mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-06 05:41:37 +00:00
Michał Kowalczyk
a12f96f49e
Non-PIE binaries support requires ELRANGE to start at low addresses, which on older SGX drivers required root permissions or reconfiguring the host, so this mapping strategy was made optional by us. This issue was fixed long time ago, so we can drop this option and always start enclaves at 0.
113 lines
4.5 KiB
Plaintext
113 lines
4.5 KiB
Plaintext
# Apache manifest example
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 16.04.
|
|
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
libos.entrypoint = "file:$(INSTALL_DIR)/bin/httpd"
|
|
loader.argv0_override = "httpd"
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
loader.debug_type = "$(GRAPHENEDEBUG)"
|
|
|
|
# Environment variables
|
|
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR):/usr/lib:/usr/$(ARCH_LIBDIR)"
|
|
|
|
# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
|
|
# guest. Other parts of the host FS will not be available in the guest.
|
|
|
|
# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Apache
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
# Host-level directory (/usr) required by Apache (needed for libaprutil-1.so)
|
|
fs.mount.usr.type = "chroot"
|
|
fs.mount.usr.path = "/usr"
|
|
fs.mount.usr.uri = "file:/usr"
|
|
|
|
# Host-level directory (/etc) required by Apache (needed mostly for SSL/TLS)
|
|
fs.mount.etc.type = "chroot"
|
|
fs.mount.etc.path = "/etc"
|
|
fs.mount.etc.uri = "file:/etc"
|
|
|
|
# Mount the current working directory
|
|
fs.mount.cwd.type = "chroot"
|
|
fs.mount.cwd.path = "$(INSTALL_DIR_ABSPATH)"
|
|
fs.mount.cwd.uri = "file:$(INSTALL_DIR)"
|
|
|
|
# SGX general options
|
|
|
|
# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
|
|
# size must be specified during signing. If Apache needs more virtual memory
|
|
# than the enclave size, Graphene will not be able to allocate it.
|
|
sgx.enclave_size = "512M"
|
|
|
|
# Set the maximum number of enclave threads. For SGX v1, the number of enclave
|
|
# TCSes must be specified during signing, so the application cannot use more
|
|
# threads than the number of TCSes. Note that Graphene also creates an internal
|
|
# thread for handling inter-process communication (IPC), and potentially another
|
|
# thread for asynchronous events. Therefore, the actual number of threads that
|
|
# the application can create is (sgx.thread_num - 2).
|
|
#
|
|
# We (somewhat arbitrarily) specify 32 threads since mpm_worker_module can create
|
|
# up to 25 threads/process.
|
|
sgx.thread_num = 32
|
|
|
|
# SGX trusted files
|
|
|
|
sgx.trusted_files.httpd = "file:$(INSTALL_DIR)/bin/httpd"
|
|
|
|
# Glibc libraries
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
|
|
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
|
|
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
|
|
sgx.trusted_files.libutil = "file:$(GRAPHENEDIR)/Runtime/libutil.so.1"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Other libraries required by Apache
|
|
sgx.trusted_files.libgcc_s = "file:$(ARCH_LIBDIR)/libgcc_s.so.1"
|
|
sgx.trusted_files.nss_files = "file:$(ARCH_LIBDIR)/libnss_files.so.2"
|
|
sgx.trusted_files.libnsscompat = "file:$(ARCH_LIBDIR)/libnss_compat.so.2"
|
|
sgx.trusted_files.libnssnis = "file:$(ARCH_LIBDIR)/libnss_nis.so.2"
|
|
sgx.trusted_files.libnsl = "file:$(ARCH_LIBDIR)/libnsl.so.1"
|
|
|
|
# Apache modules and dependencies
|
|
$(HTTPD_TRUSTED_MODS)
|
|
$(HTTPD_TRUSTED_LIBS)
|
|
|
|
# Apache configuration (trusted)
|
|
sgx.trusted_files.conf1 = "file:$(INSTALL_DIR)/conf/httpd-graphene.conf"
|
|
sgx.trusted_files.conf2 = "file:$(INSTALL_DIR)/conf/extra/httpd-ssl-graphene.conf"
|
|
sgx.trusted_files.conf3 = "file:$(INSTALL_DIR)/conf/mime.types"
|
|
|
|
# Apache SSL/TLS files (trusted)
|
|
sgx.trusted_files.server_cert = "file:$(INSTALL_DIR)/conf/server.crt"
|
|
sgx.trusted_files.server_key = "file:$(INSTALL_DIR)/conf/server.key"
|
|
|
|
# Apache HTTP documents (trusted)
|
|
# We only specify those documents used in our tests/benchmarks.
|
|
sgx.trusted_files.htdocs1 = "file:$(INSTALL_DIR)/htdocs/index.html"
|
|
sgx.trusted_files.htdocs2 = "file:$(INSTALL_DIR)/htdocs/random/10K.1.html"
|
|
|
|
# Apache logs directory (untrusted and allowed, since log files are not security-critical)
|
|
sgx.allowed_files.logs = "file:$(INSTALL_DIR)/logs"
|
|
|
|
# Name Service Switch (NSS) files, see 'man nsswitch.conf'
|
|
sgx.allowed_files.nsswitch = "file:/etc/nsswitch.conf"
|
|
sgx.allowed_files.ethers = "file:/etc/ethers"
|
|
sgx.allowed_files.hosts = "file:/etc/hosts"
|
|
sgx.allowed_files.group = "file:/etc/group"
|
|
sgx.allowed_files.passwd = "file:/etc/passwd"
|
|
|
|
# getaddrinfo(3) configuration file, see 'man gai.conf'
|
|
sgx.allowed_files.gaiconf = "file:/etc/gai.conf"
|