How to run linux perf without root

Question

I want to benchmark an application of mine. Up to now I used gnu time, but perf yields much better stats.

As a matter of principle I would like to go the route of a decicated perf user instead of allowing all users some security-related things, not because I am aware of a specific danger but because I don't understand the security implications. Therefore I'd like to avoid lowering the paranoid setting for perf as discussed in this question.

Reading kernel.org on perf-security (note that the document seems to imply that this should work with Linux 5.9 or later), I did this:

# addgroup perf_users
# adduser perfer
# addgroup perfer perf_users
# cd /usr/bin
# chgrp perf_users perf
# chmod o-rwx perf
# setcap "cap_perfmon,cap_sys_ptrace,cap_syslog=ep" perf
# setcap -v "cap_perfmon,cap_sys_ptrace,cap_syslog=ep" perf

which returns perf: ok.

# getcap perf returns perf cap_sys_ptrace,cap_syslog,cap_perfmon=ep.

which is different from the link where they got perf = cap_sys_ptrace,cap_syslog,cap_perfmon+ep

My Linux is 5.10.0-5-amd64 #1 SMP Debian 5.10.24-1

If I now run perf with user perfer I still get the error message

Error:
Access to performance monitoring and observability operations is limited.
Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
access to performance monitoring and observability operations for processes
without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
More information can be found at 'Perf events and tool security' document:
https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
perf_event_paranoid setting is 3:
  -1: Allow use of (almost) all events by all users
      Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
>= 0: Disallow raw and ftrace function tracepoint access
>= 1: Disallow CPU event access
>= 2: Disallow kernel profiling
To make the adjusted perf_event_paranoid setting permanent preserve it
in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)

which I tried to circumvent with all the above.

Do any of you know, how to get perfer to run perf without lowering the paranoid setting?

Answer 1

Standard ways of doing this include but not limited by

1. Adding a user or group using visudo to run specific commands https://www.digitalocean.com/community/tutorials/how-to-edit-the-sudoers-file

2. Setting the SUID or GUID sticky bit using chmod https://www.redhat.com/sysadmin/suid-sgid-sticky-bit

Answer 2

Make sure CAP_PERFMON capability is set:

sudo setcap "cap_perfmon,cap_sys_ptrace,cap_syslog=ep" /usr/bin/perf

To verify, run:

getcap /usr/bin/perf

You should get an output like:

/usr/bin/perf = cap_perfmon,cap_sys_ptrace,cap_syslog=ep

Then add the user perfer to the perf_users group:

sudo usermod -aG perf_users perfer

Log out and log back in as perfer to apply the group changes, then should be able to run perf without modifying the perf_event_paranoid setting.

Good luck!

Answer 3

Your setup seems mostly correct but we need to ensure that the perfer user can run perf without modifying the perf_event_paranoid setting.

1. Verify the capabilities : Ensure that the capabilities are set correctly on the perf binary. You mentioned that getcap perf returns perf cap_sys_ptrace,cap_syslog,cap_perfmon=ep, which is correct. The difference in notation (ep vs. +ep) is not significant.

2. Check Group membership: Ensure that the perfer user is indeed part of the perf_users group. You can check this with: id prefer

3. Check the permissions on perf:

   ls -l /usr/bin/perf If the problem persists :

   strace -e capget,capset perf stat ls
   

run that command and get back to me .