gramine-direct works great but gramine-sgx cannot access text files for encryption

159 Views Asked by At

I am unable to access text files for encryption inside gramine-sgx, gramine-direct works great. The issue is I want to run it inside enclave. Makefile:

 CFLAGS = -Wall -Wextra -Wno-deprecated-declarations

#ifeq ($(DEBUG),1)
    GRAMINE_LOG_LEVEL = debug
#   CFLAGS += -g
#else
#   GRAMINE_LOG_LEVEL = error
#   CFLAGS += -O3
#endif

LDFLAGS = $(CFLAGS) -L/usr/lib/x86_64-linux-gnu/sgx -lcrypto

.PHONY: all
all: test-gramine test-gramine.manifest
#ifeq ($(SGX),1)
#   all: test-gramine.manifest.sgx test-gramine.sig
#endif
ifeq ($(SGX),1)
    gramine-manifest -Dlog_level=error test-gramine.manifest.template test-gramine.manifest
    #make
    gramine-sgx-sign --manifest test-gramine.manifest --output test-gramine.manifest.sgx
endif
test-gramine: test-gramine.o
    $(CC) $^ -o $@ $(LDFLAGS) -lssl -lcrypto

test-gramine.o: test-gramine.c

test-gramine.manifest: test-gramine.manifest.template
    gramine-manifest -Dlog_level=$(GRAMINE_LOG_LEVEL) $< $@

test-gramine.sig test-gramine.manifest.sgx: sgx_sign
    @:

.INTERMEDIATE: sgx_sign
sgx_sign: test-gramine.manifest test-gramine
    gramine-sgx-sign --manifest $< --output $<.sgx

ifeq ($(SGX),)
    GRAMINE = LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu gramine-direct
else
    GRAMINE = LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu gramine-sgx
endif

.PHONY: check
check: all
    $(GRAMINE) ./test-gramine <input-file> | $(SHA512_CMD) > OUTPUT
    echo "SHA512 hash of input file:"
    cat OUTPUT
    @echo "[ Success ]"

.PHONY: clean
clean:
    $(RM) *.token *.sig *.manifest.sgx *.manifest test-gramine.o test-gramine OUTPUT

.PHONY: distclean
distclean: clean
    rm -rf .gbuild

SHA512_CMD = sha512sum

manifest.template:

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/test-gramine"
loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/lib:/usr/lib/x86_64-linux-gnu/"

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "/test-gramine", uri = "file:test-gramine" },
  { path = "/usr/lib/x86_64-linux-gnu", uri = "file:/usr/lib/x86_64-linux-gnu" },
]

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:test-gramine",
  "file:logs.txt",
  "file:{{ gramine.runtimedir() }}/",
  "file:/usr/lib/x86_64-linux-gnu/libcrypto.so.3",
  "file:/usr/lib/x86_64-linux-gnu/",
  "file:/home/imran/gramine/CI-Examples/test-gramine/logs.txt",
  
  
]

fs.entrypoint = "/test-gramine"
loader.argv0_override = "/test-gramine"
loader.insecure__use_cmdline_argv = true

I get the following Error:

imran@Imran:~/gramine/CI-Examples/test-gramine$ gramine-sgx test-gramine logs.txt Gramine is starting. Parsing TOML manifest file, this may take some time...

Gramine detected the following insecure configurations:

  • sgx.debug = true (this is a debug enclave)
  • loader.insecure__use_cmdline_argv = true (forwarding command-line args from untrusted host to the app)

Gramine will continue application execution, but this configuration must not be used in production!

Error opening file: logs.txt

I tried adding the path and file name to the trusted_files. The gramine-direct does encryption properly, gramine-sgx is unable to access the text file.

0

There are 0 best solutions below