mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-05 13:21:37 +00:00
169 lines
8.0 KiB
Plaintext
169 lines
8.0 KiB
Plaintext
# Redis manifest file example
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 16.04.
|
|
|
|
################################## GRAPHENE ###################################
|
|
|
|
# LibOS layer library of Graphene. There is currently only one implementation,
|
|
# so it is always set to libsysdb.so. Note that GRAPHENEDIR macro is expanded
|
|
# to relative path to Graphene repository in the Makefile as part of the
|
|
# build process.
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
libos.entrypoint = "file:redis-server"
|
|
|
|
# Verbosity of Graphene debug log (none/error/warning/debug/trace/all). Note
|
|
# that GRAPHENE_LOG_LEVEL macro is expanded in the Makefile as part of the
|
|
# building process: the default is "error" for non-debug builds, and "debug"
|
|
# for debug builds.
|
|
loader.log_level = "$(GRAPHENE_LOG_LEVEL)"
|
|
|
|
################################# ARGUMENTS ###################################
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
################################# ENV VARS ####################################
|
|
|
|
# Specify paths to search for libraries. The usual LD_LIBRARY_PATH syntax
|
|
# applies. Paths must be in-Graphene visible paths, not host-OS paths (i.e.,
|
|
# paths must be taken from fs.mount.xxx.path, not fs.mount.xxx.uri).
|
|
#
|
|
# In case of Redis:
|
|
# - /lib is searched for Glibc libraries (ld, libc, libpthread)
|
|
# - $(ARCH_LIBDIR) is searched for Name Service Switch (NSS) libraries
|
|
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR):/usr/$(ARCH_LIBDIR)"
|
|
|
|
################################## SIGNALS ####################################
|
|
|
|
# Allow for injecting SIGTERM signal from the host.
|
|
sys.enable_sigterm_injection = 1
|
|
|
|
################################# MOUNT FS ###################################
|
|
|
|
# General notes:
|
|
# - There is only one supported type of mount points: 'chroot'.
|
|
# - Directory names are (somewhat confusingly) prepended by 'file:'.
|
|
# - Names of mount entries (lib, lib2, lib3) are irrelevant but must be unique.
|
|
# - In-Graphene visible path names may be arbitrary but we reuse host-OS URIs
|
|
# for simplicity (except for the first 'lib' case).
|
|
|
|
# Mount host-OS directory to Graphene glibc/runtime libraries (in 'uri') into
|
|
# in-Graphene visible directory /lib (in 'path'). Note that GRAPHENEDIR macro
|
|
# is expanded to relative path to Graphene repository in the Makefile as part
|
|
# of the build process.
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
# Mount host-OS directory to Name Service Switch (NSS) libraries (in 'uri')
|
|
# into in-Graphene visible directory /lib/x86_64-linux-gnu (in 'path').
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
fs.mount.lib3.type = "chroot"
|
|
fs.mount.lib3.path = "/usr/$(ARCH_LIBDIR)"
|
|
fs.mount.lib3.uri = "file:/usr/$(ARCH_LIBDIR)"
|
|
|
|
# Mount host-OS directory to NSS files required by Glibc + NSS libs (in 'uri')
|
|
# into in-Graphene visible directory /etc (in 'path').
|
|
fs.mount.etc.type = "chroot"
|
|
fs.mount.etc.path = "/etc"
|
|
fs.mount.etc.uri = "file:/etc"
|
|
|
|
############################### SGX: GENERAL ##################################
|
|
|
|
# Set enclave size (somewhat arbitrarily) to 1024MB. Recall that SGX v1 requires
|
|
# to specify enclave size at enclave creation time. If Redis exhausts these
|
|
# 1024MB then it will start failing with random errors. Greater enclave sizes
|
|
# result in longer startup times, smaller enclave sizes are not enough for
|
|
# typical Redis workloads.
|
|
sgx.enclave_size = "1024M"
|
|
|
|
sgx.nonpie_binary = 1
|
|
|
|
# Set maximum number of in-enclave threads (somewhat arbitrarily) to 8. Recall
|
|
# that SGX v1 requires to specify the maximum number of simulteneous threads at
|
|
# enclave creation time.
|
|
#
|
|
# Note that internally Graphene may spawn two additional threads, one for IPC
|
|
# and one for asynchronous events/alarms. Redis is technically single-threaded
|
|
# but spawns couple additional threads to do background bookkeeping. Therefore,
|
|
# specifying '8' allows to run a maximum of 6 Redis threads which is enough.
|
|
sgx.thread_num = 8
|
|
|
|
############################# SGX: TRUSTED FILES ###############################
|
|
|
|
# Specify all files used by Redis and its dependencies (including all
|
|
# libraries which can be loaded at runtime via dlopen). The paths to files
|
|
# are host-OS paths. These files will be searched for in in-Graphene visible
|
|
# paths according to mount points above.
|
|
#
|
|
# As part of the build process, Graphene-SGX script (`pal-sgx-sign`) finds each
|
|
# specified file, measures its hash, and outputs the hash in auto-generated
|
|
# entry 'sgx.trusted_checksum.xxx' in auto-generated redis-server.manifest.sgx.
|
|
# Note that this happens on the developer machine or a build server.
|
|
#
|
|
# At runtime, during loading of each "trusted file", Graphene-SGX measures its hash
|
|
# and compares with the one specified in 'sgx.trusted_checksum.xxx'. If hashes
|
|
# match, this file is trusted and allowed to be loaded and used. Note that
|
|
# this happens on the client machine.
|
|
|
|
sgx.trusted_files.redis-server = "file:redis-server"
|
|
|
|
# Glibc libraries. ld, libc, libm, libdl, librt provide common functionality;
|
|
# pthread is needed because Redis spawns helper threads for bookkeeping.
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
|
|
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
|
|
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Name Service Switch (NSS) libraries. Glibc calls these libraries as part of
|
|
# name-service information gathering. libnss_{compat,files,nis} are the
|
|
# most widely used libraries, at least on Ubuntu.
|
|
# For more info, see 'man nsswitch.conf'.
|
|
sgx.trusted_files.libnsscompat = "file:$(ARCH_LIBDIR)/libnss_compat.so.2"
|
|
sgx.trusted_files.libnssfiles = "file:$(ARCH_LIBDIR)/libnss_files.so.2"
|
|
sgx.trusted_files.libnssnis = "file:$(ARCH_LIBDIR)/libnss_nis.so.2"
|
|
|
|
# libNSL is a dependency of libnss_compat above. It is a good example of nested
|
|
# library dependencies required by Graphene-SGX.
|
|
sgx.trusted_files.libnsl = "file:$(ARCH_LIBDIR)/libnsl.so.1"
|
|
|
|
# Additional dependant libraries for redis version 6+
|
|
sgx.trusted_files.libsystemd = "file:$(ARCH_LIBDIR)/libsystemd.so.0"
|
|
sgx.trusted_files.liblzma = "file:$(ARCH_LIBDIR)/liblzma.so.5"
|
|
sgx.trusted_files.libgpgerror = "file:$(ARCH_LIBDIR)/libgpg-error.so.0"
|
|
sgx.trusted_files.liblz4 = "file:/usr/$(ARCH_LIBDIR)/liblz4.so.1"
|
|
# Ubuntu16.04 sgx.trusted_files.libgcrypt = "file:$(ARCH_LIBDIR)/libgcrypt.so.20"
|
|
# Ubuntu18.04 sgx.trusted_files.libgcrypt = "file:$(ARCH_LIBDIR)/libgcrypt.so.20"
|
|
# Ubuntu20.04 sgx.trusted_files.libgcrypt = "file:/usr/$(ARCH_LIBDIR)/libgcrypt.so.20"
|
|
|
|
# Trusted no-library files include configuration files, read-only files, and
|
|
# other static files. It is useful to specify such files here to make sure
|
|
# they are not maliciously modified (modifications will be detected as hash
|
|
# mismatch by Graphene-SGX).
|
|
#
|
|
# Redis by default does not use configuration files, so this section is empty.
|
|
# sgx.trusted_files.config = "file:<important-configuration-file>"
|
|
|
|
############################# SGX: ALLOWED FILES ###############################
|
|
|
|
# Specify all non-static files used by app. These files may be accessed by
|
|
# Graphene-SGX but their integrity is not verified (Graphene-SGX does not
|
|
# measure their hashes). This may pose a security risk!
|
|
|
|
# Name Service Switch (NSS) files. Glibc reads these files as part of name-
|
|
# service information gathering. For more info, see 'man nsswitch.conf'.
|
|
sgx.allowed_files.nsswitch = "file:/etc/nsswitch.conf"
|
|
sgx.allowed_files.ethers = "file:/etc/ethers"
|
|
sgx.allowed_files.hosts = "file:/etc/hosts"
|
|
sgx.allowed_files.group = "file:/etc/group"
|
|
sgx.allowed_files.passwd = "file:/etc/passwd"
|
|
|
|
# getaddrinfo(3) configuration file. Glibc reads this file to correctly find
|
|
# network addresses. For more info, see 'man gai.conf'.
|
|
sgx.allowed_files.gaiconf = "file:/etc/gai.conf"
|