christoph/wamr
1
Fork 0
Code Releases Activity

linux-sgx: Implement SGX IPFS as POSIX backend for file interaction (#1489)

Browse Source 
This PR integrates an Intel SGX feature called Intel Protection File System Library (IPFS)
into the runtime to create, operate and delete files inside the enclave, while guaranteeing
the confidentiality and integrity of the data persisted. IPFS can be referred to here:
https://www.intel.com/content/www/us/en/developer/articles/technical/overview-of-intel-protected-file-system-library-using-software-guard-extensions.html

Introduce a cmake variable `WAMR_BUILD_SGX_IPFS`, when enabled, the files interaction
API of WASI will leverage IPFS, instead of the regular POSIX OCALLs. The implementation
has been written with light changes to sgx platform layer, so all the security aspects
WAMR relies on are conserved.

In addition to this integration, the following changes have been made:
 - The CI workflow has been adapted to test the compilation of the runtime and sample
    with the flag `WAMR_BUILD_SGX_IPFS` set to true
 - Introduction of a new sample that demonstrates the interaction of the files (called `file`),
 - Documentation of this new feature
This commit is contained in:
Jämes Ménétrey
2022-09-28 07:09:58 +02:00
committed by GitHub
parent fa736d1ee9
commit dfd16f8e4f
20 changed files with 1211 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
product-mini/platforms/linux-sgx/enclave-sample/Enclave/Enclave.edl
View File

@ -4,6 +4,7 @@
*/
#define LIB_RATS 0
#define SGX_IPFS 0
enclave {
from "sgx_tstdc.edl" import *;
@ -12,6 +13,9 @@ enclave {
#if LIB_RATS != 0
from "rats.edl" import *;
#endif
#if SGX_IPFS != 0
from "sgx_tprotected_fs.edl" import *;
#endif
trusted {
/* define ECALLs here. */

12
product-mini/platforms/linux-sgx/enclave-sample/Makefile
View File

@ -9,6 +9,9 @@ SGX_ARCH ?= x64
SGX_DEBUG ?= 0
SPEC_TEST ?= 0
# This variable is automatically set by CMakeLists.txt
SGX_IPFS = 0
VMLIB_BUILD_DIR ?= $(CURDIR)/../build
LIB_RATS_SRC ?= $(VMLIB_BUILD_DIR)/_deps/librats-build
LIB_RATS := $(shell if [ -d $(LIB_RATS_SRC) ]; then echo 1; else echo 0; fi)
@ -106,6 +109,12 @@ else
Trts_Library_Name := sgx_trts
Service_Library_Name := sgx_tservice
endif
ifeq ($(SGX_IPFS), 1)
Intel_Ipfs_Trusted_Flag = -lsgx_tprotected_fs
App_Link_Flags += -lsgx_uprotected_fs
endif
Crypto_Library_Name := sgx_tcrypto
WAMR_ROOT := $(CURDIR)/../../../../
@ -139,7 +148,7 @@ endif
Enclave_Cpp_Flags := $(Enclave_C_Flags) -std=c++11 -nostdinc++
Enclave_Link_Flags := $(SGX_COMMON_CFLAGS) -Wl,--no-undefined -nostdlib -nodefaultlibs -nostartfiles -L$(SGX_LIBRARY_PATH) ${Rats_Lib_Link_Dirs} \
-Wl,--whole-archive -l$(Trts_Library_Name) ${Rats_Lib_Link_libs} -Wl,--no-whole-archive \
-Wl,--whole-archive -l$(Trts_Library_Name) ${Rats_Lib_Link_libs} $(Intel_Ipfs_Trusted_Flag) -Wl,--no-whole-archive \
-Wl,--start-group -lsgx_tstdc -lsgx_tcxx -lsgx_pthread -lsgx_tkey_exchange -l$(Crypto_Library_Name) -l$(Service_Library_Name) -lsgx_dcap_tvl -Wl,--end-group \
-Wl,-Bstatic -Wl,-Bsymbolic -Wl,--no-undefined \
-Wl,-pie,-eenclave_entry -Wl,--export-dynamic \
@ -217,7 +226,6 @@ $(App_Name): App/Enclave_u.o $(App_Cpp_Objects) libvmlib_untrusted.a
######## Enclave Objects ########
Enclave/Enclave_t.c: $(SGX_EDGER8R) Enclave/Enclave.edl librats
@cd Enclave && $(SGX_EDGER8R) --trusted ../Enclave/Enclave.edl $(Enclave_Edl_Search_Path)
@echo "GEN => $@"