I am unable to access text files for encryption inside gramine-sgx, gramine-direct works great. The issue is I want to run it inside enclave. Makefile:
CFLAGS = -Wall -Wextra -Wno-deprecated-declarations
#ifeq ($(DEBUG),1)
GRAMINE_LOG_LEVEL = debug
# CFLAGS += -g
#else
# GRAMINE_LOG_LEVEL = error
# CFLAGS += -O3
#endif
LDFLAGS = $(CFLAGS) -L/usr/lib/x86_64-linux-gnu/sgx -lcrypto
.PHONY: all
all: test-gramine test-gramine.manifest
#ifeq ($(SGX),1)
# all: test-gramine.manifest.sgx test-gramine.sig
#endif
ifeq ($(SGX),1)
gramine-manifest -Dlog_level=error test-gramine.manifest.template test-gramine.manifest
#make
gramine-sgx-sign --manifest test-gramine.manifest --output test-gramine.manifest.sgx
endif
test-gramine: test-gramine.o
$(CC) $^ -o $@ $(LDFLAGS) -lssl -lcrypto
test-gramine.o: test-gramine.c
test-gramine.manifest: test-gramine.manifest.template
gramine-manifest -Dlog_level=$(GRAMINE_LOG_LEVEL) $< $@
test-gramine.sig test-gramine.manifest.sgx: sgx_sign
@:
.INTERMEDIATE: sgx_sign
sgx_sign: test-gramine.manifest test-gramine
gramine-sgx-sign --manifest $< --output $<.sgx
ifeq ($(SGX),)
GRAMINE = LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu gramine-direct
else
GRAMINE = LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu gramine-sgx
endif
.PHONY: check
check: all
$(GRAMINE) ./test-gramine <input-file> | $(SHA512_CMD) > OUTPUT
echo "SHA512 hash of input file:"
cat OUTPUT
@echo "[ Success ]"
.PHONY: clean
clean:
$(RM) *.token *.sig *.manifest.sgx *.manifest test-gramine.o test-gramine OUTPUT
.PHONY: distclean
distclean: clean
rm -rf .gbuild
SHA512_CMD = sha512sum
manifest.template:
loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/test-gramine"
loader.log_level = "{{ log_level }}"
loader.env.LD_LIBRARY_PATH = "/lib:/usr/lib/x86_64-linux-gnu/"
fs.mounts = [
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
{ path = "/test-gramine", uri = "file:test-gramine" },
{ path = "/usr/lib/x86_64-linux-gnu", uri = "file:/usr/lib/x86_64-linux-gnu" },
]
sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.trusted_files = [
"file:{{ gramine.libos }}",
"file:test-gramine",
"file:logs.txt",
"file:{{ gramine.runtimedir() }}/",
"file:/usr/lib/x86_64-linux-gnu/libcrypto.so.3",
"file:/usr/lib/x86_64-linux-gnu/",
"file:/home/imran/gramine/CI-Examples/test-gramine/logs.txt",
]
fs.entrypoint = "/test-gramine"
loader.argv0_override = "/test-gramine"
loader.insecure__use_cmdline_argv = true
I get the following Error:
imran@Imran:~/gramine/CI-Examples/test-gramine$ gramine-sgx test-gramine logs.txt Gramine is starting. Parsing TOML manifest file, this may take some time...
Gramine detected the following insecure configurations:
- sgx.debug = true (this is a debug enclave)
- loader.insecure__use_cmdline_argv = true (forwarding command-line args from untrusted host to the app)
Gramine will continue application execution, but this configuration must not be used in production!
Error opening file: logs.txt
I tried adding the path and file name to the trusted_files. The gramine-direct does encryption properly, gramine-sgx is unable to access the text file.