Restrict performance events

Why it matters

The performance events interface lets programs measure what the CPU and kernel are doing. It brings a large amount of kernel code within reach of ordinary users, and it has had many vulnerabilities. Tightening it reduces what a local attacker can touch.

How it works

Sets kernel.perf_event_paranoid to 2. Per the kernel documentation, users without CAP_PERFMON then cannot profile the kernel, use raw tracepoints or CPU-wide events, but can still measure their own user-space programs. Some distributions patch in stricter levels.

Who should use it

Good for desktops and servers where nobody profiles code. Many distributions already use 2 or higher. Developers who use perf on the kernel or system-wide should leave it as it is, or use sudo.

What you may notice

perf record for kernel or system-wide samples fails with a message that mentions perf_event_paranoid. Profiling your own program in user space usually still works at level 2.

Check it on your computer

Read the current value:

sysctl kernel.perf_event_paranoid

A stricter value than this one is also fine.

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.perf_event_paranoid=2

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-perf-events.conf <<'EOF'
kernel.perf_event_paranoid = 2
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Hide kernel addresses
• Restrict eBPF to administrators
• Limit one program inspecting another

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.perf_event_paranoid