- Extract parts that are common for all hosts
- Remove some outdated/unnecessary options, we should now be
closer to default configuration
- Disable libthread_db loading (does not work and crashes GDB 9.2)
- Disable pagination when loading debug maps
- Use the same mechanism (debug_map) in Pal/Linux and Pal/Linux-SGX.
Previously, Pal/Linux emulated the _r_debug structure, normally
maintained by ld.so, but that cannot be done in SGX outer PAL,
because it's loaded by ld.so already.
- Maintain the debug maps outside of SGX enclave. This allows
initializing them before enclave start, and potentially makes
them easier to use.
- Initialize PAL debug map before enclave start. Previously, this
was done from inside the enclave, so you couldn't set a
breakpoint too early (e.g. in pal_linux_main).
- Store only load address, without list of sections. This is to
avoid parsing the list of sections just to report them to the
debugger. Unfortunately, the GDB version that we support still
needs these sections, but we can retrieve them in GDB plugin.
- Move Python GDB code related to debug maps to a common file.
This is the next part of the great loader rework, with a lot of breaking changes:
- Complete removal of the "trusted children" thing - now children
processes can be spawned arbitrarily and from arbitrary mountpoint
types, without any additional configuration needed.
- There's a new, required option in the manifest: `libos.entrypoint` - it
specifies the URI to the entry binary in the first process. There's no
need anymore to name the manifest and the first binary identically.
- On SGX, the main binary is not measured in MRENCLAVE anymore - only
PAL, LibOS and the manifest are measured. This is enough to bind
MRENCLAVE to a specific entrypoint user executable if wanted - it
just has to be mounted as a trusted file.
- All Graphene SGX enclaves have now exactly the same MRENCLAVE. This is
a hash of a "Graphene stub", which can "fork" into one of two states
in runtime: initial process or child. The initial process creates a
new "Graphene namespace" with a clean state, it can also be attested
remotely (contrary to child processes). The initial process can spawn
children processes by spawning a Graphene stub and directing it to
start in the child mode. It then attests it locally, and if
successful, establishes an encrypted pipe, "connects" to its own
namespace and treats as trusted (including sending protected files
key).
- Now, there's only one, central manifest describing the initial state
of a Graphene instance which can be spawned from it (previously, each
process required a separate manifest which could have different
configuration - which wasn't actually supported and didn't make sense
design-wise). One downside of central manifests is that all processes
require the same enclave configuration (e.g. size), but that was
already the case so far because of broken checkpointing code. Also,
this is only a temporary problem, which will cease to exist after the
introduction of EDMM.
- `sgx.static_address` was renamed to `sgx.nonpie_binary` and now has to
be inserted manually by users (`sgx_sign` tools doesn't know about the
binaries run inside, which can be even provided or generated in
runtime by the user's workload).
- Caveat: the memory gap for non-PIE executables was removed because it
requires adding a new option to the manifest to be cleanly
implemented. This is left for some future loader rework PR.
This is to choose which PALs are to be build and installed. Currently
build happens outside of meson, so this only affects installing and not
building, but if one PAL was not built, then meson would fail because it
won't find the dependency.
Meson is still optional and not needed to build or run anything. It is
needed only to install Graphene in distro.
Currently only a small subset of what is actually needed is installed:
- graphene and graphene-sgx (for now those are slightly massaged copies
of pal_loader),
- libpal.so and sgx loader,
- gdb scripts.
Notably manifests should still point trusted_libs to Runtime/ dir in
repo.
For now only gdb-script and Python parts. This is mostly a clean-up of
both Linux and Linux-SGX integration which additionally removes some
annoying user prompts we had in the old scripts.
Graphene had some paths to internal files generated at compile time and
hardcoded into the output binary, which disallowed e.g. moving the
Graphene directory after compilation.
On NixOS/Guix tools are not installed under /usr/bin but are composed
as symlink trees from immutable packages under /nix/store.
Since pal_loader script already relies on bash to be in the PATH env
var, we already have PATH defined here and can use relative paths.
Because GDB is awesome this isn't actually configurable in .gdbinit (or
at least I couldn't find any way to do this) and we need to fix it via
the commandline.
Plain wildcards `*` in .gitignore are considered a bad practice
because they may cause unintended ignore of files. This commit
replaces `*` with explicit lists of file names.
