Chapter 52. Compiler and Tools

Kernel in Red Hat Enterprise Linux 7.3 changes the default value of /proc/sys/kernel/perf_event_paranoid from 1 to 2. As a consequence, collection of performance event data of code in the kernel requires root privileges. When running the occount or operf utility as a normal user, the default performance event attempts to collect data for both kernel and user code and the setup of the performance event fails because of the default perf_event_paranoid setting.

To work around this problem, change the value in /proc/sys/kernel/perf_event_paranoid to 1. If unable to do that, instead determine the default event used on the machine by running the ophelp -d command, and then explicitly change the end of the event from :1:1 to :0:1 to disable data collection in the kernel space, for example:

$ operf -e CPU_CLK_UNHALTED:100000:0:0:1 true

As a result, changing /proc/sys/kernel/perf_event_paranoid or explicitly disabling monitoring of kernel events for normal users allows collection of data, thus avoiding this issue. (BZ#1349077)

The pesign key database, which is used to sign UEFI binaries, now offers a more generalized method of setting database access permissions. You can now configure permissions using system-wide key databases, and means that any user or group can now be granted access.

However, a known issue in permission settings in pesign currently prevents the aforementioned new feature from working. To enable the improved access control, you must change the permissions to pesign manually:

chmod 0660 /etc/pki/pesign/*
chmod 0770 /etc/pki/pesign

After setting these permissions, the improved access control will become available. If you do not perform these steps, pesign behavior will be identical to previous releases. (BZ#1141263)