From 206eb81eecd8cbb65e07e13ae34ce56101ed211a Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Mon, 27 Apr 2020 16:05:00 +0000 Subject: [PATCH] [Makefiles] Get arch and distro specific vars from Makefile.configs Extend Makefile.configs and define several variables for make to use derived from 'gcc -dumpmachine'. In particular: - ARCH as the architecture, e.g., x86_64 - ARCH_LONG as the long version of the architecture, e.g., x86_64-linux-gnu - ARCH_LIBDIR as the directory where libraries are located, e.g., /lib/x86_64-linux-gnu In Makefiles and manifest templates, replace the hard-coded x86_64-linux_gnu and /lib/x86_64-linux-gnu through these variables. Extend the already existing sed scripts to replace the necessary variables. --- Examples/apache/Makefile | 3 ++ Examples/apache/httpd.manifest.template | 18 +++---- Examples/bash/Makefile | 4 ++ Examples/bash/manifest.template | 22 ++++---- Examples/blender/Makefile | 3 ++ Examples/blender/blender.manifest.template | 38 +++++++------- Examples/busybox/Makefile | 3 ++ Examples/busybox/busybox.manifest.template | 18 +++---- Examples/capnproto/Makefile | 3 ++ .../capnproto/addressbook.manifest.template | 10 ++-- Examples/curl/Makefile | 3 ++ Examples/curl/curl.manifest.template | 14 ++--- Examples/gcc/Makefile | 5 +- Examples/gcc/as.manifest.template | 12 ++--- Examples/gcc/cc1.manifest.template | 6 +-- Examples/gcc/collect2.manifest.template | 6 +-- Examples/gcc/gcc.manifest.template | 6 +-- Examples/gcc/ld.manifest.template | 16 +++--- Examples/lighttpd/Makefile | 3 ++ Examples/lighttpd/lighttpd.manifest.template | 12 ++--- Examples/lmbench/Makefile | 3 ++ Examples/lmbench/manifest.template | 6 +-- Examples/memcached/Makefile | 3 ++ .../memcached/memcached.manifest.template | 28 +++++----- Examples/nginx/Makefile | 3 ++ Examples/nginx/nginx.manifest.template | 16 +++--- Examples/nodejs-express-server/Makefile | 5 +- .../nodejs.manifest.template | 10 ++-- Examples/nodejs/Makefile | 3 ++ Examples/nodejs/nodejs.manifest.template | 10 ++-- Examples/openvino/Makefile | 3 ++ Examples/openvino/openvino.manifest.template | 26 +++++----- Examples/python-scipy-insecure/Makefile | 3 ++ .../python.manifest.template | 16 +++--- Examples/python-simple/Makefile | 4 ++ .../python-simple/python.manifest.template | 16 +++--- Examples/pytorch/Makefile | 3 ++ Examples/pytorch/pytorch.manifest.template | 52 +++++++++---------- Examples/r/Makefile | 3 ++ Examples/r/R.manifest.template | 8 +-- Examples/redis/Makefile | 3 ++ Examples/redis/redis-server.manifest.template | 16 +++--- Examples/tensorflow/Makefile | 6 ++- LibOS/shim/test/fs/manifest.template | 12 ++--- LibOS/shim/test/ltp/Makefile | 4 +- LibOS/shim/test/ltp/Makefile.Test | 2 + LibOS/shim/test/ltp/manifest.template | 10 ++-- LibOS/shim/test/native/ls.manifest.template | 14 ++--- .../test/regression/echo.manifest.template | 10 ++-- LibOS/shim/test/regression/manifest.template | 14 ++--- .../test/regression/openmp.manifest.template | 4 +- .../shim/test/regression/sh.manifest.template | 10 ++-- Scripts/Makefile.Test | 2 + Scripts/Makefile.configs | 8 +++ 54 files changed, 308 insertions(+), 233 deletions(-) diff --git a/Examples/apache/Makefile b/Examples/apache/Makefile index 6bd1b5ac..f0170af8 100644 --- a/Examples/apache/Makefile +++ b/Examples/apache/Makefile @@ -42,6 +42,8 @@ ifeq ($(SGX),1) all: httpd.manifest.sgx httpd.sig httpd.token endif +include ../../Scripts/Makefile.configs + # The make targets for downloading and compiling the Apache source code, and # installing the binaries. @@ -117,6 +119,7 @@ httpd.manifest: httpd.manifest.template httpd-trusted-mods httpd-trusted-libs -e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \ -e 's|$$(HTTPD_TRUSTED_MODS)|'"`cat httpd-trusted-mods`"'|g' \ -e 's|$$(HTTPD_TRUSTED_LIBS)|'"`cat httpd-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generating the SGX-specific manifest (httpd.manifest.sgx), the enclave signature, diff --git a/Examples/apache/httpd.manifest.template b/Examples/apache/httpd.manifest.template index acb1ff4d..54a4b6f1 100644 --- a/Examples/apache/httpd.manifest.template +++ b/Examples/apache/httpd.manifest.template @@ -16,7 +16,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -26,10 +26,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by Apache +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Apache fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory (/usr) required by Apache (needed for libaprutil-1.so) fs.mount.usr.type = chroot @@ -76,11 +76,11 @@ sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # Other libraries required by Apache -sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 -sgx.trusted_files.nss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libgcc_s = file:$(ARCH_LIBDIR)/libgcc_s.so.1 +sgx.trusted_files.nss_files = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 # Apache modules and dependencies $(HTTPD_TRUSTED_MODS) diff --git a/Examples/bash/Makefile b/Examples/bash/Makefile index 6c4c5a0b..3e763ac8 100644 --- a/Examples/bash/Makefile +++ b/Examples/bash/Makefile @@ -26,6 +26,8 @@ ifeq ($(SGX),1) all: bash.token $(addsuffix .token,$(PROGRAMS)) endif +include ../../Scripts/Makefile.configs + # Program dependencies (generate from ldd): # # For SGX, the manifest needs to list all the libraries loaded during the @@ -69,6 +71,7 @@ bash.manifest: manifest.template trusted-children bash.trusted-libs -e 's|$$(EXECPATH)|'"$(shell which bash)"'|g' \ -e 's|$$(TRUSTED_LIBS)|'"`cat bash.trusted-libs`"'|g' \ -e 's|$$(TRUSTED_CHILDREN)|'"`cat trusted-children`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ $(addsuffix .manifest,$(PROGRAMS)): %.manifest: manifest.template %.trusted-libs @@ -78,6 +81,7 @@ $(addsuffix .manifest,$(PROGRAMS)): %.manifest: manifest.template %.trusted-libs -e 's|$$(EXECPATH)|'"$(shell which $(basename $@))"'|g' \ -e 's|$$(TRUSTED_LIBS)|'"`cat $(basename $@).trusted-libs`"'|g' \ -e 's|$$(TRUSTED_CHILDREN)||g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generating the SGX-specific manifest (*.manifest.sgx), the enclave signature, diff --git a/Examples/bash/manifest.template b/Examples/bash/manifest.template index 905d25fa..5e210d4e 100644 --- a/Examples/bash/manifest.template +++ b/Examples/bash/manifest.template @@ -14,7 +14,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR) # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -24,10 +24,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by Bash +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Bash fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Mount /bin fs.mount.bin.type = chroot @@ -61,15 +61,15 @@ sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # Name Service Switch (NSS) libraries (Glibc dependencies) -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # Additional libs opened by Bash at runtime -sgx.trusted_files.libselinux1 = file:/lib/x86_64-linux-gnu/libselinux.so.1 -sgx.trusted_files.libpcre = file:/lib/x86_64-linux-gnu/libpcre.so.3 -sgx.trusted_files.libacl = file:/lib/x86_64-linux-gnu/libacl.so.1 -sgx.trusted_files.libattr = file:/lib/x86_64-linux-gnu/libattr.so.1 +sgx.trusted_files.libselinux1 = file:$(ARCH_LIBDIR)/libselinux.so.1 +sgx.trusted_files.libpcre = file:$(ARCH_LIBDIR)/libpcre.so.3 +sgx.trusted_files.libacl = file:$(ARCH_LIBDIR)/libacl.so.1 +sgx.trusted_files.libattr = file:$(ARCH_LIBDIR)/libattr.so.1 # Other required libraries $(TRUSTED_LIBS) diff --git a/Examples/blender/Makefile b/Examples/blender/Makefile index dc143bcc..0659fb78 100644 --- a/Examples/blender/Makefile +++ b/Examples/blender/Makefile @@ -32,6 +32,8 @@ ifeq ($(SGX),1) all: $(RUN_DIR)/blender.manifest.sgx endif +include ../../Scripts/Makefile.configs + $(BLENDER_DIR)/blender: $(GRAPHENE_DIR)/Scripts/download --output blender.tar.xz \ --sha256 $(BLENDER_SHA256) --url $(BLENDER_URL) @@ -48,6 +50,7 @@ $(RUN_DIR)/blender.manifest: blender.manifest.template $(RUN_DIR) -e 's|$$(BLENDER_DIR)|'"$(BLENDER_DIR)"'|g' \ -e 's|$$(BLENDER_VER)|'"$(BLENDER_VER)"'|g' \ -e 's|# \['"$(UBUNTU_VER)"'\] ||g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ $(RUN_DIR)/blender.manifest.sgx: $(BLENDER_DIR)/blender $(RUN_DIR)/blender.manifest $(GRAPHENE_DIR)/Runtime/libpal-Linux-SGX.so $(RUN_DIR) diff --git a/Examples/blender/blender.manifest.template b/Examples/blender/blender.manifest.template index 09bfb732..501351d3 100644 --- a/Examples/blender/blender.manifest.template +++ b/Examples/blender/blender.manifest.template @@ -17,7 +17,7 @@ loader.execname = blender loader.preload = file:$(GRAPHENE_DIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENE_DEBUG) -loader.env.LD_LIBRARY_PATH = /graphene_lib:/blender_lib:/usr/lib/x86_64-linux-gnu:/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /graphene_lib:/blender_lib:/usr/$(ARCH_LIBDIR):$(ARCH_LIBDIR) # Graphene implicitly copies host environment variables - overwriting troublesome one loader.env.PWD = @@ -30,12 +30,12 @@ fs.mount.blender_lib.path = /blender_lib fs.mount.blender_lib.uri = file:$(BLENDER_DIR)/lib fs.mount.usr_lib.type = chroot -fs.mount.usr_lib.path = /usr/lib/x86_64-linux-gnu -fs.mount.usr_lib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.usr_lib.path = /usr/$(ARCH_LIBDIR) +fs.mount.usr_lib.