mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-04 21:01:40 +00:00
Stefan Berger
dfb7743d41
On Ubuntu 'which' finds 'cp' in '/bin/cp' and on Fedora in '/usr/bin/cp'. Rather than hard-coding the path '/bin', use $(EXECDIR) and derive its value from the dirname of the path of the executable, i.e., either '/bin' or '/usr/bin'.
81 lines
3.1 KiB
Plaintext
81 lines
3.1 KiB
Plaintext
# This is a general manifest template for running Bash and core utility programs,
|
|
# including ls, cat, cp, date, and rm.
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 16.04.
|
|
|
|
# The executable to load in Graphene. We replace EXECPATH and EXECNAME for
|
|
# each program that a manifest is generated for.
|
|
loader.exec = file:$(EXECPATH)
|
|
loader.execname = file:$(EXECNAME)
|
|
|
|
# Graphene environment, including the path of the library OS and the debug
|
|
# option (inline/none).
|
|
loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
|
|
loader.debug_type = $(GRAPHENEDEBUG)
|
|
|
|
# Environment variables
|
|
loader.env.LD_LIBRARY_PATH = /lib:$(ARCH_LIBDIR)
|
|
|
|
# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
|
|
# guest. Other parts of the host FS will not be available in the guest.
|
|
|
|
# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
|
|
fs.mount.lib.type = chroot
|
|
fs.mount.lib.path = /lib
|
|
fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
|
|
|
|
# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Bash
|
|
fs.mount.lib2.type = chroot
|
|
fs.mount.lib2.path = $(ARCH_LIBDIR)
|
|
fs.mount.lib2.uri = file:$(ARCH_LIBDIR)
|
|
|
|
# Mount /bin
|
|
fs.mount.bin.type = chroot
|
|
fs.mount.bin.path = $(EXECDIR)
|
|
fs.mount.bin.uri = file:$(EXECDIR)
|
|
|
|
# SGX general options
|
|
|
|
# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
|
|
# size must be specified during signing. If the program needs more virtual
|
|
# memory than the enclave size, Graphene will not be able to allocate it.
|
|
sgx.enclave_size = 256M
|
|
|
|
# Set the maximum number of enclave threads. For SGX v1, the number of enclave
|
|
# TCSes must be specified during signing, so the application cannot use more
|
|
# threads than the number of TCSes. Note that Graphene also creates an internal
|
|
# thread for handling inter-process communication (IPC), and potentially another
|
|
# thread for asynchronous events. Therefore, the actual number of threads that
|
|
# the application can create is (sgx.thread_num - 2).
|
|
sgx.thread_num = 4
|
|
|
|
# SGX trusted libraries
|
|
|
|
# Glibc libraries
|
|
sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
|
|
sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
|
|
sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
|
|
sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
|
|
sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
|
|
sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
|
|
sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
|
|
|
|
# Name Service Switch (NSS) libraries (Glibc dependencies)
|
|
sgx.trusted_files.libnsscompat = file:$(ARCH_LIBDIR)/libnss_compat.so.2
|
|
sgx.trusted_files.libnssfiles = file:$(ARCH_LIBDIR)/libnss_files.so.2
|
|
sgx.trusted_files.libnssnis = file:$(ARCH_LIBDIR)/libnss_nis.so.2
|
|
|
|
# Additional libs opened by Bash at runtime
|
|
sgx.trusted_files.libselinux1 = file:$(ARCH_LIBDIR)/libselinux.so.1
|
|
sgx.trusted_files.libpcre = file:$(ARCH_LIBDIR)/libpcre.so.3
|
|
sgx.trusted_files.libacl = file:$(ARCH_LIBDIR)/libacl.so.1
|
|
sgx.trusted_files.libattr = file:$(ARCH_LIBDIR)/libattr.so.1
|
|
|
|
# Other required libraries
|
|
$(TRUSTED_LIBS)
|
|
|
|
# Signatures of child enclaves
|
|
$(TRUSTED_CHILDREN)
|
|
|
|
sgx.allowed_files.scripts = file:scripts
|