From 541b03b2a13c3958b3dfa8b0fed814df701dc5fe Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Thu, 8 Oct 2026 18:57:29 +0100 Subject: Adjust perf_event_paranoid to allow kernel profiling Linux kernel default [1] paranoia level is 2, which means unprivilage users can to profiler kernel. On my boxes only trusted users have an account (at least for now), so it is fine for them to be able to profile kernel, even if it creates security concerns. [1]: 0161028b7c8a ("perf/core: Change the default paranoia level to 2") --- roles/dev/meta/main.yml | 2 +- roles/dev/tasks/main.yml | 2 -- roles/gdb/meta/main.yml | 1 + roles/netfwd/handlers/main.yml | 4 ---- roles/netfwd/meta/main.yml | 2 ++ roles/perf/files/99-perf-event-paranoid.conf | 1 + roles/perf/meta/main.yml | 2 ++ roles/perf/tasks/main.yml | 15 +++++++++++++++ roles/sysctl/handlers/main.yml | 4 ++++ 9 files changed, 26 insertions(+), 7 deletions(-) delete mode 100644 roles/netfwd/handlers/main.yml create mode 100644 roles/netfwd/meta/main.yml create mode 100644 roles/perf/files/99-perf-event-paranoid.conf create mode 100644 roles/perf/meta/main.yml create mode 100644 roles/perf/tasks/main.yml create mode 100644 roles/sysctl/handlers/main.yml diff --git a/roles/dev/meta/main.yml b/roles/dev/meta/main.yml index f7423dc..2c6ca2a 100644 --- a/roles/dev/meta/main.yml +++ b/roles/dev/meta/main.yml @@ -4,4 +4,4 @@ dependencies: - role: vim - role: go - role: devtools - - role: debuginfod + - role: perf diff --git a/roles/dev/tasks/main.yml b/roles/dev/tasks/main.yml index 8c06ea9..b6956c2 100644 --- a/roles/dev/tasks/main.yml +++ b/roles/dev/tasks/main.yml @@ -4,8 +4,6 @@ - gcc - clang - python - - perf - - debuginfod - autoconf - make - cmake diff --git a/roles/gdb/meta/main.yml b/roles/gdb/meta/main.yml index 4aa0127..5f28894 100644 --- a/roles/gdb/meta/main.yml +++ b/roles/gdb/meta/main.yml @@ -1,2 +1,3 @@ dependencies: - role: users + - role: debuginfod diff --git a/roles/netfwd/handlers/main.yml b/roles/netfwd/handlers/main.yml deleted file mode 100644 index 0e5f805..0000000 --- a/roles/netfwd/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: Restart systemd-sysctl - ansible.builtin.service: - name: systemd-sysctl - state: restarted diff --git a/roles/netfwd/meta/main.yml b/roles/netfwd/meta/main.yml new file mode 100644 index 0000000..e5e0e39 --- /dev/null +++ b/roles/netfwd/meta/main.yml @@ -0,0 +1,2 @@ +dependencies: + - role: sysctl diff --git a/roles/perf/files/99-perf-event-paranoid.conf b/roles/perf/files/99-perf-event-paranoid.conf new file mode 100644 index 0000000..7968763 --- /dev/null +++ b/roles/perf/files/99-perf-event-paranoid.conf @@ -0,0 +1 @@ +kernel.perf_event_paranoid = 1 diff --git a/roles/perf/meta/main.yml b/roles/perf/meta/main.yml new file mode 100644 index 0000000..e5e0e39 --- /dev/null +++ b/roles/perf/meta/main.yml @@ -0,0 +1,2 @@ +dependencies: + - role: sysctl diff --git a/roles/perf/tasks/main.yml b/roles/perf/tasks/main.yml new file mode 100644 index 0000000..25c291a --- /dev/null +++ b/roles/perf/tasks/main.yml @@ -0,0 +1,15 @@ +- name: Install perf + ansible.builtin.package: + name: + - perf + state: present + +- name: Configure perf event paranoid + ansible.builtin.copy: + src: files/99-perf-event-paranoid.conf + dest: /etc/sysctl.d/99-perf-event-paranoid.conf + owner: root + group: root + mode: u+rw,g+r,o+r + notify: + - Restart systemd-sysctl diff --git a/roles/sysctl/handlers/main.yml b/roles/sysctl/handlers/main.yml new file mode 100644 index 0000000..0e5f805 --- /dev/null +++ b/roles/sysctl/handlers/main.yml @@ -0,0 +1,4 @@ +- name: Restart systemd-sysctl + ansible.builtin.service: + name: systemd-sysctl + state: restarted -- cgit v1.3.1