mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-05 13:21:37 +00:00
borysp
c24bddd5aa
Change log (most important only):
- unify CPU context structures - now we have only one version -
`PAL_CONTEXT` - which is shared between LibOS and PALs and it should
depend only on the host architecture (not OS),
- syscalls emulation changed:
- dedicated LibOS stack is now used for syscalls emulation,
- removed one indirection level in syscalls table - now it stores
`shim_do_*` functions directly,
- signal handling - completely rewritten:
- all signal queues use proper locking schemes now,
- signals are handled *only* when returning to the user app from LibOS
or PAL,
- nested signals are now possible,
- the app is allowed to jump out of signal handler with the same
sematics as on normal Linux,
- signal altstack is now fully supported,
- syscall restarting is now supported,
- doing a backtrace from the signal handler works properly,
- disallow injecting host-level signals, with one exception, see
`sys.enable_sigterm_injection` manifest option for more details.
105 lines
3.7 KiB
Plaintext
105 lines
3.7 KiB
Plaintext
# R manifest example
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 16.04.
|
|
|
|
libos.entrypoint = "file:$(R_EXEC)"
|
|
|
|
# Path to the library OS
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
|
|
# Graphene log level
|
|
loader.log_level = "$(GRAPHENE_LOG_LEVEL)"
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
# Allow for injecting SIGTERM signal from the host.
|
|
sys.enable_sigterm_injection = 1
|
|
|
|
# Environment variables for R
|
|
loader.env.LD_LIBRARY_PATH = "$(R_HOME)/lib:/lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR)"
|
|
loader.env.PATH = "$(R_HOME)/bin:/usr/bin:/bin"
|
|
loader.env.USERNAME = ""
|
|
loader.env.HOME = ""
|
|
loader.env.PWD = ""
|
|
loader.env.R_ARCH = ""
|
|
loader.env.R_HOME = "$(R_HOME)"
|
|
|
|
# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the guest. Other parts
|
|
# of the host FS will not be available in the guest.
|
|
|
|
# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by the R executable
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
# Host-level directory (/usr) required by the R executable
|
|
fs.mount.usr.type = "chroot"
|
|
fs.mount.usr.path = "/usr"
|
|
fs.mount.usr.uri = "file:/usr"
|
|
|
|
# Mount $R_HOME
|
|
fs.mount.r_home.type = "chroot"
|
|
fs.mount.r_home.path = "$(R_HOME)"
|
|
fs.mount.r_home.uri = "file:$(R_HOME)"
|
|
|
|
# Mount /tmp
|
|
fs.mount.tmp.type = "chroot"
|
|
fs.mount.tmp.path = "/tmp"
|
|
fs.mount.tmp.uri = "file:/tmp"
|
|
|
|
# Mount host's /bin
|
|
fs.mount.bin.type = "chroot"
|
|
fs.mount.bin.path = "/bin"
|
|
fs.mount.bin.uri = "file:/bin"
|
|
|
|
# Workload `scripts/R-benchmark-25.R` requires large stack
|
|
sys.stack.size = "8M"
|
|
|
|
# SGX general options
|
|
|
|
sgx.nonpie_binary = 1
|
|
|
|
# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave size must be specified
|
|
# during signing. If R needs more virtual memory than the enclave size, Graphene will not be able to
|
|
# allocate it.
|
|
sgx.enclave_size = "1G"
|
|
|
|
# Set the maximum number of enclave threads. For SGX v1, the number of enclave TCSes must be
|
|
# specified during signing, so the application cannot use more threads than the number of TCSes.
|
|
# Note that Graphene also creates an internal thread for handling inter-process communication (IPC),
|
|
# and potentially another thread for asynchronous events. Therefore, the actual number of threads
|
|
# that the application can create is (sgx.thread_num - 2).
|
|
sgx.thread_num = 4
|
|
|
|
# SGX trusted files
|
|
|
|
sgx.trusted_files.r = "file:$(R_EXEC)"
|
|
# Glibc libraries
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
|
|
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
|
|
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Other libraries as dependencies of R
|
|
sgx.trusted_files.stats_lib = "file:$(R_HOME)/library/stats/libs/stats.so"
|
|
sgx.trusted_files.lapack = "file:$(R_HOME)/modules/lapack.so"
|
|
|
|
# SGX untrusted (allowed) files/directories
|
|
sgx.allowed_files.scripts = "file:scripts"
|
|
sgx.allowed_files.tmp = "file:/tmp"
|
|
sgx.allowed_files.r_etc = "file:$(R_HOME)/etc"
|
|
sgx.allowed_files.r_lib = "file:$(R_HOME)/library"
|
|
|
|
# R uses shell to delete files, so we need to allow /bin/sh and /bin/rm to be accessed.
|
|
# strace snippet: execve("/bin/sh", ["sh", "-c", "rm -rf /tmp/RtmpEiedDF"], [/* 41 vars */])
|
|
sgx.trusted_files.rm = "file:/bin/rm"
|
|
sgx.trusted_files.sh = "file:/bin/sh"
|