

What you may notice

Pressing Alt+SysRq combinations does nothing, so a frozen machine can only be fixed with the power button. If the emergency keys stop responding, this is the cause.

Check it on your computer

Read the current value:

sysctl kernel.sysrq

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.sysrq=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-sysrq.conf <<'EOF'
kernel.sysrq = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Forbid loading another kernel while running

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.sysrq