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.lib.type = chroot -fs.mount.lib.path = /lib/x86_64-linux-gnu -fs.mount.lib.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib.path = $(ARCH_LIBDIR) +fs.mount.lib.uri = file:$(ARCH_LIBDIR) fs.mount.scenes.type = chroot fs.mount.scenes.path = /data @@ -64,19 +64,19 @@ sgx.trusted_files.librt = file:$(GRAPHENE_DIR)/Runtime/librt.so.1 sgx.trusted_files.libGL = file:$(BLENDER_DIR)/lib/libGL.so.1 sgx.trusted_files.libglapi = file:$(BLENDER_DIR)/lib/libglapi.so.0 -sgx.trusted_files.libX11 = file:/usr/lib/x86_64-linux-gnu/libX11.so.6 -sgx.trusted_files.libXi = file:/usr/lib/x86_64-linux-gnu/libXi.so.6 -sgx.trusted_files.libXxf86vm = file:/usr/lib/x86_64-linux-gnu/libXxf86vm.so.1 -sgx.trusted_files.libXfixes = file:/usr/lib/x86_64-linux-gnu/libXfixes.so.3 -sgx.trusted_files.libXrender = file:/usr/lib/x86_64-linux-gnu/libXrender.so.1 -sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.libXext = file:/usr/lib/x86_64-linux-gnu/libXext.so.6 -sgx.trusted_files.libxcb = file:/usr/lib/x86_64-linux-gnu/libxcb.so.1 -sgx.trusted_files.libXau = file:/usr/lib/x86_64-linux-gnu/libXau.so.6 -sgx.trusted_files.libXdmcp = file:/usr/lib/x86_64-linux-gnu/libXdmcp.so.6 -sgx.trusted_files.libstdcpp = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6 -sgx.trusted_files.libnuma = file:/usr/lib/x86_64-linux-gnu/libnuma.so.1 +sgx.trusted_files.libX11 = file:/usr/$(ARCH_LIBDIR)/libX11.so.6 +sgx.trusted_files.libXi = file:/usr/$(ARCH_LIBDIR)/libXi.so.6 +sgx.trusted_files.libXxf86vm = file:/usr/$(ARCH_LIBDIR)/libXxf86vm.so.1 +sgx.trusted_files.libXfixes = file:/usr/$(ARCH_LIBDIR)/libXfixes.so.3 +sgx.trusted_files.libXrender = file:/usr/$(ARCH_LIBDIR)/libXrender.so.1 +sgx.trusted_files.libgcc_s = file:$(ARCH_LIBDIR)/libgcc_s.so.1 +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.libXext = file:/usr/$(ARCH_LIBDIR)/libXext.so.6 +sgx.trusted_files.libxcb = file:/usr/$(ARCH_LIBDIR)/libxcb.so.1 +sgx.trusted_files.libXau = file:/usr/$(ARCH_LIBDIR)/libXau.so.6 +sgx.trusted_files.libXdmcp = file:/usr/$(ARCH_LIBDIR)/libXdmcp.so.6 +sgx.trusted_files.libstdcpp = file:/usr/$(ARCH_LIBDIR)/libstdc++.so.6 +sgx.trusted_files.libnuma = file:/usr/$(ARCH_LIBDIR)/libnuma.so.1 # Ubuntu version specific files -# [Ubuntu18.04] sgx.trusted_files.libbsd = file:/lib/x86_64-linux-gnu/libbsd.so.0 +# [Ubuntu18.04] sgx.trusted_files.libbsd = file:$(ARCH_LIBDIR)/libbsd.so.0 diff --git a/Examples/busybox/Makefile b/Examples/busybox/Makefile index 79de515c..a4204ce1 100644 --- a/Examples/busybox/Makefile +++ b/Examples/busybox/Makefile @@ -32,6 +32,8 @@ ifeq ($(SGX),1) all: busybox.manifest.sgx endif +include ../../Scripts/Makefile.configs + ############################ BUSYBOX EXECUTABLE ############################### # Busybox is built as usual, without any changes to the build process. The @@ -66,6 +68,7 @@ $(SRCDIR)/busybox: $(SRCDIR)/.config busybox.manifest: busybox.manifest.template sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \ -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This diff --git a/Examples/busybox/busybox.manifest.template b/Examples/busybox/busybox.manifest.template index 5ca686ec..37988633 100644 --- a/Examples/busybox/busybox.manifest.template +++ b/Examples/busybox/busybox.manifest.template @@ -33,8 +33,8 @@ loader.debug_type = $(GRAPHENEDEBUG) # In case of Busybox: # - /lib is searched for Glibc libraries (ld, libc, libresolv) provided by # graphene, -# - /lib/x86_64-linux-gnu is searched for libcrypt, NSS libraries. -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu +# - $(ARCH_LIBDIR) is searched for libcrypt, NSS libraries. +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR) # Explicitly set some environment variables used by Busybox. loader.env.PATH = /:/usr/sbin:/usr/bin:/sbin:/bin @@ -61,8 +61,8 @@ fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime # Mount host-OS directory contanining libcrypt and NSS libraries. fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Mount host-OS directory to NSS files required by Glibc + NSS libraries. fs.mount.etc.type = chroot @@ -95,19 +95,19 @@ sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6 # libcrypt is an explicit dependency of Busybox. We choose to install it on # host OS instead of downloading the sources, building, and linking Busybox # against the built library (which is possible but would require more effort). -sgx.trusted_files.libcrypt = file:/lib/x86_64-linux-gnu/libcrypt.so.1 +sgx.trusted_files.libcrypt = file:$(ARCH_LIBDIR)/libcrypt.so.1 # Name Service Switch (NSS) libraries. Glibc calls these libraries as part of # name-service information gathering. libnss_{compat,files,nis} are the # most widely used libraries, at least on Ubuntu. # For more info, see 'man nsswitch.conf'. -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # libNSL is a dependency of libnss_compat above. It is a good example of nested # library dependencies required by Graphene-SGX. -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 ############################ SGX: TRUSTED FILES ############################### diff --git a/Examples/capnproto/Makefile b/Examples/capnproto/Makefile index 9281f45a..43530aeb 100644 --- a/Examples/capnproto/Makefile +++ b/Examples/capnproto/Makefile @@ -36,6 +36,8 @@ ifeq ($(SGX),1) all: addressbook.token endif +include ../../Scripts/Makefile.configs + $(SRCDIR)/addressbook.c++: mkdir -p $(SRCDIR) $(GRAPHENEDIR)/Scripts/download --output $(SRCDIR)/addressbook.c++ \ @@ -78,6 +80,7 @@ addressbook.manifest: addressbook.manifest.template addressbook-trusted-libs sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \ -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ -e 's|$$(TRUSTEDLIBS)|'"`cat addressbook-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ addressbook.manifest.sgx: addressbook.manifest $(SRCDIR)/addressbook diff --git a/Examples/capnproto/addressbook.manifest.template b/Examples/capnproto/addressbook.manifest.template index 7c732561..c4c138c2 100644 --- a/Examples/capnproto/addressbook.manifest.template +++ b/Examples/capnproto/addressbook.manifest.template @@ -17,7 +17,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Specify paths to search for libraries (usual LD_LIBRARY_PATH syntax) -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Mount host-OS directory to Graphene glibc/runtime libraries fs.mount.lib.type = chroot @@ -26,13 +26,13 @@ fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime # Mount host-OS directory to Name Service Switch (NSS) libraries fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Mount host-OS directory to libcapnp lib required by Addressbook fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr/$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) # Mount host-OS directory to NSS files required by Glibc + NSS libs fs.mount.etc.type = chroot diff --git a/Examples/curl/Makefile b/Examples/curl/Makefile index e254ff53..c5e5e231 100644 --- a/Examples/curl/Makefile +++ b/Examples/curl/Makefile @@ -26,6 +26,8 @@ ifeq ($(SGX),1) all: curl.token endif +include ../../Scripts/Makefile.configs + # curl dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries # loaded during execution, so that the signer can include the file hashes. @@ -55,6 +57,7 @@ curl.manifest: curl.manifest.template curl-trusted-libs -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ -e 's|$$(CURL_DIR)|'"$(CURL_DIR)"'|g' \ -e 's|$$(CURL_TRUSTED_LIBS)|'"`cat curl-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generate SGX-specific manifest, enclave signature, and token for enclave initialization diff --git a/Examples/curl/curl.manifest.template b/Examples/curl/curl.manifest.template index 63234826..e16551e0 100644 --- a/Examples/curl/curl.manifest.template +++ b/Examples/curl/curl.manifest.template @@ -16,7 +16,7 @@ loader.debug_type = $(GRAPHENEDEBUG) # Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax # applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e., # paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri). -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Mount host-OS directory to required libraries (in 'uri') into in-Graphene # visible directory /lib (in 'path'). @@ -25,12 +25,12 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.etc.type = chroot fs.mount.etc.path = /etc @@ -60,8 +60,8 @@ sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 sgx.trusted_files.libresolv = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2 sgx.trusted_files.libnssdns = file:$(GRAPHENEDIR)/Runtime/libnss_dns.so.2 -sgx.trusted_files.libnss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnss_mdns4_minimal = file:/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2 +sgx.trusted_files.libnss_files = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnss_mdns4_minimal = file:$(ARCH_LIBDIR)/libnss_mdns4_minimal.so.2 $(CURL_TRUSTED_LIBS) # Name Service Switch (NSS) files. Glibc reads these files as part of name- diff --git a/Examples/gcc/Makefile b/Examples/gcc/Makefile index 11466f48..fc95bbbb 100644 --- a/Examples/gcc/Makefile +++ b/Examples/gcc/Makefile @@ -9,13 +9,15 @@ else GRAPHENEDEBUG = none endif +include ../../Scripts/Makefile.configs + # All the tools/executables required for this example (alphabetic order). TOOLS = as cc1 collect2 gcc ld # awk '{print $NF}' ... print last field. BINUTILS_VERSION ?= $(shell ld -v | awk '{print $$NF}') GCC_MAJOR_VERSION ?= $(shell gcc -v 2>&1 | tail -n1 | awk '{print $$3}' | awk 'BEGIN {FS="."}{print $$1}') -GCC_LIB_PATH ?= /usr/lib/gcc/x86_64-linux-gnu +GCC_LIB_PATH ?= /usr/lib/gcc/$(ARCH_LONG) .PHONY: all ifeq ($(SGX),1) @@ -32,6 +34,7 @@ endif -e 's|$$(GCC_LIB_PATH)|'"$(GCC_LIB_PATH)"'|g' \ -e 's|$$(CC1_TRUSTED_LIBS)|'"`cat cc1-trusted-libs`"'|g' \ -e 's|$$(LD_TRUSTED_FILES)|'"`cat ld-gcc-$(GCC_MAJOR_VERSION)-trusted-files`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Prevent .manifest/.manifest.sgx from automatically being deleted by make diff --git a/Examples/gcc/as.manifest.template b/Examples/gcc/as.manifest.template index 902c179b..3081da56 100644 --- a/Examples/gcc/as.manifest.template +++ b/Examples/gcc/as.manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.exec = file:/usr/bin/as loader.execname = /usr/bin/as -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = /bin:/usr/bin loader.debug_type = $(GRAPHENEDEBUG) @@ -10,8 +10,8 @@ fs.mount.lib1.path = /lib fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr @@ -29,9 +29,9 @@ sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6 sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2 sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.libopcodes = file:/usr/lib/x86_64-linux-gnu/libopcodes-$(BINUTILS_VERSION)-system.so -sgx.trusted_files.libbfd = file:/usr/lib/x86_64-linux-gnu/libbfd-$(BINUTILS_VERSION)-system.so +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.libopcodes = file:/usr/$(ARCH_LIBDIR)/libopcodes-$(BINUTILS_VERSION)-system.so +sgx.trusted_files.libbfd = file:/usr/$(ARCH_LIBDIR)/libbfd-$(BINUTILS_VERSION)-system.so sgx.allowed_files.tmp = file:/tmp sgx.allowed_files.test_files = file:test_files diff --git a/Examples/gcc/cc1.manifest.template b/Examples/gcc/cc1.manifest.template index 45fe4a80..6703fc22 100644 --- a/Examples/gcc/cc1.manifest.template +++ b/Examples/gcc/cc1.manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.exec = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/cc1 loader.execname = cc1 -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = /bin:/usr/bin loader.debug_type = $(GRAPHENEDEBUG) @@ -10,8 +10,8 @@ fs.mount.lib1.path = /lib fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr diff --git a/Examples/gcc/collect2.manifest.template b/Examples/gcc/collect2.manifest.template index 56d2e249..73169091 100644 --- a/Examples/gcc/collect2.manifest.template +++ b/Examples/gcc/collect2.manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.exec = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/collect2 loader.execname = collect2 -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = /bin:/usr/bin loader.debug_type = $(GRAPHENEDEBUG) @@ -10,8 +10,8 @@ fs.mount.lib1.path = /lib fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr diff --git a/Examples/gcc/gcc.manifest.template b/Examples/gcc/gcc.manifest.template index 37d6a8f3..2bee976c 100644 --- a/Examples/gcc/gcc.manifest.template +++ b/Examples/gcc/gcc.manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.exec = file:/usr/bin/gcc loader.execname = /usr/bin/gcc -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = /bin:/usr/bin loader.debug_type = $(GRAPHENEDEBUG) @@ -10,8 +10,8 @@ fs.mount.lib1.path = /lib fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr diff --git a/Examples/gcc/ld.manifest.template b/Examples/gcc/ld.manifest.template index dccff2dc..cb408fdc 100644 --- a/Examples/gcc/ld.manifest.template +++ b/Examples/gcc/ld.manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.exec = file:/usr/bin/ld loader.execname = /usr/bin/ld -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = /bin:/usr/bin loader.debug_type = $(GRAPHENEDEBUG) @@ -10,8 +10,8 @@ fs.mount.lib1.path = /lib fs.mount.lib1.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr @@ -29,8 +29,8 @@ sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6 sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2 sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.libbfd = file:/usr/lib/x86_64-linux-gnu/libbfd-$(BINUTILS_VERSION)-system.so +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.libbfd = file:/usr/$(ARCH_LIBDIR)/libbfd-$(BINUTILS_VERSION)-system.so sgx.trusted_files.liblto = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/liblto_plugin.so sgx.trusted_files.libgcc = file:$(GCC_LIB_PATH)/$(GCC_MAJOR_VERSION)/libgcc_s.so @@ -44,6 +44,6 @@ sgx.allowed_files.tmp = file:/tmp sgx.allowed_files.test_files = file:test_files sgx.allowed_files.aout = file:a.out -sgx.allowed_files.hostdebug = file:/usr/lib/debug/usr/lib/x86_64-linux-gnu -sgx.allowed_files.hostusrlib = file:/usr/lib/x86_64-linux-gnu -sgx.allowed_files.hostlib = file:/lib/x86_64-linux-gnu +sgx.allowed_files.hostdebug = file:/usr/lib/debug/usr/$(ARCH_LIBDIR) +sgx.allowed_files.hostusrlib = file:/usr/$(ARCH_LIBDIR) +sgx.allowed_files.hostlib = file:$(ARCH_LIBDIR) diff --git a/Examples/lighttpd/Makefile b/Examples/lighttpd/Makefile index 901ad1f5..7366524c 100644 --- a/Examples/lighttpd/Makefile +++ b/Examples/lighttpd/Makefile @@ -34,6 +34,8 @@ ifeq ($(SGX),1) all: lighttpd.token endif +include ../../Scripts/Makefile.configs + # The commands for downloading and compiling the lighttpd source code, and # installing the binaries. $(INSTALL_DIR)/sbin/lighttpd: $(LIGHTTPD_SRC)/configure @@ -95,6 +97,7 @@ lighttpd.manifest: lighttpd.manifest.template lighttpd-trusted-libs lighttpd-tru -e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \ -e 's|$$(LIGHTTPD_TRUSTED_MODS)|'"`cat lighttpd-trusted-mods`"'|g' \ -e 's|$$(LIGHTTPD_TRUSTED_LIBS)|'"`cat lighttpd-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generate the SGX-specific manifest (lighttpd.manifest.sgx), the enclave signature, and the token diff --git a/Examples/lighttpd/lighttpd.manifest.template b/Examples/lighttpd/lighttpd.manifest.template index 1cc64592..924cdfba 100644 --- a/Examples/lighttpd/lighttpd.manifest.template +++ b/Examples/lighttpd/lighttpd.manifest.template @@ -16,7 +16,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables for lighttpd -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:$(INSTALL_DIR)/lib +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):$(INSTALL_DIR)/lib # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -26,10 +26,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by the lighttpd executable +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by the lighttpd executable fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory (/usr) required by the lighttpd executable fs.mount.usr.type = chroot @@ -71,8 +71,8 @@ sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2 sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1 sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.nss_files = file:/lib/x86_64-linux-gnu/libnss_files.so.2 +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.nss_files = file:$(ARCH_LIBDIR)/libnss_files.so.2 # lighttpd modules and dependencies $(LIGHTTPD_TRUSTED_MODS) diff --git a/Examples/lmbench/Makefile b/Examples/lmbench/Makefile index aa2d25fa..48b22290 100644 --- a/Examples/lmbench/Makefile +++ b/Examples/lmbench/Makefile @@ -40,6 +40,8 @@ ifeq ($(SGX),1) all: sgx endif +include ../../Scripts/Makefile.configs + # Building LMBench binaries $(INSTALLDIR)/lmbench: $(LMBENCHDIR)/src/Makefile @@ -62,6 +64,7 @@ $(INSTALLDIR)/lmbench-test-ci.sh: $(MANIFESTS): $(INSTALLDIR)/%: %.template $(INSTALLDIR)/lmbench sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR_FROM_INSTALLDIR)"'|g' \ -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ + -e 's|$$(ARCH_LONG)|'"$(ARCH_LONG)"'|g' \ $< > $@ # Generating the manifests for SGX diff --git a/Examples/lmbench/manifest.template b/Examples/lmbench/manifest.template index 7c72574f..8f539ee1 100644 --- a/Examples/lmbench/manifest.template +++ b/Examples/lmbench/manifest.template @@ -41,8 +41,8 @@ fs.mount.var_tmp.uri = file:/var/tmp # Mount /usr/include/x84_64-linux-gnu/ (used by LMBench for file tests) fs.mount.inc.type = chroot -fs.mount.inc.path = /usr/include/x86_64-linux-gnu/ -fs.mount.inc.uri = file:/usr/include/x86_64-linux-gnu/ +fs.mount.inc.path = /usr/include/$(ARCH_LONG) +fs.mount.inc.uri = file:/usr/include/$(ARCH_LONG) # Network related rules. These rules are used only for sandboxing, which is # currently an EXPERIMENTAL feature. @@ -77,7 +77,7 @@ sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # SGX untrusted (allowed) files/directories sgx.allowed_files.tmp = file:/tmp sgx.allowed_files.var_tmp = file:/var/tmp -sgx.allowed_files.inc = file:/usr/include/x86_64-linux-gnu +sgx.allowed_files.inc = file:/usr/include/$(ARCH_LONG) # Trusted signature for creating child enclaves (by execve()) sgx.trusted_children.hello = file:hello.sig diff --git a/Examples/memcached/Makefile b/Examples/memcached/Makefile index 44e80fce..9487096a 100644 --- a/Examples/memcached/Makefile +++ b/Examples/memcached/Makefile @@ -31,6 +31,8 @@ ifeq ($(SGX),1) all: memcached.manifest.sgx endif +include ../../Scripts/Makefile.configs + ############################ MEMCACHED EXECUTABLE ############################# # Memcached is built as usual, without any changes to the build process. The @@ -57,6 +59,7 @@ $(SRCDIR)/memcached: $(SRCDIR)/configure memcached.manifest: memcached.manifest.template sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \ -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This diff --git a/Examples/memcached/memcached.manifest.template b/Examples/memcached/memcached.manifest.template index 4b5bab45..94fd8ec9 100644 --- a/Examples/memcached/memcached.manifest.template +++ b/Examples/memcached/memcached.manifest.template @@ -42,10 +42,10 @@ loader.debug_type = $(GRAPHENEDEBUG) # # In case of Memcached: # - /lib is searched for Glibc libraries (ld, libc, libpthread) -# - /lib/x86_64-linux-gnu is searched for Name Service Switch (NSS) libraries -# - /usr/lib/x86_64-linux-gnu is searched for libevent (the only explicit +# - $(ARCH_LIBDIR) is searched for Name Service Switch (NSS) libraries +# - /usr/$(ARCH_LIBDIR) is searched for libevent (the only explicit # Memcached dependency) -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Explicitly unset all environment variables used by Memcached. This is just a # precaution so that attacker cannot influence the default behavior of Memcached @@ -80,16 +80,16 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime # Mount host-OS directory to Name Service Switch (NSS) libraries (in 'uri') -# into in-Graphene visible directory /lib/x86_64-linux-gnu (in 'path'). +# into in-Graphene visible directory e.g., /lib/x86_64-linux-gnu (in 'path'). fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Mount host-OS directory to libevent lib required by Memcached (in 'uri') -# into in-Graphene visible directory /usr/lib/x86_64-linux-gnu (in 'path'). +# into in-Graphene visible directory e.g., /usr/lib/x86_64-linux-gnu (in 'path'). fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr/$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) # Mount host-OS directory to NSS files required by Glibc + NSS libs (in 'uri') # into in-Graphene visible directory /etc (in 'path'). @@ -156,18 +156,18 @@ sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # name-service information gathering. libnss_{compat,files,nis} are the # most widely used libraries, at least on Ubuntu. # For more info, see 'man nsswitch.conf'. -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # libNSL is a dependency of libnss_compat above. It is a good example of nested # library dependencies required by Graphene-SGX. -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 # libEvent is an explicit dependency of Memcached. We choose to install it on # host OS instead of downloading the sources, building, and linking Memcached # against the built library (which is possible but would require more effort). -sgx.trusted_files.libevent = file:/usr/lib/x86_64-linux-gnu/libevent-2.0.so.5 +sgx.trusted_files.libevent = file:/usr/$(ARCH_LIBDIR)/libevent-2.0.so.5 ############################ SGX: TRUSTED FILES ############################### diff --git a/Examples/nginx/Makefile b/Examples/nginx/Makefile index 88157191..4abb51d2 100644 --- a/Examples/nginx/Makefile +++ b/Examples/nginx/Makefile @@ -39,6 +39,8 @@ ifeq ($(SGX),1) all: nginx.manifest.sgx nginx.sig nginx.token endif +include ../../Scripts/Makefile.configs + # The make targets for downloading and compiling the Nginx source code, and # installing the binaries. # Note that Graphene doesn't support eventfd() and PR_SET_DUMPABLE, so we manually @@ -97,6 +99,7 @@ nginx.manifest: nginx.manifest.template nginx-trusted-libs -e 's|$$(INSTALL_DIR)|'"$(INSTALL_DIR)"'|g' \ -e 's|$$(INSTALL_DIR_ABSPATH)|'"$(abspath $(INSTALL_DIR))"'|g' \ -e 's|$$(NGINX_TRUSTED_LIBS)|'"`cat nginx-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generating the SGX-specific manifest (nginx.manifest.sgx), the enclave signature, diff --git a/Examples/nginx/nginx.manifest.template b/Examples/nginx/nginx.manifest.template index 13be68e5..743e418f 100644 --- a/Examples/nginx/nginx.manifest.template +++ b/Examples/nginx/nginx.manifest.template @@ -16,7 +16,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR) # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -26,10 +26,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by Nginx. +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Nginx. fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory to NSS files required by Glibc + NSS libs. fs.mount.etc.type = chroot @@ -70,12 +70,12 @@ sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # Name Service Switch (NSS) libraries (Glibc dependencies) -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # libNSL is a dependency of libnss_compat above -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 # Nginx dependencies (shared libraries) $(NGINX_TRUSTED_LIBS) diff --git a/Examples/nodejs-express-server/Makefile b/Examples/nodejs-express-server/Makefile index c94368ba..6b83890a 100644 --- a/Examples/nodejs-express-server/Makefile +++ b/Examples/nodejs-express-server/Makefile @@ -26,6 +26,8 @@ ifeq ($(SGX),1) all: nodejs.token endif +include ../../Scripts/Makefile.configs + # Node.js dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries # loaded during execution, so that the signer can include the file hashes. @@ -55,6 +57,7 @@ nodejs.manifest: nodejs.manifest.template nodejs-trusted-libs -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ -e 