mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-06 05:41:37 +00:00
Michał Kowalczyk
3d31f2d18d
This is the next part of the great loader rework, with a lot of breaking changes: - Complete removal of the "trusted children" thing - now children processes can be spawned arbitrarily and from arbitrary mountpoint types, without any additional configuration needed. - There's a new, required option in the manifest: `libos.entrypoint` - it specifies the URI to the entry binary in the first process. There's no need anymore to name the manifest and the first binary identically. - On SGX, the main binary is not measured in MRENCLAVE anymore - only PAL, LibOS and the manifest are measured. This is enough to bind MRENCLAVE to a specific entrypoint user executable if wanted - it just has to be mounted as a trusted file. - All Graphene SGX enclaves have now exactly the same MRENCLAVE. This is a hash of a "Graphene stub", which can "fork" into one of two states in runtime: initial process or child. The initial process creates a new "Graphene namespace" with a clean state, it can also be attested remotely (contrary to child processes). The initial process can spawn children processes by spawning a Graphene stub and directing it to start in the child mode. It then attests it locally, and if successful, establishes an encrypted pipe, "connects" to its own namespace and treats as trusted (including sending protected files key). - Now, there's only one, central manifest describing the initial state of a Graphene instance which can be spawned from it (previously, each process required a separate manifest which could have different configuration - which wasn't actually supported and didn't make sense design-wise). One downside of central manifests is that all processes require the same enclave configuration (e.g. size), but that was already the case so far because of broken checkpointing code. Also, this is only a temporary problem, which will cease to exist after the introduction of EDMM. - `sgx.static_address` was renamed to `sgx.nonpie_binary` and now has to be inserted manually by users (`sgx_sign` tools doesn't know about the binaries run inside, which can be even provided or generated in runtime by the user's workload). - Caveat: the memory gap for non-PIE executables was removed because it requires adding a new option to the manifest to be cleanly implemented. This is left for some future loader rework PR.
126 lines
4.6 KiB
Makefile
126 lines
4.6 KiB
Makefile
# Build Redis as follows:
|
|
#
|
|
# - make -- create non-SGX no-debug-log manifest
|
|
# - make SGX=1 -- create SGX no-debug-log manifest
|
|
# - make SGX=1 DEBUG=1 -- create SGX debug-log manifest
|
|
#
|
|
# Any of these invocations clones Redis' git repository and builds Redis in
|
|
# default configuration and in the latest-to-date (5.0.5) version.
|
|
#
|
|
# By default, Redis uses poll/epoll mechanism of Linux. To build Redis with
|
|
# select, use `make USE_SELECT=1`. For correct re-builds, always clean up
|
|
# Redis source code beforehand via `make distclean`.
|
|
#
|
|
# Use `make clean` to remove Graphene-generated files and `make distclean` to
|
|
# additionally remove the cloned Redis git repository.
|
|
|
|
################################# CONSTANTS ###################################
|
|
|
|
# Relative path to Graphene root
|
|
GRAPHENEDIR = ../..
|
|
SGX_SIGNER_KEY ?= $(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/enclave-key.pem
|
|
|
|
SRCDIR = src
|
|
COMMIT = 6.0.5
|
|
TAR_SHA256 = f7ded6c27d48c20bc78e797046c79b6bc411121f0c2d7eead9fea50d6b0b6290
|
|
|
|
ifeq ($(DEBUG),1)
|
|
GRAPHENEDEBUG = inline
|
|
else
|
|
GRAPHENEDEBUG = none
|
|
endif
|
|
|
|
.PHONY: all
|
|
all: redis-server redis-server.manifest pal_loader
|
|
ifeq ($(SGX),1)
|
|
all: redis-server.manifest.sgx redis-server.sig redis-server.token
|
|
endif
|
|
|
|
include ../../Scripts/Makefile.configs
|
|
|
|
############################## REDIS EXECUTABLE ###############################
|
|
|
|
# Redis is built as usual, without any changes to the build process (except to
|
|
# test select syscall instead of poll/epoll). The source is downloaded from the
|
|
# GitHub repo (5.0.5 tag) and built via `make`. The result of this build process
|
|
# is the final executable "src/redis-server".
|
|
|
|
$(SRCDIR)/Makefile:
|
|
$(GRAPHENEDIR)/Scripts/download --output redis.tar.gz \
|
|
--sha256 $(TAR_SHA256) \
|
|
--url https://github.com/antirez/redis/archive/$(COMMIT).tar.gz
|
|
mkdir $(SRCDIR)
|
|
tar -C $(SRCDIR) --strip-components=1 -xf redis.tar.gz
|
|
|
|
ifeq ($(USE_SELECT),1)
|
|
$(SRCDIR)/src/redis-server: $(SRCDIR)/Makefile
|
|
sed -i 's|#define HAVE_EPOLL 1|/* no HAVE_EPOLL */|g' src/src/config.h
|
|
$(MAKE) -C $(SRCDIR)
|
|
else
|
|
$(SRCDIR)/src/redis-server: $(SRCDIR)/Makefile
|
|
$(MAKE) -C $(SRCDIR)
|
|
endif
|
|
|
|
################################ REDIS MANIFEST ###############################
|
|
|
|
# The template file contains almost all necessary information to run Redis
|
|
# under Graphene / Graphene-SGX. We create redis.manifest (to be run under
|
|
# non-SGX Graphene) by simply replacing variables in the template file via sed.
|
|
|
|
redis-server.manifest: redis-server.manifest.template
|
|
sed -e 's|$$(GRAPHENEDIR)|'"$(GRAPHENEDIR)"'|g' \
|
|
-e 's|$$(GRAPHENEDEBUG)|'"$(GRAPHENEDEBUG)"'|g' \
|
|
-e 's|$$(ARCH_LIBDIR)|'"$(ARCH_LIBDIR)"'|g' \
|
|
$< > $@
|
|
|
|
# Manifest for Graphene-SGX requires special "pal-sgx-sign" procedure. This procedure measures all
|
|
# Redis trusted files, adds the measurement to the resulting manifest.sgx file (among other,
|
|
# less important SGX options) and creates redis-server.sig (SIGSTRUCT object).
|
|
#
|
|
# Graphene-SGX requires EINITTOKEN and SIGSTRUCT objects (see SGX hardware ABI, in particular EINIT
|
|
# instruction). The "pal-sgx-get-token" script generates EINITTOKEN based on a SIGSTRUCT and puts it
|
|
# in .token file. Note that filenames must be the same as the manifest name (i.e., "redis-server").
|
|
# EINITTOKEN must be generated on the machine where the application will run, not where it was
|
|
# built.
|
|
|
|
redis-server.sig redis-server.manifest.sgx &: redis-server.manifest $(SRCDIR)/src/redis-server
|
|
$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-sign \
|
|
-libpal $(GRAPHENEDIR)/Runtime/libpal-Linux-SGX.so \
|
|
-key $(SGX_SIGNER_KEY) \
|
|
-manifest redis-server.manifest \
|
|
-output redis-server.manifest.sgx
|
|
|
|
redis-server.token: redis-server.sig
|
|
$(GRAPHENEDIR)/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output $@ -sig $<
|
|
|
|
########################### COPIES OF EXECUTABLES #############################
|
|
|
|
# Redis build process creates the final executable as src/redis-server. For
|
|
# simplicity, copy it into our root directory.
|
|
# Also, create a link to pal_loader for simplicity.
|
|
|
|
redis-server: $(SRCDIR)/src/redis-server
|
|
cp $< $@
|
|
|
|
pal_loader:
|
|
ln -s $(GRAPHENEDIR)/Runtime/pal_loader $@
|
|
|
|
############################## RUNNING TESTS ##################################
|
|
.PHONY: start-native-server
|
|
start-native-server: all
|
|
./redis-server --save '' --protected-mode no
|
|
|
|
.PHONY: start-graphene-server
|
|
start-graphene-server: all
|
|
./pal_loader redis-server --save '' --protected-mode no
|
|
|
|
################################## CLEANUP ####################################
|
|
|
|
.PHONY: clean
|
|
clean:
|
|
$(RM) *.token *.sig *.manifest.sgx *.manifest pal_loader redis-server *.rdb
|
|
|
|
.PHONY: distclean
|
|
distclean: clean
|
|
$(RM) -r $(SRCDIR) redis.tar.gz
|