perf error: failed to open /sys/kernel/debug - permission denied - how to fix

perf error: failed to open /sys/kernel/debug - permission denied - how to fix

TL;DR

perf needs access to kernel tracing facilities, which are locked down by the perfeventparanoid sysctl and file permissions. Lower the paranoid level or grant CAPSYSADMIN / CAP_PERFMON, and mount debugfs. For most user-space profiling you do not need full kernel access at all.

perf error: failed to open /sys/kernel/debug - permission denied

Steps

1. Check the paranoid level: cat /proc/sys/kernel/perfeventparanoid. Values above 0 restrict unprivileged use. Expected: You know the current restriction level.

2. For user-space-only profiling, set it to 1 or 2 (echo 1 > /proc/sys/kernel/perfeventparanoid, persisted via sysctl.conf). Level 2 still allows per-process profiling. Expected: perf record -p [pid] works without root.

3. For system-wide or kernel symbols, you need more: run as root or grant CAPPERFMON (newer kernels) / CAPSYS_ADMIN, and mount debugfs (mount -t debugfs none /sys/kernel/debug). Expected: perf can open the debug path.

4. In containers, add --cap-add=SYSADMIN or --cap-add=PERFMON and --privileged is the blunt alternative; also pass /proc/sys/kernel/perfevent_paranoid from the host. Expected: Containerized perf attaches successfully.

5. Prefer the least privilege that works: user-space flame graphs rarely need kernel stacks, so stop at level 2 instead of going full root. Expected: Profiles capture what you need without weakening the host.

When to use

• perf fails to open /sys/kernel/debug with permission denied
• perfeventparanoid blocks unprivileged profiling
• profiling inside containers

When not to use

• perf runs but shows [unknown] symbols (that is a symbolization problem, not permissions)
• the error is 'not counted' or multiplexing (event limits, different issue)
• you only need CPU time per process (higher-level tools avoid perf entirely)

Tool compatibility

• Linux perf (any recent kernel)
• kernel 5.x+ for CAP_PERFMON

Variant phrasings

• "perf permission denied sys kernel debug"
• "failed to open /sys/kernel/debug perf"
• "perfeventparanoid profiling"

Why it happens

The kernel guards its tracing interfaces because they can leak information across processes. perfeventparanoid and debugfs permissions are the gates. perf fails fast with permission denied instead of silently producing empty profiles, which is why this error is actually helpful.

Edge cases

• lowering perfeventparanoid is host-wide; document it as a profiling-host setting, not a production default
• some cloud VMs virtualize the PMU away entirely; no permission change can fix missing hardware counters
• kernel debuginfo packages are separate from the permission fix; you need both for kernel symbols

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2QMmloalkU2Qz25TqN7TZQ