mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-05 21:31:36 +00:00
borysp
c24bddd5aa
Change log (most important only):
- unify CPU context structures - now we have only one version -
`PAL_CONTEXT` - which is shared between LibOS and PALs and it should
depend only on the host architecture (not OS),
- syscalls emulation changed:
- dedicated LibOS stack is now used for syscalls emulation,
- removed one indirection level in syscalls table - now it stores
`shim_do_*` functions directly,
- signal handling - completely rewritten:
- all signal queues use proper locking schemes now,
- signals are handled *only* when returning to the user app from LibOS
or PAL,
- nested signals are now possible,
- the app is allowed to jump out of signal handler with the same
sematics as on normal Linux,
- signal altstack is now fully supported,
- syscall restarting is now supported,
- doing a backtrace from the signal handler works properly,
- disallow injecting host-level signals, with one exception, see
`sys.enable_sigterm_injection` manifest option for more details.
184 lines
8.7 KiB
Plaintext
184 lines
8.7 KiB
Plaintext
# Memcached manifest file example
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 18.04.
|
|
|
|
################################## RUNNING ####################################
|
|
|
|
# Memcached must be run with the --user=<existing-user-name> argument:
|
|
#
|
|
# ./pal_loader ./memcached --user=nobody
|
|
#
|
|
# User argument is required because Graphene currently emulates real/effective
|
|
# user ID as 0 (root). This leads Memcached to believe it is run under root. For
|
|
# security reasons, Memcached drops privileges and assumes non-privileged user
|
|
# ID which must be specified as command-line argument. The assumed user ID is
|
|
# irrelevant for consequent Memcached execution, so it may be any existing
|
|
# host-OS username (e.g. "nobody" or even "root").
|
|
|
|
################################## GRAPHENE ###################################
|
|
|
|
# LibOS layer library of Graphene. There is currently only one implementation,
|
|
# so it is always set to libsysdb.so. Note that GRAPHENEDIR macro is expanded
|
|
# to relative path to Graphene repository in the Makefile as part of the
|
|
# build process.
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
|
|
# Binary to run.
|
|
libos.entrypoint = "file:memcached"
|
|
|
|
# Verbosity of Graphene debug log (none/error/warning/debug/trace/all). Note
|
|
# that GRAPHENE_LOG_LEVEL macro is expanded in the Makefile as part of the
|
|
# building process: the default is "error" for non-debug builds, and "debug"
|
|
# for debug builds.
|
|
loader.log_level = "$(GRAPHENE_LOG_LEVEL)"
|
|
|
|
################################# ARGUMENTS ###################################
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
################################# ENV VARS ####################################
|
|
|
|
# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
|
|
# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
|
|
# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
|
|
#
|
|
# In case of Memcached:
|
|
# - /lib is searched for Glibc libraries (ld, libc, libpthread)
|
|
# - $(ARCH_LIBDIR) is searched for Name Service Switch (NSS) libraries
|
|
# - /usr/$(ARCH_LIBDIR) is searched for libevent (the only explicit
|
|
# Memcached dependency)
|
|
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR)"
|
|
|
|
# All other environment variables are unset. This is the default Graphene
|
|
# behavior. Memcached doesn't require any environment variables to be set.
|
|
|
|
################################## SIGNALS ####################################
|
|
|
|
# Allow for injecting SIGTERM signal from the host.
|
|
sys.enable_sigterm_injection = 1
|
|
|
|
################################# MOUNT FS ###################################
|
|
|
|
# General notes:
|
|
# - There is only one supported type of mount points: "chroot".
|
|
# - Directory names are (somewhat confusingly) prepended by "file:".
|
|
# - Names of mount entries (lib, lib2, lib3) are irrelevant but must be unique.
|
|
# - In-Graphene visible path names may be arbitrary but we reuse host-OS URIs
|
|
# for simplicity (except for the first "lib" case).
|
|
|
|
# Mount host-OS directory to Graphene glibc/runtime libraries (in "uri") into
|
|
# in-Graphene visible directory /lib (in "path"). Note that GRAPHENEDIR macro
|
|
# is expanded to relative path to Graphene repository in the Makefile as part
|
|
# of the build process.
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
# Mount host-OS directory to Name Service Switch (NSS) libraries (in "uri")
|
|
# into in-Graphene visible directory e.g., /lib/x86_64-linux-gnu (in "path").
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
# Mount host-OS directory to libevent lib required by Memcached (in "uri")
|
|
# into in-Graphene visible directory e.g., /usr/lib/x86_64-linux-gnu (in "path").
|
|
fs.mount.lib3.type = "chroot"
|
|
fs.mount.lib3.path = "/usr/$(ARCH_LIBDIR)"
|
|
fs.mount.lib3.uri = "file:/usr/$(ARCH_LIBDIR)"
|
|
|
|
# Mount host-OS directory to NSS files required by Glibc + NSS libs (in "uri")
|
|
# into in-Graphene visible directory /etc (in "path").
|
|
fs.mount.etc.type = "chroot"
|
|
fs.mount.etc.path = "/etc"
|
|
fs.mount.etc.uri = "file:/etc"
|
|
|
|
############################### SGX: GENERAL ##################################
|
|
|
|
# Set enclave size (somewhat arbitrarily) to 1024MB. Recall that SGX v1 requires
|
|
# to specify enclave size at enclave creation time. If Memcached exhausts these
|
|
# 1024MB then it will start failing with random errors. Greater enclave sizes
|
|
# result in longer startup times, smaller enclave sizes are not enough for
|
|
# typical Memcached workloads.
|
|
#
|
|
# NOTE: Memcached does not fail explicitly when enclave memory is exhausted.
|
|
# Instead, Memcached goes into infinite loop without a listening socket. You
|
|
# can trigger this incorrect behavior by increasing the number of threads
|
|
# to 12 (each thread requires 128MB of memory): `memcached -t 12`. This is
|
|
# an issue in Memcached source code, not related to Graphene.
|
|
sgx.enclave_size = "1024M"
|
|
|
|
sgx.nonpie_binary = 1
|
|
|
|
# Set maximum number of in-enclave threads (somewhat arbitrarily) to 16. Recall
|
|
# that SGX v1 requires to specify the maximum number of simulteneous threads at
|
|
# enclave creation time. If Memcached spawns more threads, Graphene-SGX fails.
|
|
#
|
|
# Note that internally Graphene may spawn two additional threads, one for IPC
|
|
# and one for asynchronous events/alarms. Memcached spawns an additional main
|
|
# thread which sits idle after spawning worker threads. Therefore, specifying
|
|
# '16' allows to run a maximum of 13 Memcached threads (`--threads <= 13`).
|
|
sgx.thread_num = 16
|
|
|
|
############################# SGX: TRUSTED FILES ###############################
|
|
|
|
# Specify all files used by Memcached and its dependencies (including all
|
|
# libraries which can be loaded at runtime via dlopen). The paths to files
|
|
# are host-OS paths. These files will be searched for in in-Graphene visible
|
|
# paths according to mount points above.
|
|
#
|
|
# As part of the build process, Graphene-SGX script (`pal-sgx-sign`) finds each
|
|
# specified file, measures its hash, and outputs the hash in auto-generated
|
|
# entry 'sgx.trusted_checksum.xxx' in auto-generated memcached.manifest.sgx.
|
|
# Note that this happens on the developer machine or a build server.
|
|
#
|
|
# At runtime, during loading of each "trusted file", Graphene-SGX measures its hash
|
|
# and compares with the one specified in 'sgx.trusted_checksum.xxx'. If hashes
|
|
# match, this file is trusted and allowed to be loaded and used. Note that
|
|
# this happens on the client machine.
|
|
|
|
|
|
sgx.trusted_files.memcached = "file:memcached"
|
|
|
|
# Glibc libraries. ld and libc are needed for all apps; pthread is needed
|
|
# because Memcached is multi-threaded.
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Name Service Switch (NSS) libraries. Glibc calls these libraries as part of
|
|
# name-service information gathering. libnss_{compat,files,nis} are the
|
|
# most widely used libraries, at least on Ubuntu.
|
|
# For more info, see 'man nsswitch.conf'.
|
|
sgx.trusted_files.libnsscompat = "file:$(ARCH_LIBDIR)/libnss_compat.so.2"
|
|
sgx.trusted_files.libnssfiles = "file:$(ARCH_LIBDIR)/libnss_files.so.2"
|
|
sgx.trusted_files.libnssnis = "file:$(ARCH_LIBDIR)/libnss_nis.so.2"
|
|
|
|
# libNSL is a dependency of libnss_compat above. It is a good example of nested
|
|
# library dependencies required by Graphene-SGX.
|
|
sgx.trusted_files.libnsl = "file:$(ARCH_LIBDIR)/libnsl.so.1"
|
|
|
|
# libEvent is an explicit dependency of Memcached. We choose to install it on
|
|
# host OS instead of downloading the sources, building, and linking Memcached
|
|
# against the built library (which is possible but would require more effort).
|
|
# [Ubuntu16.04] sgx.trusted_files.libevent = "file:/usr/$(ARCH_LIBDIR)/libevent-2.0.so.5"
|
|
# [Ubuntu18.04] sgx.trusted_files.libevent = "file:/usr/$(ARCH_LIBDIR)/libevent-2.1.so.6"
|
|
|
|
############################# SGX: ALLOWED FILES ###############################
|
|
|
|
# Specify all non-static files used by app. These files may be opened by
|
|
# Graphene-SGX but modifications to them are not detected (Graphene-SGX does
|
|
# not measure their hashes). This may pose a security risk!
|
|
|
|
# Name Service Switch (NSS) files. Glibc reads these files as part of name-
|
|
# service information gathering. For more info, see 'man nsswitch.conf'.
|
|
sgx.allowed_files.nsswitch = "file:/etc/nsswitch.conf"
|
|
sgx.allowed_files.ethers = "file:/etc/ethers"
|
|
sgx.allowed_files.hosts = "file:/etc/hosts"
|
|
sgx.allowed_files.group = "file:/etc/group"
|
|
sgx.allowed_files.passwd = "file:/etc/passwd"
|
|
|
|
# getaddrinfo(3) configuration file. Glibc reads this file to correctly find
|
|
# network addresses. For more info, see 'man gai.conf'.
|
|
sgx.allowed_files.gaiconf = "file:/etc/gai.conf"
|