10

I want to benchmark an application of mine. Up to now I used gnu time, but perf yields much better stats.

As a matter of principle I would like to go the route of a decicated perf user instead of allowing all users some security-related things, not because I am aware of a specific danger but because I don't understand the security implications. Therefore I'd like to avoid lowering the paranoid setting for perf as discussed in this question.

Reading kernel.org on perf-security (note that the document seems to imply that this should work with Linux 5.9 or later), I did this:

# addgroup perf_users
# adduser perfer
# addgroup perfer perf_users
# cd /usr/bin
# chgrp perf_users perf
# chmod o-rwx perf
# setcap "cap_perfmon,cap_sys_ptrace,cap_syslog=ep" perf
# setcap -v "cap_perfmon,cap_sys_ptrace,cap_syslog=ep" perf

which returns perf: ok.

# getcap perf returns perf cap_sys_ptrace,cap_syslog,cap_perfmon=ep.

which is different from the link where they got perf = cap_sys_ptrace,cap_syslog,cap_perfmon+ep

My Linux is 5.10.0-5-amd64 #1 SMP Debian 5.10.24-1

If I now run perf with user perfer I still get the error message

Error:
Access to performance monitoring and observability operations is limited.
Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
access to performance monitoring and observability operations for processes
without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
More information can be found at 'Perf events and tool security' document:
https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
perf_event_paranoid setting is 3:
  -1: Allow use of (almost) all events by all users
      Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
>= 0: Disallow raw and ftrace function tracepoint access
>= 1: Disallow CPU event access
>= 2: Disallow kernel profiling
To make the adjusted perf_event_paranoid setting permanent preserve it
in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)

which I tried to circumvent with all the above.

Do any of you know, how to get perfer to run perf without lowering the paranoid setting?

3
  • perf with which arguments?
    – aviro
    Nov 2, 2022 at 22:21
  • 1
    I hope I find the time today to revisit this.
    – Eike
    Nov 3, 2022 at 5:59
  • Apparently I didn't find the time and probably won't find it soon, sorry.
    – Eike
    Dec 22, 2022 at 19:13

1 Answer 1

0

Standard ways of doing this include but not limited by

  1. Adding a user or group using visudo to run specific commands https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file

  2. Setting the SUID or GUID sticky bit using chmod https://www.redhat.com/sysadmin/suid-sgid-sticky-bit

1
  • 1
    I feel like you havn't read the question. I have no idea, how your answer should help me. Although I still havn't found the time, to reinvestigate my problem at all. If you really feel, your answer can resolve the issue of the warning with perf, please elaborate.
    – Eike
    Feb 18, 2023 at 21:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .