Index: sys/sys/priv.h
===================================================================
--- sys/sys/priv.h	(revision 251793)
+++ sys/sys/priv.h	(working copy)
@@ -494,9 +494,15 @@
 #define	PRIV_RCTL_REMOVE_RULE	674
 
 /*
+ * Kernel memory privileges.
+ */
+#define	PRIV_KMEM_READ		680	/* Read from kernel memory. */
+#define	PRIV_KMEM_WRITE		681	/* Write to kernel memory. */
+
+/*
  * Track end of privilege list.
  */
-#define	_PRIV_HIGHEST		675
+#define	_PRIV_HIGHEST		682
 
 /*
  * Validate that a named privilege is known by the privilege system.  Invalid
Index: sys/kern/kern_priv.c
===================================================================
--- sys/kern/kern_priv.c	(revision 251793)
+++ sys/kern/kern_priv.c	(working copy)
@@ -142,6 +142,15 @@
 	}
 
 	/*
+	 * Writes to kernel memory are a typical root-only operation,
+	 * but non-root users are expected to be able to read it.
+	 */
+	if (priv == PRIV_KMEM_READ) {
+		error = 0;
+		goto out;
+	}
+
+	/*
 	 * Now check with MAC, if enabled, to see if a policy module grants
 	 * privilege.
 	 */
Index: sys/dev/mem/memdev.c
===================================================================
--- sys/dev/mem/memdev.c	(revision 251793)
+++ sys/dev/mem/memdev.c	(working copy)
@@ -67,8 +67,14 @@
 {
 	int error = 0;
 
-	if (flags & FWRITE)
-		error = securelevel_gt(td->td_ucred, 0);
+	if (flags & FREAD)
+		error = priv_check(td, PRIV_KMEM_READ);
+	if (flags & FWRITE) {
+		if (error != 0)
+			error = priv_check(td, PRIV_KMEM_WRITE);
+		if (error != 0)
+			error = securelevel_gt(td->td_ucred, 0);
+	}
 
 	return (error);
 }