mirror of
https://github.com/clearlinux/graphene.git
synced 2026-08-18 19:55:56 +00:00
borysp
c24bddd5aa
Change log (most important only):
- unify CPU context structures - now we have only one version -
`PAL_CONTEXT` - which is shared between LibOS and PALs and it should
depend only on the host architecture (not OS),
- syscalls emulation changed:
- dedicated LibOS stack is now used for syscalls emulation,
- removed one indirection level in syscalls table - now it stores
`shim_do_*` functions directly,
- signal handling - completely rewritten:
- all signal queues use proper locking schemes now,
- signals are handled *only* when returning to the user app from LibOS
or PAL,
- nested signals are now possible,
- the app is allowed to jump out of signal handler with the same
sematics as on normal Linux,
- signal altstack is now fully supported,
- syscall restarting is now supported,
- doing a backtrace from the signal handler works properly,
- disallow injecting host-level signals, with one exception, see
`sys.enable_sigterm_injection` manifest option for more details.
65 lines
2.4 KiB
Plaintext
65 lines
2.4 KiB
Plaintext
# Nodejs manifest file example
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 18.04.
|
|
|
|
libos.entrypoint = "file:$(NODEJS_DIR)/nodejs"
|
|
|
|
# LibOS layer library of Graphene. There is currently only one implementation, so it is always set
|
|
# to libsysdb.so.
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
|
|
# Graphene log level
|
|
loader.log_level = "$(GRAPHENE_LOG_LEVEL)"
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax applies. Paths must be in-
|
|
# Graphene visible paths, not host-OS paths (i.e., paths must be taken from fs.mount.xxx.path, not
|
|
# fs.mount.xxx.uri).
|
|
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR)"
|
|
|
|
# Allow for injecting SIGTERM signal from the host.
|
|
sys.enable_sigterm_injection = 1
|
|
|
|
# Mount host-OS directory to required libraries (in 'uri') into in-Graphene visible directory /lib
|
|
# (in 'path').
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
fs.mount.lib3.type = "chroot"
|
|
fs.mount.lib3.path = "/usr/$(ARCH_LIBDIR)"
|
|
fs.mount.lib3.uri = "file:/usr/$(ARCH_LIBDIR)"
|
|
|
|
# Set enclave size to 2GB. Recall that SGX v1 requires to specify enclave size at enclave creation
|
|
# time.
|
|
sgx.enclave_size = "2G"
|
|
|
|
sgx.nonpie_binary = 1
|
|
|
|
# Set maximum number of in-enclave threads to 8. Recall that SGX v1 requires to specify the maximum
|
|
# number of simultaneous threads at enclave creation time.
|
|
sgx.thread_num = 8
|
|
|
|
# Specify all files used by Node.js and its dependencies (including all libs which can be loaded at
|
|
# runtime via dlopen).
|
|
sgx.trusted_files.nodejs = "file:$(NODEJS_DIR)/nodejs"
|
|
sgx.trusted_files.node = "file:$(NODEJS_DIR)/node"
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
|
|
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
|
|
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
|
|
sgx.trusted_files.libutil = "file:$(GRAPHENEDIR)/Runtime/libutil.so.1"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Input
|
|
sgx.trusted_files.javascript = "file:helloworld.js"
|
|
sgx.allowed_files.modules = "file:node_modules"
|
|
|