's|$$(NODEJS_DIR)|'"$(NODEJS_DIR)"'|g' \ -e 's|$$(NODEJS_TRUSTED_LIBS)|'"`cat nodejs-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generate SGX-specific manifest, enclave signature, and token for enclave initialization @@ -77,7 +80,7 @@ pal_loader: .PHONY: check check: all ./pal_loader nodejs.manifest helloworld.js 3000 & SERVER_ID=$$!; \ - sleep 30; \ + sleep 3; \ curl localhost:3000 > OUTPUT; \ kill -9 $$SERVER_ID; @grep -q "Hello World!" OUTPUT && echo "[ Success 1/1 ]" diff --git a/Examples/nodejs-express-server/nodejs.manifest.template b/Examples/nodejs-express-server/nodejs.manifest.template index a3ed89be..eecb799e 100644 --- a/Examples/nodejs-express-server/nodejs.manifest.template +++ b/Examples/nodejs-express-server/nodejs.manifest.template @@ -16,7 +16,7 @@ loader.debug_type = $(GRAPHENEDEBUG) # Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax # applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e., # paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri). -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Mount host-OS directory to required libraries (in 'uri') into in-Graphene # visible directory /lib (in 'path'). @@ -25,12 +25,12 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr/$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) # Set enclave size to 2GB. Recall that SGX v1 requires to specify enclave size at # enclave creation time. diff --git a/Examples/nodejs/Makefile b/Examples/nodejs/Makefile index 9f50d514..8df11c35 100644 --- a/Examples/nodejs/Makefile +++ b/Examples/nodejs/Makefile @@ -26,6 +26,8 @@ ifeq ($(SGX),1) all: nodejs.token endif +include ../../Scripts/Makefile.configs + # Node.js dependencies (generated from ldd). For SGX, the manifest needs to list all the libraries # loaded during execution, so that the signer can include the file hashes. @@ -55,6 +57,7 @@ nodejs.manifest: nodejs.manifest.template nodejs-trusted-libs -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ -e 's|$$(NODEJS_DIR)|'"$(NODEJS_DIR)"'|g' \ -e 's|$$(NODEJS_TRUSTED_LIBS)|'"`cat nodejs-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generate SGX-specific manifest, enclave signature, and token for enclave initialization diff --git a/Examples/nodejs/nodejs.manifest.template b/Examples/nodejs/nodejs.manifest.template index 92f9fcb9..c05947f7 100644 --- a/Examples/nodejs/nodejs.manifest.template +++ b/Examples/nodejs/nodejs.manifest.template @@ -16,7 +16,7 @@ loader.debug_type = $(GRAPHENEDEBUG) # Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax # applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e., # paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri). -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Mount host-OS directory to required libraries (in 'uri') into in-Graphene # visible directory /lib (in 'path'). @@ -25,12 +25,12 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr/$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) # Set enclave size to 2GB; NodeJS expects around 1.7GB of heap on startup, # see e.g. https://github.com/nodejs/node/issues/13018. diff --git a/Examples/openvino/Makefile b/Examples/openvino/Makefile index 52c0590a..57531e94 100644 --- a/Examples/openvino/Makefile +++ b/Examples/openvino/Makefile @@ -38,6 +38,8 @@ ifeq ($(SGX),1) all: openvino.manifest.sgx openvino.sig openvino.token endif +include ../../Scripts/Makefile.configs + $(MODEL_DIR)/README.md: git clone https://github.com/opencv/open_model_zoo.git $(MODEL_DIR) cd $(MODEL_DIR) && git checkout $(MODEL_COMMIT) @@ -69,6 +71,7 @@ openvino.manifest: openvino.manifest.template -e 's|$$(MODEL_DIR)|'"$(MODEL_DIR)"'|g' \ -e 's|$$(OPENVINO_BUILD)|'"$(OPENVINO_BUILD)"'|g' \ -e 's|$$(LIBTBB_DEBUG)|'$(LIBTBB_DEBUG)'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Generating the SGX-specific manifest (openvino.manifest.sgx), the enclave signature, diff --git a/Examples/openvino/openvino.manifest.template b/Examples/openvino/openvino.manifest.template index 13b909a5..903b7c2d 100644 --- a/Examples/openvino/openvino.manifest.template +++ b/Examples/openvino/openvino.manifest.template @@ -16,7 +16,7 @@ loader.preload = file:$(GRAPHENE_DIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENE_DEBUG) # Environment variables -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -26,15 +26,15 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENE_DIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by OpenVINO. +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by OpenVINO. fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) -# More host-level libraries (/usr/lib/x86_64-linux-gnu) required by OpenVINO. +# More host-level libraries (e.g., /usr/lib/x86_64-linux-gnu) required by OpenVINO. fs.mount.lib3.type = chroot -fs.mount.lib3.path = /usr/lib/x86_64-linux-gnu -fs.mount.lib3.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.lib3.path = /usr/$(ARCH_LIBDIR) +fs.mount.lib3.uri = file:/usr/$(ARCH_LIBDIR) # Host-level directory to NSS files required by Glibc + NSS libs. fs.mount.etc.type = chroot @@ -78,16 +78,16 @@ sgx.trusted_files.libutil = file:$(GRAPHENE_DIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENE_DIR)/Runtime/libpthread.so.0 # Name Service Switch (NSS) libraries (Glibc dependencies) -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # libNSL is a dependency of libnss_compat above -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 # OpenVINO C++ dependencies -sgx.trusted_files.libcpp = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6 -sgx.trusted_files.libgcc = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 +sgx.trusted_files.libcpp = file:/usr/$(ARCH_LIBDIR)/libstdc++.so.6 +sgx.trusted_files.libgcc = file:$(ARCH_LIBDIR)/libgcc_s.so.1 # OpenVINO main libraries sgx.trusted_files.libformatreader = file:$(OPENVINO_DIR)/inference-engine/bin/intel64/$(OPENVINO_BUILD)/lib/libformat_reader.so diff --git a/Examples/python-scipy-insecure/Makefile b/Examples/python-scipy-insecure/Makefile index 16a473de..1c070f97 100644 --- a/Examples/python-scipy-insecure/Makefile +++ b/Examples/python-scipy-insecure/Makefile @@ -7,6 +7,8 @@ # # Use `make clean` to remove Graphene-generated files. +include ../../Scripts/Makefile.configs + # Constants # By default, Graphene runs the system Python 3.5 executable. @@ -88,6 +90,7 @@ python.manifest: python.manifest.template python-trusted-libs -e 's|$$(PYTHONHOME)|'"$(PYTHONHOME)"'|g' \ -e 's|$$(PYTHONEXEC)|'"$(PYTHONEXEC)"'|g' \ -e 's|$$(PYTHON_TRUSTED_LIBS)|'"`cat python-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Python manifests for SGX: diff --git a/Examples/python-scipy-insecure/python.manifest.template b/Examples/python-scipy-insecure/python.manifest.template index d93e4f66..440f8954 100644 --- a/Examples/python-scipy-insecure/python.manifest.template +++ b/Examples/python-scipy-insecure/python.manifest.template @@ -17,7 +17,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables for Python -loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = $(PYTHONHOME)/bin:/usr/bin:/bin loader.env.PYTHONHOME = $(PYTHONHOME) loader.env.PYTHONPATH = $(PYTHONHOME):$(PYTHONHOME)/plat-x86_64-linux-gnu:$(PYTHONDISTHOME):$(PYTHONHOME)/lib-dynload @@ -30,10 +30,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by the Python executable +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by the Python executable fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory (/usr) required by the Python executable fs.mount.usr.type = chroot @@ -93,10 +93,10 @@ sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # Other libraries -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.libbz2 = file:/lib/x86_64-linux-gnu/libbz2.so.1.0 -sgx.trusted_files.liblzma = file:/lib/x86_64-linux-gnu/liblzma.so.5 -sgx.trusted_files.libexpat = file:/lib/x86_64-linux-gnu/libexpat.so.1 +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.libbz2 = file:$(ARCH_LIBDIR)/libbz2.so.1.0 +sgx.trusted_files.liblzma = file:$(ARCH_LIBDIR)/liblzma.so.5 +sgx.trusted_files.libexpat = file:$(ARCH_LIBDIR)/libexpat.so.1 $(PYTHON_TRUSTED_LIBS) # SGX untrusted (allowed) files/directories diff --git a/Examples/python-simple/Makefile b/Examples/python-simple/Makefile index 1f09dcdb..9a26a97a 100644 --- a/Examples/python-simple/Makefile +++ b/Examples/python-simple/Makefile @@ -7,6 +7,8 @@ # # Use `make clean` to remove Graphene-generated files. +include ../../Scripts/Makefile.configs + # Constants # By default, Graphene runs the system Python 3.5 executable. @@ -102,6 +104,8 @@ python.manifest: python.manifest.template python-trusted-libs python-trusted-scr -e 's|$$(PYTHONEXEC)|'"$(PYTHONEXEC)"'|g' \ -e 's|$$(PYTHON_TRUSTED_SCRIPTS)|'"`cat python-trusted-scripts`"'|g' \ -e 's|$$(PYTHON_TRUSTED_LIBS)|'"`cat python-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ + -e 's|$$(ARCH_LONG)|'"$(ARCH_LONG)"'|g' \ $< > $@ # Python manifests for SGX: diff --git a/Examples/python-simple/python.manifest.template b/Examples/python-simple/python.manifest.template index 811dbc5b..ba81139a 100644 --- a/Examples/python-simple/python.manifest.template +++ b/Examples/python-simple/python.manifest.template @@ -18,10 +18,10 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables for Python -loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = $(PYTHONHOME)/lib:/lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = $(PYTHONHOME)/bin:/usr/bin:/bin loader.env.PYTHONHOME = $(PYTHONHOME) -loader.env.PYTHONPATH = $(PYTHONHOME):$(PYTHONHOME)/plat-x86_64-linux-gnu:$(PYTHONDISTHOME):$(PYTHONHOME)/lib-dynload +loader.env.PYTHONPATH = $(PYTHONHOME):$(PYTHONHOME)/plat-$(ARCH_LONG):$(PYTHONDISTHOME):$(PYTHONHOME)/lib-dynload # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the # guest. Other parts of the host FS will not be available in the guest. @@ -31,10 +31,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by the Python executable +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by the Python executable fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory (/usr) required by the Python executable fs.mount.usr.type = chroot @@ -90,9 +90,9 @@ sgx.trusted_files.libnssdns = file:$(GRAPHENEDIR)/Runtime/libnss_dns.so.2 sgx.trusted_files.libresolve = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2 # Other libraries -sgx.trusted_files.libexpat = file:/lib/x86_64-linux-gnu/libexpat.so.1 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssmdns4 = file:/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2 +sgx.trusted_files.libexpat = file:$(ARCH_LIBDIR)/libexpat.so.1 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssmdns4 = file:$(ARCH_LIBDIR)/libnss_mdns4_minimal.so.2 $(PYTHON_TRUSTED_LIBS) # Python scripts required for helloworld.py/fibonacci.py diff --git a/Examples/pytorch/Makefile b/Examples/pytorch/Makefile index a0a96b4f..5510a495 100644 --- a/Examples/pytorch/Makefile +++ b/Examples/pytorch/Makefile @@ -33,6 +33,8 @@ else default: pytorch.manifest python3.manifest pal_loader endif +include ../../Scripts/Makefile.configs + pytorch.sig: python3.sig # .manifest.template contains stanzas for both Ubuntu 16 and 18. The last rule selectively enables @@ -42,6 +44,7 @@ pytorch.sig: python3.sig -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ -e 's|$$(HOME)|'"$(HOME)"'|g' \ -e 's|# '"$(UBUNTU_VERSION)"' ||g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ pytorch.sig: pytorch.manifest diff --git a/Examples/pytorch/pytorch.manifest.template b/Examples/pytorch/pytorch.manifest.template index 427fbc35..96e9c245 100644 --- a/Examples/pytorch/pytorch.manifest.template +++ b/Examples/pytorch/pytorch.manifest.template @@ -16,7 +16,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables -loader.env.LD_LIBRARY_PATH = /lib:/usr/lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:/usr/lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) # Default glibc files, mounted from the Runtime directory in GRAPHENEDIR fs.mount.lib.type = chroot @@ -25,8 +25,8 @@ fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime/ # More libraries required by PyTorch fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr @@ -82,37 +82,37 @@ sgx.trusted_files.libresolv = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2 sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1 sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1 -sgx.trusted_files.libstdc = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6 -sgx.trusted_files.libgccs = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 -sgx.trusted_files.libaptpkg = file:/usr/lib/x86_64-linux-gnu/libapt-pkg.so.5.0 -sgx.trusted_files.liblz4 = file:/usr/lib/x86_64-linux-gnu/liblz4.so.1 -sgx.trusted_files.libsystemd = file:/lib/x86_64-linux-gnu/libsystemd.so.0 -sgx.trusted_files.libselinux = file:/lib/x86_64-linux-gnu/libselinux.so.1 -sgx.trusted_files.libgcrypt = file:/lib/x86_64-linux-gnu/libgcrypt.so.20 -sgx.trusted_files.libpcre = file:/lib/x86_64-linux-gnu/libpcre.so.3 -sgx.trusted_files.libgpgerror = file:/lib/x86_64-linux-gnu/libgpg-error.so.0 -sgx.trusted_files.libexpat = file:/lib/x86_64-linux-gnu/libexpat.so.1 -sgx.trusted_files.libz = file:/lib/x86_64-linux-gnu/libz.so.1 -sgx.trusted_files.libz2 = file:/lib/x86_64-linux-gnu/libbz2.so.1.0 -sgx.trusted_files.liblzma = file:/lib/x86_64-linux-gnu/liblzma.so.5 -sgx.trusted_files.libmpdec = file:/usr/lib/x86_64-linux-gnu/libmpdec.so.2 +sgx.trusted_files.libstdc = file:/usr/$(ARCH_LIBDIR)/libstdc++.so.6 +sgx.trusted_files.libgccs = file:$(ARCH_LIBDIR)/libgcc_s.so.1 +sgx.trusted_files.libaptpkg = file:/usr/$(ARCH_LIBDIR)/libapt-pkg.so.5.0 +sgx.trusted_files.liblz4 = file:/usr/$(ARCH_LIBDIR)/liblz4.so.1 +sgx.trusted_files.libsystemd = file:$(ARCH_LIBDIR)/libsystemd.so.0 +sgx.trusted_files.libselinux = file:$(ARCH_LIBDIR)/libselinux.so.1 +sgx.trusted_files.libgcrypt = file:$(ARCH_LIBDIR)/libgcrypt.so.20 +sgx.trusted_files.libpcre = file:$(ARCH_LIBDIR)/libpcre.so.3 +sgx.trusted_files.libgpgerror = file:$(ARCH_LIBDIR)/libgpg-error.so.0 +sgx.trusted_files.libexpat = file:$(ARCH_LIBDIR)/libexpat.so.1 +sgx.trusted_files.libz = file:$(ARCH_LIBDIR)/libz.so.1 +sgx.trusted_files.libz2 = file:$(ARCH_LIBDIR)/libbz2.so.1.0 +sgx.trusted_files.liblzma = file:$(ARCH_LIBDIR)/liblzma.so.5 +sgx.trusted_files.libmpdec = file:/usr/$(ARCH_LIBDIR)/libmpdec.so.2 -# Ubuntu16.04 sgx.trusted_files.libcrypto = file:/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 -# Ubuntu16.04 sgx.trusted_files.libssl = file:/lib/x86_64-linux-gnu/libssl.so.1.0.0 -# Ubuntu18.04 sgx.trusted_files.libcrypto = file:/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 -# Ubuntu18.04 sgx.trusted_files.libssl = file:/usr/lib/x86_64-linux-gnu/libssl.so.1.1 +# Ubuntu16.04 sgx.trusted_files.libcrypto = file:$(ARCH_LIBDIR)/libcrypto.so.1.0.0 +# Ubuntu16.04 sgx.trusted_files.libssl = file:$(ARCH_LIBDIR)/libssl.so.1.0.0 +# Ubuntu18.04 sgx.trusted_files.libcrypto = file:/usr/$(ARCH_LIBDIR)/libcrypto.so.1.1 +# Ubuntu18.04 sgx.trusted_files.libssl = file:/usr/$(ARCH_LIBDIR)/libssl.so.1.1 # Name Service Switch (NSS) libraries (Glibc dependencies) -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 # The script to run sgx.trusted_files.script = file:pytorchexample.py # required by Python package ctypes (lib/python3.6/lib-dynload/ctypes.cpython-36m-x86_64-linux-gnu.so) -# Ubuntu18.04 sgx.trusted_files.libffi = file:/usr/lib/x86_64-linux-gnu/libffi.so.6 +# Ubuntu18.04 sgx.trusted_files.libffi = file:/usr/$(ARCH_LIBDIR)/libffi.so.6 # File containing the classes, i.e., things the classifier has been trained to distinguish between sgx.trusted_files.classes = file:classes.txt diff --git a/Examples/r/Makefile b/Examples/r/Makefile index d39ea736..5d9ba669 100644 --- a/Examples/r/Makefile +++ b/Examples/r/Makefile @@ -31,6 +31,8 @@ ifeq ($(SGX),1) all: R.manifest.sgx R.sig R.token sh.manifest.sgx sh.sig sh.token endif +include ../../Scripts/Makefile.configs + # R dependencies (generate from ldd): # # For SGX, the manifest needs to list all the libraries loaded during the @@ -79,6 +81,7 @@ R.manifest: R.manifest.template R-trusted-libs -e 's|$$(R_HOME)|'"$(R_HOME)"'|g' \ -e 's|$$(R_EXEC)|'"$(R_EXEC)"'|g' \ -e 's|$$(R_TRUSTED_LIBS)|'"`cat R-trusted-libs`"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ sh.manifest: sh.manifest.template diff --git a/Examples/r/R.manifest.template b/Examples/r/R.manifest.template index 42dea918..0c4cc194 100644 --- a/Examples/r/R.manifest.template +++ b/Examples/r/R.manifest.template @@ -17,7 +17,7 @@ loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so loader.debug_type = $(GRAPHENEDEBUG) # Environment variables for R -loader.env.LD_LIBRARY_PATH = $(R_HOME)/lib:/lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = $(R_HOME)/lib:/lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR) loader.env.PATH = $(R_HOME)/bin:/usr/bin:/bin loader.env.USERNAME = loader.env.HOME = @@ -33,10 +33,10 @@ fs.mount.lib.type = chroot fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime -# Host-level libraries (/lib/x86_64-linux-gnu) required by the R executable +# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by the R executable fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Host-level directory (/usr) required by the R executable fs.mount.usr.type = chroot diff --git a/Examples/redis/Makefile b/Examples/redis/Makefile index 35b8e177..a98bed6a 100644 --- a/Examples/redis/Makefile +++ b/Examples/redis/Makefile @@ -35,6 +35,8 @@ ifeq ($(SGX),1) all: redis-server.manifest.sgx endif +include ../../Scripts/Makefile.configs + ############################## REDIS EXECUTABLE ############################### # Redis is built as usual, without any changes to the build process (except to @@ -67,6 +69,7 @@ endif redis-server.manifest: redis-server.manifest.template sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \ -e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \ + -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ $< > $@ # Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This diff --git a/Examples/redis/redis-server.manifest.template b/Examples/redis/redis-server.manifest.template index 3e6a7fcb..128bd4b6 100644 --- a/Examples/redis/redis-server.manifest.template +++ b/Examples/redis/redis-server.manifest.template @@ -31,8 +31,8 @@ loader.debug_type = $(GRAPHENEDEBUG) # # In case of Redis: # - /lib is searched for Glibc libraries (ld, libc, libpthread) -# - /lib/x86_64-linux-gnu is searched for Name Service Switch (NSS) libraries -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu +# - $(ARCH_LIBDIR) is searched for Name Service Switch (NSS) libraries +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR) ################################# MOUNT FS ################################### @@ -54,8 +54,8 @@ fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime # Mount host-OS directory to Name Service Switch (NSS) libraries (in 'uri') # into in-Graphene visible directory /lib/x86_64-linux-gnu (in 'path'). fs.mount.lib2.type = chroot -fs.mount.lib2.path = /lib/x86_64-linux-gnu -fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib2.path = $(ARCH_LIBDIR) +fs.mount.lib2.uri = file:$(ARCH_LIBDIR) # Mount host-OS directory to NSS files required by Glibc + NSS libs (in 'uri') # into in-Graphene visible directory /etc (in 'path'). @@ -119,13 +119,13 @@ sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0 # name-service information gathering. libnss_{compat,files,nis} are the # most widely used libraries, at least on Ubuntu. # For more info, see 'man nsswitch.conf'. -sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2 -sgx.trusted_files.libnssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2 -sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2 +sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2 +sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2 +sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2 # libNSL is a dependency of libnss_compat above. It is a good example of nested # library dependencies required by Graphene-SGX. -sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1 +sgx.trusted_files.libnsl = file:$(ARCH_LIBDIR)/libnsl.so.1 ############################ SGX: TRUSTED FILES ############################### diff --git a/Examples/tensorflow/Makefile b/Examples/tensorflow/Makefile index 9af8d334..b56a7f55 100644 --- a/Examples/tensorflow/Makefile +++ b/Examples/tensorflow/Makefile @@ -15,6 +15,8 @@ ifeq ($(SGX),1) default: label_image.manifest.sgx endif +include ../../Scripts/Makefile.configs + $(TF_DIR)/configure: $(GRAPHENEDIR)/Scripts/download --output tensorflow.tar.gz --sha256 $(TAR_SHA256)\ --url https://github.com/tensorflow/tensorflow/archive/$(GIT_COMMIT).tar.gz @@ -43,10 +45,10 @@ image.bmp: $(TF_DIR)/tensorflow/contrib/lite/examples/label_image/testdata/grace cp $^ $@ $(GRAPHENEDIR)/Runtime/libgcc_s.so.1: - cp /lib/x86_64-linux-gnu/libgcc_s.so.1 $@ + cp $(ARCH_LIBDIR)/libgcc_s.so.1 $@ $(GRAPHENEDIR)/Runtime/libstdc++.so.6: - cp /usr/lib/x86_64-linux-gnu/libstdc++.so.6 $@ + cp /usr/$(ARCH_LIBDIR)/libstdc++.so.6 $@ label_image.manifest: libtensorflow_framework.so label_image inception_v3.tflite labels.txt image.bmp label_image.manifest: $(GRAPHENEDIR)/Runtime/libgcc_s.so.1 $(GRAPHENEDIR)/Runtime/libstdc++.so.6 diff --git a/LibOS/shim/test/fs/manifest.template b/LibOS/shim/test/fs/manifest.template index 7a80c6af..1dd1effb 100644 --- a/LibOS/shim/test/fs/manifest.template +++ b/LibOS/shim/test/fs/manifest.template @@ -1,5 +1,5 @@ loader.preload = file:../../src/libsysdb.so -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) loader.debug_type = none loader.syscall_symbol = syscalldb @@ -8,12 +8,12 @@ fs.mount.graphene_lib.path = /lib fs.mount.graphene_lib.uri = file:../../../../Runtime fs.mount.host_lib.type = chroot -fs.mount.host_lib.path = /lib/x86_64-linux-gnu -fs.mount.host_lib.uri = file:/lib/x86_64-linux-gnu +fs.mount.host_lib.path = $(ARCH_LIBDIR) +fs.mount.host_lib.uri = file:$(ARCH_LIBDIR) fs.mount.host_usr_lib.type = chroot -fs.mount.host_usr_lib.path = /usr/lib/x86_64-linux-gnu -fs.mount.host_usr_lib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.host_usr_lib.path = /usr/$(ARCH_LIBDIR) +fs.mount.host_usr_lib.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.bin.type = chroot fs.mount.bin.path = /bin @@ -28,6 +28,6 @@ sgx.trusted_files.libc = file:../../../../Runtime/libc.so.6 sgx.trusted_files.libdl = file:../../../../Runtime/libdl.so.2 sgx.trusted_files.libm = file:../../../../Runtime/libm.so.6 sgx.trusted_files.libpthread = file:../../../../Runtime/libpthread.so.0 -sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 +sgx.trusted_files.libgcc_s = file:$(ARCH_LIBDIR)/libgcc_s.so.1 sgx.allowed_files.tmp_dir = file:tmp/ diff --git a/LibOS/shim/test/ltp/Makefile b/LibOS/shim/test/ltp/Makefile index 3087faf4..bfe767da 100644 --- a/LibOS/shim/test/ltp/Makefile +++ b/LibOS/shim/test/ltp/Makefile @@ -5,6 +5,7 @@ exec_target = clean-extra = clean-build +include ../../../../Scripts/Makefile.configs include Makefile.Test $(SRCDIR)/Makefile: @@ -25,7 +26,8 @@ build-manifest: $(TESTCASEDIR)/manifest.template $(TESTCASEDIR)/Makefile cd $(TESTCASEDIR) && $(MAKE) $(TESTCASEDIR)/manifest.template: manifest.template - cp -f $< $@ + sed -e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \ + $< > $@ $(TESTCASEDIR)/Makefile: Makefile.testcases ln -sf $(abspath $<) $@ diff --git a/LibOS/shim/test/ltp/Makefile.Test b/LibOS/shim/test/ltp/Makefile.Test index 11630e4b..58f33227 100644 --- a/LibOS/shim/test/ltp/Makefile.Test +++ b/LibOS/shim/test/ltp/Makefile.Test @@ -53,6 +53,7 @@ manifest_rules = \ -e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \ -e 's:\$$(SHIMPATH):$(abspath $(RUNTIME))/libsysdb.so:g' \ -e 's:\$$(LIBCDIR):$(abspath $(RUNTIME)):g' \ + -e 's:\$$(ARCH_LIBDIR):$(ARCH_LIBDIR):g' \ $(extra_rules) else manifest_rules= \ @@ -61,6 +62,7 @@ manifest_rules= \ -e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \ -e 's:\$$(SHIMPATH):'$$RELDIR'$(RUNTIME)/libsysdb.so:g' \ -e 's:\$$(LIBCDIR):'$$RELDIR'$(RUNTIME):g' \ + -e 's:\$$(ARCH_LIBDIR):$(ARCH_LIBDIR):g' \ $(extra_rules) endif diff --git a/LibOS/shim/test/ltp/manifest.template b/LibOS/shim/test/ltp/manifest.template index 12e3fe3a..984c72e7 100644 --- a/LibOS/shim/test/ltp/manifest.template +++ b/LibOS/shim/test/ltp/manifest.template @@ -1,7 +1,7 @@ loader.preload = file:$(SHIMPATH) -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib64 +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/lib:/usr/lib64 loader.env.PATH = /bin:/usr/bin:. -loader.env.LD_PRELOAD = /usr/lib/x86_64-linux-gnu/coreutils/libstdbuf.so +loader.env.LD_PRELOAD = /usr/$(ARCH_LIBDIR)/coreutils/libstdbuf.so loader.env._STDBUF_O = L loader.debug_type = none @@ -14,8 +14,8 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(LIBCDIR) fs.mount.lib64.type = chroot -fs.mount.lib64.path = /lib/x86_64-linux-gnu -fs.mount.lib64.uri = file:/lib/x86_64-linux-gnu +fs.mount.lib64.path = $(ARCH_LIBDIR) +fs.mount.lib64.uri = file:$(ARCH_LIBDIR) fs.mount.usr.type = chroot fs.mount.usr.path = /usr @@ -36,6 +36,6 @@ sgx.trusted_files.libdl = file:$(LIBCDIR)/libdl.so.2 sgx.trusted_files.libm = file:$(LIBCDIR)/libm.so.6 sgx.trusted_files.libpthread = file:$(LIBCDIR)/libpthread.so.0 sgx.trusted_files.librt = file:$(LIBCDIR)/librt.so.1 -sgx.trusted_files.libstdbuf = file:/usr/lib/x86_64-linux-gnu/coreutils/libstdbuf.so +sgx.trusted_files.libstdbuf = file:/usr/$(ARCH_LIBDIR)/coreutils/libstdbuf.so sgx.allowed_files.tmp = file:/tmp diff --git a/LibOS/shim/test/native/ls.manifest.template b/LibOS/shim/test/native/ls.manifest.template index b7b8d53c..62559a22 100644 --- a/LibOS/shim/test/native/ls.manifest.template +++ b/LibOS/shim/test/native/ls.manifest.template @@ -1,6 +1,6 @@ loader.preload = file:$(SHIMPATH) loader.exec = file:/bin/ls -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR) loader.debug_type = none fs.mount.lib.type = chroot @@ -8,8 +8,8 @@ fs.mount.lib.path = /lib fs.mount.lib.uri = file:$(LIBCDIR) fs.mount.hostlib.type = chroot -fs.mount.hostlib.path = /lib/x86_64-linux-gnu -fs.mount.hostlib.uri = file:/lib/x86_64-linux-gnu +fs.mount.hostlib.path = $(ARCH_LIBDIR) +fs.mount.hostlib.uri = file:$(ARCH_LIBDIR) fs.mount.bin.type = chroot fs.mount.bin.path = /bin @@ -20,7 +20,7 @@ sgx.trusted_files.ld = file:$(LIBCDIR)/ld-linux-x86-64.so.2 sgx.trusted_files.libc = file:$(LIBCDIR)/libc.so.6 sgx.trusted_files.libdl = file:$(LIBCDIR)/libdl.so.2 sgx.trusted_files.libpthread = file:$(LIBCDIR)/libpthread.so.0 -sgx.trusted_files.libselinux = file:/lib/x86_64-linux-gnu/libselinux.so.1 -sgx.trusted_files.libacl = file:/lib/x86_64-linux-gnu/libacl.so.1 -sgx.trusted_files.libpcre = file:/lib/x86_64-linux-gnu/libpcre.so.3 -sgx.trusted_files.libattr = file:/lib/x86_64-linux-gnu/libattr.so.1 +sgx.trusted_files.libselinux = file:$(ARCH_LIBDIR)/libselinux.so.1 +sgx.trusted_files.libacl = file:$(ARCH_LIBDIR)/libacl.so.1 +sgx.trusted_files.libpcre = file:$(ARCH_LIBDIR)/libpcre.so.3 +sgx.trusted_files.libattr = file:$(ARCH_LIBDIR)/libattr.so.1 diff --git a/LibOS/shim/test/regression/echo.manifest.template b/LibOS/shim/test/regression/echo.manifest.template index fa0e0c92..c8d7858d 100644 --- a/LibOS/shim/test/regression/echo.manifest.template +++ b/LibOS/shim/test/regression/echo.manifest.template @@ -2,7 +2,7 @@ loader.exec = file:/bin/echo loader.execname = file:echo loader.preload = file:../../src/libsysdb.so -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) loader.debug_type = none loader.syscall_symbol = syscalldb @@ -11,12 +11,12 @@ fs.mount.graphene_lib.path = /lib fs.mount.graphene_lib.uri = file:../../../../Runtime fs.mount.host_lib.type = chroot -fs.mount.host_lib.path = /lib/x86_64-linux-gnu -fs.mount.host_lib.uri = file:/lib/x86_64-linux-gnu +fs.mount.host_lib.path = $(ARCH_LIBDIR) +fs.mount.host_lib.uri = file:$(ARCH_LIBDIR) fs.mount.host_usr_lib.type = chroot -fs.mount.host_usr_lib.path = /usr/lib/x86_64-linux-gnu -fs.mount.host_usr_lib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.host_usr_lib.path = /usr/$(ARCH_LIBDIR) +fs.mount.host_usr_lib.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.bin.type = chroot fs.mount.bin.path = /bin diff --git a/LibOS/shim/test/regression/manifest.template b/LibOS/shim/test/regression/manifest.template index c3af850d..3d266f88 100644 --- a/LibOS/shim/test/regression/manifest.template +++ b/LibOS/shim/test/regression/manifest.template @@ -1,5 +1,5 @@ loader.preload = file:../../src/libsysdb.so -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) loader.debug_type = none loader.syscall_symbol = syscalldb @@ -8,12 +8,12 @@ fs.mount.graphene_lib.path = /lib fs.mount.graphene_lib.uri = file:../../../../Runtime fs.mount.host_lib.type = chroot -fs.mount.host_lib.path = /lib/x86_64-linux-gnu -fs.mount.host_lib.uri = file:/lib/x86_64-linux-gnu +fs.mount.host_lib.path = $(ARCH_LIBDIR) +fs.mount.host_lib.uri = file:$(ARCH_LIBDIR) fs.mount.host_usr_lib.type = chroot -fs.mount.host_usr_lib.path = /usr/lib/x86_64-linux-gnu -fs.mount.host_usr_lib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.host_usr_lib.path = /usr/$(ARCH_LIBDIR) +fs.mount.host_usr_lib.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.bin.type = chroot fs.mount.bin.path = /bin @@ -29,8 +29,8 @@ sgx.trusted_files.libc = file:../../../../Runtime/libc.so.6 sgx.trusted_files.libdl = file:../../../../Runtime/libdl.so.2 sgx.trusted_files.libm = file:../../../../Runtime/libm.so.6 sgx.trusted_files.libpthread = file:../../../../Runtime/libpthread.so.0 -sgx.trusted_files.libgcc_s = file:/lib/x86_64-linux-gnu/libgcc_s.so.1 -sgx.trusted_files.libstdcxx = file:/usr/lib/x86_64-linux-gnu/libstdc++.so.6 +sgx.trusted_files.libgcc_s = file:$(ARCH_LIBDIR)/libgcc_s.so.1 +sgx.trusted_files.libstdcxx = file:/usr$(ARCH_LIBDIR)/libstdc++.so.6 sgx.trusted_files.victim = file:exec_victim sgx.trusted_children.victim = file:exec_victim.sig diff --git a/LibOS/shim/test/regression/openmp.manifest.template b/LibOS/shim/test/regression/openmp.manifest.template index 43a56f4b..d482f93c 100644 --- a/LibOS/shim/test/regression/openmp.manifest.template +++ b/LibOS/shim/test/regression/openmp.manifest.template @@ -13,7 +13,7 @@ fs.mount.bin.uri = file:/bin fs.mount.usrlib.type = chroot fs.mount.usrlib.path = /usrlib -fs.mount.usrlib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.usrlib.uri = file:/usr/$(ARCH_LIBDIR) sgx.thread_num = 32 @@ -21,6 +21,6 @@ sgx.trusted_files.ld = file:../../../../Runtime/ld-linux-x86-64.so.2 sgx.trusted_files.libc = file:../../../../Runtime/libc.so.6 sgx.trusted_files.libpthread = file:../../../../Runtime/libpthread.so.0 sgx.trusted_files.libdl = file:../../../../Runtime/libdl.so.2 -sgx.trusted_files.libgomp = file:/usr/lib/x86_64-linux-gnu/libgomp.so.1 +sgx.trusted_files.libgomp = file:/usr$(ARCH_LIBDIR)/libgomp.so.1 sgx.static_address = 1 diff --git a/LibOS/shim/test/regression/sh.manifest.template b/LibOS/shim/test/regression/sh.manifest.template index 6d94cc7d..5c57ea47 100644 --- a/LibOS/shim/test/regression/sh.manifest.template +++ b/LibOS/shim/test/regression/sh.manifest.template @@ -2,7 +2,7 @@ loader.exec = file:/bin/sh loader.execname = file:sh loader.preload = file:../../src/libsysdb.so -loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu +loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR) loader.debug_type = none loader.syscall_symbol = syscalldb @@ -11,12 +11,12 @@ fs.mount.graphene_lib.path = /lib fs.mount.graphene_lib.uri = file:../../../../Runtime fs.mount.host_lib.type = chroot -fs.mount.host_lib.path = /lib/x86_64-linux-gnu -fs.mount.host_lib.uri = file:/lib/x86_64-linux-gnu +fs.mount.host_lib.path = $(ARCH_LIBDIR) +fs.mount.host_lib.uri = file:$(ARCH_LIBDIR) fs.mount.host_usr_lib.type = chroot -fs.mount.host_usr_lib.path = /usr/lib/x86_64-linux-gnu -fs.mount.host_usr_lib.uri = file:/usr/lib/x86_64-linux-gnu +fs.mount.host_usr_lib.path = /usr/$(ARCH_LIBDIR) +fs.mount.host_usr_lib.uri = file:/usr/$(ARCH_LIBDIR) fs.mount.bin.type = chroot fs.mount.bin.path = /bin diff --git a/Scripts/Makefile.Test b/Scripts/Makefile.Test index 6caecfab..aadd582d 100644 --- a/Scripts/Makefile.Test +++ b/Scripts/Makefile.Test @@ -38,6 +38,7 @@ manifest_rules = \ -e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \ -e 's:\$$(SHIMPATH):$(abspath $(RUNTIME))/libsysdb.so:g' \ -e 's:\$$(LIBCDIR):$(abspath $(RUNTIME)):g' \ + -e 's:\$$(ARCH_LIBDIR):$(ARCH_LIBDIR):g' \ $(extra_rules) else manifest_rules= \ @@ -46,6 +47,7 @@ manifest_rules= \ -e 's:\$$(BIN):$(subst .manifest,,$(notdir $@)):g' \ -e 's:\$$(SHIMPATH):$(RUNTIME)/libsysdb.so:g' \ -e 's:\$$(LIBCDIR):$(RUNTIME):g' \ + -e 's:\$$(ARCH_LIBDIR):$(ARCH_LIBDIR):g' \ $(extra_rules) endif diff --git a/Scripts/Makefile.configs b/Scripts/Makefile.configs index 9506f8e4..64f618ff 100644 --- a/Scripts/Makefile.configs +++ b/Scripts/Makefile.configs @@ -23,6 +23,14 @@ OBJCOPY ?= objcopy SYS ?= $(shell $(CC) -dumpmachine) export SYS +ARCH := $(word 1,$(subst -, -, $(SYS))) + +# where libraries are found, e.g., /lib/x86_64-linux-gnu +ARCH_LIBDIR := /lib/$(SYS) + +# part of filenames and dirs like /usr/lib/gcc/$(ARCH_LONG) +ARCH_LONG := $(SYS) + DEBUG ?= export DEBUG