clearlinux/graphene
2
0
Fork 0
mirror of https://github.com/clearlinux/graphene.git synced 2026-04-28 11:13:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

[GSC] Always use absolute paths inside the Docker container

Browse Source 
Previously, some GSC templates and scripts that execute inside Docker
containers contained relative file paths. This led to failures if
a base Docker image contained WORKDIR different from root (`/`),
since all GSC scripts put Graphene-related files under root dir.

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>
This commit is contained in:
Dmitrii Kuvaiskii
2021-02-09 05:29:33 -08:00
parent aa9ded3c42
commit 31f08ab11c
4 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Tools/gsc/finalize_manifest.py
View File

@@ -84,7 +84,7 @@ def main(args=None):
if not os.path.isdir(args.dir):
argparser.error(f'\t[from inside Docker container] Could not find directory `{args.dir}`.')
env = jinja2.Environment(loader=jinja2.FileSystemLoader('.'))
env = jinja2.Environment(loader=jinja2.FileSystemLoader('/'))
env.globals.update({'library_paths': generate_library_paths(), 'env_path': os.getenv('PATH')})
manifest = 'entrypoint.manifest'

13
Tools/gsc/templates/Dockerfile.ubuntu18.04.build.template
View File

@@ -56,17 +56,18 @@ COPY entrypoint.manifest /
# Generate trusted arguments if required
{% if not insecure_args %}
RUN /graphene/Tools/argv_serializer {{binary}} {{binary_arguments}} "{{"\" \"".join(cmd)}}" > trusted_argv
RUN /graphene/Tools/argv_serializer {{binary}} {{binary_arguments}} "{{"\" \"".join(cmd)}}" > /trusted_argv
{% endif %}
# Docker entrypoint/cmd typically contains only the basename of the executable so create a symlink
RUN which {{binary}} | xargs ln -s || true
RUN cd / \
&& which {{binary}} | xargs ln -s || true
# Mark apploader.sh executable, finalize manifest, and remove intermediate scripts
RUN chmod u+x apploader.sh \
&& python3 -B finalize_manifest.py \
&& rm -f finalize_manifest.py
RUN chmod u+x /apploader.sh \
&& python3 -B /finalize_manifest.py \
&& rm -f /finalize_manifest.py
# Define default command
ENTRYPOINT ["/bin/bash", "./apploader.sh"]
ENTRYPOINT ["/bin/bash", "/apploader.sh"]
CMD [{% if insecure_args %} "{{'", "'.join(cmd)}}" {% endif %}]

6
Tools/gsc/templates/apploader.template
View File

@@ -6,8 +6,8 @@ set -ex
if [ -z "$GSC_PAL" ] || [ "$GSC_PAL" == "Linux-SGX" ]
then
GSC_PAL=Linux-SGX
/graphene/python/graphene-sgx-get-token -output entrypoint.token -sig entrypoint.sig
/graphene/Runtime/pal-$GSC_PAL /graphene/Runtime/libpal-$GSC_PAL.so init entrypoint {% if insecure_args %}{{binary_arguments}} "${@}"{% endif %}
/graphene/python/graphene-sgx-get-token -output /entrypoint.token -sig /entrypoint.sig
/graphene/Runtime/pal-$GSC_PAL /graphene/Runtime/libpal-$GSC_PAL.so init /entrypoint {% if insecure_args %}{{binary_arguments}} "${@}"{% endif %}
else
/graphene/Runtime/pal-$GSC_PAL /graphene/Runtime/libpal-$GSC_PAL.so init entrypoint {{binary_arguments}} "${@}"
/graphene/Runtime/pal-$GSC_PAL /graphene/Runtime/libpal-$GSC_PAL.so init /entrypoint {{binary_arguments}} "${@}"
fi

4
Tools/gsc/templates/entrypoint.manifest.template
View File

@@ -21,8 +21,8 @@ sgx.nonpie_binary = 1
loader.arg0_override = "{{binary}}"
loader.insecure__use_cmdline_argv = 1
{% else %}
loader.argv_src_file = "file:trusted_argv"
sgx.trusted_files.trusted_argv = "file:trusted_argv"
loader.argv_src_file = "file:/trusted_argv"
sgx.trusted_files.trusted_argv = "file:/trusted_argv"
{% endif %}
# All trusted files and the user defined manifest specifications should be after this line