# perf error: failed to open /sys/kernel/debug - permission denied - how to fix

## TL;DR

perf needs access to kernel tracing facilities, which are locked down by the perf_event_paranoid sysctl and file permissions. Lower the paranoid level or grant CAP_SYS_ADMIN / CAP_PERFMON, and mount debugfs. For most user-space profiling you do not need full kernel access at all.

```text
perf error: failed to open /sys/kernel/debug - permission denied
```

## Steps

1. Check the paranoid level: cat /proc/sys/kernel/perf_event_paranoid. Values above 0 restrict unprivileged use.
   Expected: You know the current restriction level.

2. For user-space-only profiling, set it to 1 or 2 (echo 1 > /proc/sys/kernel/perf_event_paranoid, persisted via sysctl.conf). Level 2 still allows per-process profiling.
   Expected: perf record -p [pid] works without root.

3. For system-wide or kernel symbols, you need more: run as root or grant CAP_PERFMON (newer kernels) / CAP_SYS_ADMIN, and mount debugfs (mount -t debugfs none /sys/kernel/debug).
   Expected: perf can open the debug path.

4. In containers, add --cap-add=SYS_ADMIN or --cap-add=PERFMON and --privileged is the blunt alternative; also pass /proc/sys/kernel/perf_event_paranoid from the host.
   Expected: Containerized perf attaches successfully.

5. Prefer the least privilege that works: user-space flame graphs rarely need kernel stacks, so stop at level 2 instead of going full root.
   Expected: Profiles capture what you need without weakening the host.

## When to use

- perf fails to open /sys/kernel/debug with permission denied
- perf_event_paranoid blocks unprivileged profiling
- profiling inside containers

## When not to use

- perf runs but shows [unknown] symbols (that is a symbolization problem, not permissions)
- the error is 'not counted' or multiplexing (event limits, different issue)
- you only need CPU time per process (higher-level tools avoid perf entirely)

## Tool compatibility

- Linux perf (any recent kernel)
- kernel 5.x+ for CAP_PERFMON

## Variant phrasings

- "perf permission denied sys kernel debug"
- "failed to open /sys/kernel/debug perf"
- "perf_event_paranoid profiling"

## Why it happens

The kernel guards its tracing interfaces because they can leak information across processes. perf_event_paranoid and debugfs permissions are the gates. perf fails fast with permission denied instead of silently producing empty profiles, which is why this error is actually helpful.

## Edge cases

- lowering perf_event_paranoid is host-wide; document it as a profiling-host setting, not a production default
- some cloud VMs virtualize the PMU away entirely; no permission change can fix missing hardware counters
- kernel debuginfo packages are separate from the permission fix; you need both for kernel symbols

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2QMmloalkU2Qz25TqN7TZQ