In certain cases (e.g, a container runtime for production), `make` and `gcc`
programs may be unavailable. In this case, detect `PAL_HOST` based on the
base name of libpal.
For detection of SGX/non-SGX (for example in regression tests) always
use the SGX environment variable. To generate launch/EINIT tokens use
the new 'sgx-tokens' Make target.
This commit removes the following from the master Graphene branch (this
is now moved to the EXPERIMENTAL/linux-reference-monitor branch):
- Remove reference monitor loader code
- Remove sandboxing code and dependency to reference monitor code
- Remove Linux kernel changes for reference monitor
- Remove README instructions and scripts regarding reference monitor
Since clean rule is first target, just "make" means "make clean" as default goal.
This is a surprise. usually "make" means "make all".
So move all rule to the first target.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
This patch fixes up to make LibOS/shim/tests/benchmark build again.
It addresses small 4 issues as follows.
- Runtime/pal_loader
pass --no-print-directory to make pal_loader doesn't work as
expected when it's invoked by make command as below. pal_loader
invokes make with --quiet. But when pal_loader is called by make as
sub command, the message, "Entering/Leaving <dir>" is still output.
pass --no-print-directory to make to suppress Entering/Leaving
message.
> /graphene/Runtime/pal-make[1]: Entering
> directory '/graphene/Pal/test'
> Linux
> make[1]: Leaving directory
> '/graphene/devel/graphene/Pal/test' is not built, or
> security mode is not supported
- fix up Makefiles to build LibOS/shim/tests/benchmark
Otherwise the build fails as follows.
> $ make
> ln -sf ../../../../Runtime/pal_loader
> [ fork_latency ]
> [ test_start.m ]
> [ rpc_latency.libos ]
> /usr/bin/ld: cannot find -llibos
> collect2: error: ld returned 1 exit status
> Makefile:18: recipe for target 'rpc_latency.libos' failed
> make: *** [rpc_latency.libos] Error 1
- update stale manifest.template
- update .gitignore
The change set of 7f5a4cc made Makefile create .lib directory.
So add it to .gitignore.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
1. Redesign of the VMA bookkeeping logic in the library OS
2. ASLR reimplementation
3. Support MAP_32BITS flags for mmap()
4. Safeguarding library OS internal memory from user memory and checkpoint buffers
5. Eliminating race conditions at VMA lookup and bookkeeping
6. Enable early VMA bookkeeping during initialization
7. Adding documentation for the VMA implementation
* add memusg to pal_loader script
* Stop bleeding PAL handles.
Deprecating DkOjectReference and reference counting in PAL handle.
Deprecating DkSemaphoreDestroy and DkEventDestroy (replaced by DkObjectClose).
Cleaning unused PAL handles in the library OS.
Adding a heap tracing feature to profile usage of PAL handles.
* fix a bug in SGX mode that mapping untrusted files into memory never got free by DkVirtualMemoryFree()
* adding lighttpd SSL option
* fixing the freeing convention of PAL handles; On SGX, event and mutex handles need to be freed seperately.
* changing how mutexes and events are allocated on SGX
* fixing GCC regression tests (for both Linux and SGX)
* fix a double-free problem of the first thread handle
- Fixing AES-CMAC algorithm
- Using SHA512 to hash file stubs (much faster than SHA256 and AES-CMAC)
- Hardening enclave interface (still work-in-progress); delt with issue #28
- Handling socket/pipe polling better
- Allowing setting the lowest heap address in enclaves ('sgx.heap_min' in manifest)
- Fixing the pipe between processes (for SGX)
- Fixing race condition in futex handling in LibOS
- Inheriting epoll handles in forked chilren
- Assigning signal code (now only hard-coding FPE_INTDIV, BUS_ADRERR, SEGV_ACCERR, SEGV_MAPERR)
- Fixing race condition in vma allocation (likely to fix bug() in bookkeep/shim_vma.c)
- Clearer debug message in LibOS
- Fixing calling convention in LibOS and glibc
- Fixing futex behavior (FUTEX_WAIT takes relative time, FUTEX_WAIT_BITSET takes absolute time)
- More system call implemented
- More application working (NGINX)
Paweł Marczewski