mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-05 13:21:37 +00:00
Michał Kowalczyk
6c7ff2d3a6
We decided to merge the sample app integrations submodule back because working with git submodules turned out to be really painful. The only blocker for this was the fact, that previously it contained a lot of binary blobs and copy-pasted sources, but this was cleaned up recently. Credits: (authors of particular integration examples, extracted from commits and PR history in https://github.com/oscarlab/graphene-tests) apache: Chia-Che Tsai <chiache@tamu.edu>, Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> bash: Chia-Che Tsai <chiache@tamu.edu>, Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> blender: borysp <borysp@invisiblethingslab.com> busybox: borysp <borysp@invisiblethingslab.com> capnproto: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> curl: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> gcc: Thomas Knauth <thomas.knauth@intel.com> lighttpd: Chia-Che Tsai <chiache@tamu.edu>, Thomas Knauth <thomas.knauth@intel.com> lmbench: Chia-Che Tsai <chiache@tamu.edu> memcached: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> nginx: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> nodejs: jack.wxz <jack.wxz@alibaba-inc.com> nodejs-express-server: Eduardo Rodriguez <erodrig@us.ibm.com> openvino: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> python-scipy-insecure: Chia-Che Tsai <chiache@tamu.edu>, Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> python-simple: Chia-Che Tsai <chiache@tamu.edu>, Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> pytorch: Thomas Knauth <thomas.knauth@intel.com> r: Chia-Che Tsai <chiache@tamu.edu> redis: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com> tensorflow: Thomas Knauth <thomas.knauth@intel.com> LTP was moved to LibOS/shim/test/ltp. It was recently rewritten by Wojtek Porczyk <woju@invisiblethingslab.com>.
58 lines
1.8 KiB
Markdown
58 lines
1.8 KiB
Markdown
# Python example
|
|
|
|
This directory contains an example for running Python 3 with SciPy/NumPy in Graphene,
|
|
including the Makefile and a template for generating the manifest. The application is
|
|
tested on Ubuntu 16.04, with both normal Linux and SGX platforms.
|
|
|
|
This example is *insecure*: the manifest file uses `sgx.allowed_files` to allow all
|
|
Python libraries/scripts without any integrity checks. This example simply shows
|
|
the functionality of Graphene but *does not* prevent the attacker from silently
|
|
modifying Python files. For secure Python usage, see the `python-simple` example.
|
|
|
|
# Generating the manifest
|
|
|
|
## Installing prerequisites
|
|
|
|
For generating the manifest and running the test scripts, please run the following
|
|
command to install the required Python packages (Ubuntu-specific):
|
|
|
|
sudo apt-get install libnss-mdns python3-numpy python3-scipy
|
|
|
|
## Building for Linux
|
|
|
|
Run `make` (non-debug) or `make DEBUG=1` (debug) in the directory.
|
|
|
|
## Building for SGX
|
|
|
|
Run `make SGX=1` (non-debug) or `make SGX=1 DEBUG=1` (debug) in the directory.
|
|
|
|
## Building with a local Python installation
|
|
|
|
By default, the `make` command creates the manifest for the Python binary from
|
|
the system installation. If you have a local installation, you may create the
|
|
manifest with the `PYTHONPATH` variable set accordingly. You can also specify
|
|
a particular version of Python. For example:
|
|
|
|
```
|
|
make PYTHONPATH=<python install path> PYTHONVERSION=python3.2 SGX=1
|
|
```
|
|
|
|
By default, `PYTHONPATH=/usr` and `PYTHONVERSION=python3.5`.
|
|
|
|
|
|
# Run Python with Graphene
|
|
|
|
Here's an example of running Python scripts under Graphene:
|
|
|
|
Without SGX:
|
|
```
|
|
./pal_loader python.manifest scripts/test-numpy.py
|
|
./pal_loader python.manifest scripts/test-scipy.py
|
|
```
|
|
|
|
With SGX:
|
|
```
|
|
SGX=1 ./pal_loader python.manifest scripts/test-numpy.py
|
|
SGX=1 ./pal_loader python.manifest scripts/test-scipy.py
|
|
```
|