# This is a general manifest template for running Bash and core utility programs,
# including ls, cat, cp, date, and rm.
#
# This manifest was prepared and tested on Ubuntu 16.04.
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
libos.entrypoint = "file:$(EXECDIR)/bash"

# Read application arguments directly from the command line. Don't use this on production!
loader.insecure__use_cmdline_argv = 1

loader.log_level = "$(GRAPHENE_LOG_LEVEL)"

# Environment variables
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR):/usr$(ARCH_LIBDIR)"
loader.env.PATH = "$(EXECDIR)"

# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
# guest. Other parts of the host FS will not be available in the guest.

# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
fs.mount.lib.type = "chroot"
fs.mount.lib.path = "/lib"
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"

# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Bash
fs.mount.lib64.type = "chroot"
fs.mount.lib64.path = "/lib64"
fs.mount.lib64.uri = "file:/lib64"

fs.mount.usr_lib.type = "chroot"
fs.mount.usr_lib.path = "/usr/lib"
fs.mount.usr_lib.uri = "file:/usr/lib"

fs.mount.lib2.type = "chroot"
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"

# Mount /bin
fs.mount.bin.type = "chroot"
fs.mount.bin.path = "$(EXECDIR)"
fs.mount.bin.uri = "file:$(EXECDIR)"

# SGX general options

# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
# size must be specified during signing. If the program needs more virtual
# memory than the enclave size, Graphene will not be able to allocate it.
sgx.enclave_size = "256M"

# Set the maximum number of enclave threads. For SGX v1, the number of enclave
# TCSes must be specified during signing, so the application cannot use more
# threads than the number of TCSes. Note that Graphene also creates an internal
# thread for handling inter-process communication (IPC), and potentially another
# thread for asynchronous events. Therefore, the actual number of threads that
# the application can create is (sgx.thread_num - 2).
sgx.thread_num = 4

# SGX trusted files

sgx.trusted_files.bash = "file:$(EXECDIR)/bash"
sgx.trusted_files.ls = "file:$(EXECDIR)/ls"
sgx.trusted_files.cat = "file:$(EXECDIR)/cat"
sgx.trusted_files.rm = "file:$(EXECDIR)/rm"
sgx.trusted_files.cp = "file:$(EXECDIR)/cp"
sgx.trusted_files.date = "file:$(EXECDIR)/date"

# Glibc libraries
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
sgx.trusted_files.libutil = "file:$(GRAPHENEDIR)/Runtime/libutil.so.1"
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"

# Name Service Switch (NSS) libraries (Glibc dependencies)
sgx.trusted_files.libnsscompat = "file:$(ARCH_LIBDIR)/libnss_compat.so.2"
sgx.trusted_files.libnssfiles = "file:$(ARCH_LIBDIR)/libnss_files.so.2"
sgx.trusted_files.libnssnis = "file:$(ARCH_LIBDIR)/libnss_nis.so.2"

sgx.allowed_files.scripts = "file:scripts"

sgx.nonpie_binary = 1