6

On my installation of Ubuntu Focal, kernel.perf_event_paranoid is set to 4 by default:

$ sysctl kernel.perf_event_paranoid
kernel.perf_event_paranoid = 4

(I've checked /etc/sysctl.conf and the associated config dir, I haven't set this.)

This seems weird to me, because the kernel documentation does not describe any additional effect for values higher than 2:

perf_event_paranoid:

Controls use of the performance events system by unprivileged
users (without CAP_SYS_ADMIN).  The default value is 2.

 -1: Allow use of (almost) all events by all users
     Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
>=0: Disallow ftrace function tracepoint by users without CAP_SYS_ADMIN
     Disallow raw tracepoint access by users without CAP_SYS_ADMIN
>=1: Disallow CPU event access by users without CAP_SYS_ADMIN
>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN

(Source.)

I did quick search of the mainline kernel source code, and I couldn't find any place where perf_event_paranoid was compared to a number higher than 2.

However, setting to 4 does have an effect. I ran the following perf command, with perf_event_paranoid set to 4, as a non-root user:

perf stat -e context-switches,cpu-migrations -r 1 -- sleep 1

It shows the following error:

Error:
Access to performance monitoring and observability operations is limited.
Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
access to performance monitoring and observability operations for processes
without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
More information can be found at 'Perf events and tool security' document:
https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
perf_event_paranoid setting is 4:
  -1: Allow use of (almost) all events by all users
      Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
>= 0: Disallow raw and ftrace function tracepoint access
>= 1: Disallow CPU event access
>= 2: Disallow kernel profiling
To make the adjusted perf_event_paranoid setting permanent preserve it
in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)

If I change kernel.perf_event_paranoid to 3, and run the same command, I get the following result, again as a non-root user:


 Performance counter stats for 'sleep 1':

                 0      context-switches:u                                          
                 0      cpu-migrations:u                                            

       1.000502603 seconds time elapsed

       0.000460000 seconds user
       0.000000000 seconds sys

So changing the perf_event_paranoid setting from the default of 4 to 3 has some effect, even if the Linux kernel documentation doesn't say what.

What gives? Does Ubuntu ship with a custom patch that adds a new, more paranoid perf level?

Other distributions

Debian seems to carry a non-standard patch creating a perf_event_paranoid level of 3:

Jeff Vander Stoep posted the patch on July 27. It adds a another value that can be set for the sysctl parameter (i.e. kernel.perf_event_paranoid=3) that restricts perf_event_open() to processes with the CAP_SYS_ADMIN capability. Currently, perf_event_paranoid is set to 2 by default, which disallows access to some perf features (raw tracepoint access, CPU event access, and kernel profiling) to processes without the proper capabilities; the patch does not change the default. He also submitted another patch that would allow configuring the kernel to make 3 be the default perf_event_paranoid value.

(Source.)

But it would seem Ubuntu is even more paranoid than that.

2 Answers 2

7

Level 4 does exactly the same thing as the Debian patch: it disables unprivileged processes from using perf_event_open(). However, the restriction kicks in at paranoia level 4, instead of paranoia level 3.

The current paranoia levels are documented in a comment in the kernel source, in file kernel/events/core.c.

/*
 * perf event paranoia level:
 *  -1 - not paranoid at all
 *   0 - disallow raw tracepoint access for unpriv
 *   1 - disallow cpu events for unpriv
 *   2 - disallow kernel profiling for unpriv
 *   4 - disallow all unpriv perf event use
 */

The commit making this change can be found here. (Note: that the commit message and the kernel comments contradict each other. The kernel comments seem correct to me.)

To summarize:

  • Levels -1 through 2: Same as mainline kernel.
  • Level 3: Same as level 2? Could not 100% confirm this. There is a constant PERF_SECURITY_TRACEPOINT set to 3 which is still used some places.
  • Level 4: Disable perf_event_open entirely for unprivileged users.
1

Along with disabling it for non-privileged users as Nick correctly points out, paranoia level 4 also seems to apply the same restrictions to privileged files.

For example, on my Ubuntu 20.04 system I have set up a perf_users group in accordance with the official documentation, and endowed perf with the following capabilities

$ getcap perf
perf = cap_sys_ptrace,cap_syslog,38+ep

Running with paranoia level 3 works as expected for non-privileged users. At paranoia level 4 however, perf returns the error from the question in spite of the file capabilities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .