From the code you posted above, $perm = ob_get_contents();
That means $perm is the contents of the output buffer or the output (presumably) of the perm.php page. NOT a URL.
But the iframe SRC is looking for a URL ONLY. You can't put iframe content in the
src= attribute.
Actually, it appears HTML5 does allow you to specify the code in the iframe but it uses the srcdoc attribute -
http://www.w3schools.com/tags/tag_iframe.asp