mirror of
https://github.com/clearlinux/graphene.git
synced 2026-08-28 13:25:43 +00:00
Rafał Wojdyła
cf84489cd5
Protected files (PF) are a new type of file that can be specified in the manifest (SGX only). They are encrypted on disk and transparently decrypted when accessed by the Graphene payload. Other features: - data is integrity protected (tamper resistance) - file swap protection (a PF can only be accessed when in a specific path) - transparency (Graphene payload sees PFs as regular files, no need to modify the payload) See Linux-SGX/protected-files directory for implementation. PF format is based on protected files from the SGX SDK: https://github.com/intel/linux-sgx/tree/master/sdk/protected_fs The following new manifest elements are added: sgx.protected_files_key = <16-byte hex value> sgx.protected_files.<name> = file:<host path> sgx.protected_files_key specifies the encryption key and is only a temporary implementation. This key should be provisioned with local/remote attestation in the future. Paths specifying PF entries can be files or directories. If a directory is specified, all files/directories within are registered as protected recursively (and are expected to be encrypted in the PF format). Linux-SGX/tools directory contains the pf_crypt utility that converts files to/from the protected format.