You may succeed with giving the kmsgrab system admin capabilities, it does no longer require explicit sudo then.
sudo setcap cap_sys_admin+ep /path/to/kmsgrab
https://linux.die.net/man/8/setcap
https://linux.die.net/man/3/cap_from_text
https://man7.org/linux/man-pages/man7/capabilities.7.html
I did not debug to the end, but I strongly assume at some point DRM hits this method, which bails out with -EACCES ("Operation not permitted") when privileges are not met.