If the path of allowed directory in a manifest file ended with a '/'
e.g. "sgx.allowed_files.tmp_dir = file:tmp/" anything inside it was
disallowed due to a buggy subdirectory check
- Deduplicate much of setup code.
- Allow running non-sandbox and sandbox code in single run.
- Use pytest.
- Generate JUnit-XML file for Jenkins.
- Document running a subset of regression tests.
Previous implementation of vfork() was both buggy (worked only in simple
cases) and not compatible with the new IPC implementation. We take a
shortcut for now and emulate vfork() via fork(); this is allowed by
POSIX. This commit also adds LibOS regression test for vfork().
Previously, Graphene incorrectly treated execve() under SGX PAL:
Graphene would emulate execve() as fork + execve, and the new forked
process didn't try to "assume" the identity of its parent (which
violated execve specification "all process attributes are preserved").
This commit reworks the implementations of clone/fork and execve. In
particular, the IPC subsystem clearly distinguishes between the two
cases: clone/fork works as before whereas execve forks new "real"
process (which starts executing the requested program) and silently
exits the now-useless "temporary" process. New "real" process assumes
the identity of "temporary" process by inheriting its VMID (ID of
process for IPC purposes) and IPC-info objects with their PAL handles.
This commit also cleans up initialization of four IPC-info objects: self
(creates process-unique server pipe for IPC), parent (holds pipe for IPC
with parent process), and two namespace leaders (hold pipes for IPC with
leader processes). To correctly identify new-process server pipe, the
implementation of create_pipe() now allows to create VMID-based pipe URI.
- Add error case: fail with EISDIR if directory is open()'ed with
writable access.
- Add additional checks: O_TRUNC must work only on regular writable
files (otherwise do not truncate).
The commit also improves LibOS regression test on FS corner cases and
fixes a tiny bug in DkStreamSetLength() with assert hanging Graphene.
Previously, Graphene had a bug when dentry's rel_path was not initialized
to actual relative path if parent + filename length was longer than
256B. The problem was that rel_path was a shim_qstr which could contain
maximum 256 chars. This commit increases the limit to 4096B and adds
checks to fail explicitly if rel_path is still too large. Also, it adds
LibOS regression test.
Note that relative paths greater than 256 chars in length are not
uncommon. Most OSes impose the limit of 4096 chars or no limit at all.
Previously, OpenMP apps failed to run under Graphene-SGX because it did
not support raw system calls (used inside of OpenMP lib, in particular
the futex() syscall). Since recently, Graphene-SGX has support for raw
syscall execution. This commit adds a test showing that OpenMP works.
Add LibOS regression test which contains a raw syscall instruction to test
SIGILL handler hook logic (if SIGILL'ed instruction is a syscall, it is
redirected inside LibOS as if syscalldb() was called).
Previously the check on correct memory region under Linux-SGX
(called is_in_one_vma()) only checked that the whole memory region fits
into one VMA. In some cases (e.g. DATA and BSS sections), memory regions
can span several adjacent VMAs. This commit refines the check and
renames it to is_in_adjacent_vmas(). It also adds a LibOS test.
This commit also adds LibOS regression test for sigaltstack(). This
test is currently disabled (signal delivery on sigaltstack is not yet
implemented).
Previously, execve(NULL, ...) failed with segfault. This commit adds
memory checks that all arguments of execve() are valid memory regions.
Also adds LibOS regression test on execve(bad-file, bad-args, bad-env).
Previously, test_user_{memory/string} failed on Linux-SGX PAL.
These functions check if user-supplied buffer/string is accessible
inside LibOS. There was only one option: setup a segfault handler
to catch memory errors and access one byte of each page in user-supplied
buffer/string. If some byte is inaccessible, then exception is raised
and caught by segfault handler. The handler checks the faulting
address and redirects back to function and it returns with failure.
This option doesn't work under SGX because there is no trusted field
that contains the faulting address. SGX v1 doesn't have such field at
all, SGX v2 introduces a field in SSA.MISC region but only at the
4K-page granularity.
This commit adds a second option used for SGX PAL: functions consult
LibOS's internal VMA bookkeeping. If buffer/string is not in any VMA,
then these functions fail. This option is slightly slower than first one
since it requires locking and traversing a list of VMAs.
Some Linux applications get the number of CPU cores by querying
/proc/cpuinfo. Before, such apps would be confused by a wrong
format of /proc/cpuinfo in Graphene. This commit updates format
to exactly the same as in Linux kernel.
This commit also adds a LibOS regression test for /proc/cpuinfo.
On weaker machines (Intel NUCs and SGX-enabled laptops),
SGX regression tests take longer than 5 seconds because
Graphene measures/zeroes all enclave memory at startup.
Increase the timeout for SGX regression tests to 20 sec.
The regression python scripts are not marked executable. Also they
expect that the Makefile has setup the environment correctly so just
marking them executable would not be useful. So drop the unused shebang
to avoid encoding the interpreter in multiple places.
Script/regression.py is a library so it also doesn't need a shebang.
This bug just occurs when reading a symlink on procfs.
If input is an absolute path, it will get wrong my_dent.
So we use stat syscall to check whether the "/proc/1/root"
and "/" is same path in graphene.
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
This patch fixes up to make LibOS/shim/tests/benchmark build again.
It addresses small 4 issues as follows.
- Runtime/pal_loader
pass --no-print-directory to make pal_loader doesn't work as
expected when it's invoked by make command as below. pal_loader
invokes make with --quiet. But when pal_loader is called by make as
sub command, the message, "Entering/Leaving <dir>" is still output.
pass --no-print-directory to make to suppress Entering/Leaving
message.
> /graphene/Runtime/pal-make[1]: Entering
> directory '/graphene/Pal/test'
> Linux
> make[1]: Leaving directory
> '/graphene/devel/graphene/Pal/test' is not built, or
> security mode is not supported
- fix up Makefiles to build LibOS/shim/tests/benchmark
Otherwise the build fails as follows.
> $ make
> ln -sf ../../../../Runtime/pal_loader
> [ fork_latency ]
> [ test_start.m ]
> [ rpc_latency.libos ]
> /usr/bin/ld: cannot find -llibos
> collect2: error: ld returned 1 exit status
> Makefile:18: recipe for target 'rpc_latency.libos' failed
> make: *** [rpc_latency.libos] Error 1
- update stale manifest.template
- update .gitignore
The change set of 7f5a4cc made Makefile create .lib directory.
So add it to .gitignore.
Signed-off-by: Isaku Yamahata <isaku.yamahata@gmail.com>
Fixing the bound of a debug buffer in SGX PAL
Rewrite bytes2hexstr; Add two new macros, alloca_bytes2hexstr() and malloc_bytes2hexstr().
Remove HASHBUF_SIZE
Add comments for the bytes2hexstr() macros.
Add a compile-time assertion
Li Lei