lowsystemverified ✓rollback-safe
Restrict use of performance events
kernel-perf-restrict · RHEL ≥ 8 · 1 impl
Description
The kernel.perf_event_paranoid sysctl must be set to restrict access to performance monitoring events.
Rationale
Performance events can be used for side-channel attacks or to gather information about system activity. Restricting access prevents unauthorized profiling.
Check → Remediate
Checksysctl_value
- key:
- kernel.perf_event_paranoid
- expected:
- 2
Remediatesysctl_set
- key:
- kernel.perf_event_paranoid
- value:
- 2
Framework references
STIG
V-230270V-257798V-281306 / RHEL-10-701040
NIST 800-53
CM-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#sysctl#perf#kernel#security#stig