What restriction is perf_event_paranoid == 1 actually putting on x86 perf? : <p>Newer Linux kernels have a sysfs tunable <code>/proc/sys/kernel/perf_event_paranoid</code> which allows the user to adjust the available functionality of <code>perf_events</code> for non-root users, with higher numbers being more secure (offering correspondingly less functionality):</p>

<p>From the <a href="https://www.kernel.org/doc/Documentation/sysctl/kernel.txt" rel="noreferrer">kernel documenation</a> we have the following behavior for the various values:</p>

<blockquote>
  <p>perf_event_paranoid:</p>
  
  <p>Controls use of the performance events system by unprivileged users
  (without CAP_SYS_ADMIN).  The default value is 2.</p>
  
  <p>-1: Allow use of (almost) all events by all users
       Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK</p>
  
  <p>>=0: Disallow ftrace function tracepoint by users without CAP_SYS_ADMIN
       Disallow raw tracepoint access by users without CAP_SYS_ADMIN</p>
  
  <p>>=1: Disallow CPU event access by users without CAP_SYS_ADMIN</p>
  
  <p>>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN</p>
</blockquote>

<p>I have <code>1</code> in my <code>perf_event_paranoid</code> file which should "Disallow CPU event access" - but what does that mean exactly?</p>

<p>A plain reading would imply no access to CPU performance counter events (such as Intel PMU events), but it seems I can access those just fine. For example:</p>

<pre><code>$ perf stat sleep 1

 Performance counter stats for 'sleep 1':

          0.408734      task-clock (msec)         #    0.000 CPUs utilized          
                 1      context-switches          #    0.002 M/sec                  
                 0      cpu-migrations            #    0.000 K/sec                  
                57      page-faults               #    0.139 M/sec                  
         1,050,362      cycles                    #    2.570 GHz                    
           769,135      instructions              #    0.73  insn per cycle         
           152,661      branches                  #  373.497 M/sec                  
             6,942      branch-misses             #    4.55% of all branches        

       1.000830821 seconds time elapsed
</code></pre>

<p>Here, many of the events are CPU PMU events (<code>cycles</code>, <code>instructions</code>, <code>branches</code>, <code>branch-misses</code>, <code>cache-misses</code>).</p>

<p>If these aren't the CPU events being referred to, what are they?</p>
