mirror of
https://github.com/clearlinux/graphene.git
synced 2026-09-03 20:31:40 +00:00
Dmitrii Kuvaiskii
8eee4a4742
The manifest syntax stays exactly the same, including 0 and 1 integers to denote boolean values (this is done for ease of porting and can be fixed in future commits). The only visible change is surrounding strings in the manifest with quotes (requirement of TOML). All manifests and Makefiles of our tests and example apps are ported to the new TOML syntax. Documentation is updated.
82 lines
3.2 KiB
Plaintext
82 lines
3.2 KiB
Plaintext
# This is a general manifest template for running Bash and core utility programs,
|
|
# including ls, cat, cp, date, and rm.
|
|
#
|
|
# This manifest was prepared and tested on Ubuntu 16.04.
|
|
|
|
loader.argv0_override = "$(ARGV0_OVERRIDE)"
|
|
|
|
# Read application arguments directly from the command line. Don't use this on production!
|
|
loader.insecure__use_cmdline_argv = 1
|
|
|
|
# Graphene environment, including the path of the library OS and the debug
|
|
# option (inline/none).
|
|
loader.preload = "file:$(GRAPHENEDIR)/Runtime/libsysdb.so"
|
|
loader.debug_type = "$(GRAPHENEDEBUG)"
|
|
|
|
# Environment variables
|
|
loader.env.LD_LIBRARY_PATH = "/lib:$(ARCH_LIBDIR)"
|
|
loader.env.PATH = "/"
|
|
|
|
# Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
|
|
# guest. Other parts of the host FS will not be available in the guest.
|
|
|
|
# Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
|
|
fs.mount.lib.type = "chroot"
|
|
fs.mount.lib.path = "/lib"
|
|
fs.mount.lib.uri = "file:$(GRAPHENEDIR)/Runtime"
|
|
|
|
# Host-level libraries (e.g., /lib/x86_64-linux-gnu) required by Bash
|
|
fs.mount.lib2.type = "chroot"
|
|
fs.mount.lib2.path = "$(ARCH_LIBDIR)"
|
|
fs.mount.lib2.uri = "file:$(ARCH_LIBDIR)"
|
|
|
|
# Mount /bin
|
|
fs.mount.bin.type = "chroot"
|
|
fs.mount.bin.path = "$(EXECDIR)"
|
|
fs.mount.bin.uri = "file:$(EXECDIR)"
|
|
|
|
# SGX general options
|
|
|
|
# Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
|
|
# size must be specified during signing. If the program needs more virtual
|
|
# memory than the enclave size, Graphene will not be able to allocate it.
|
|
sgx.enclave_size = "256M"
|
|
|
|
# Set the maximum number of enclave threads. For SGX v1, the number of enclave
|
|
# TCSes must be specified during signing, so the application cannot use more
|
|
# threads than the number of TCSes. Note that Graphene also creates an internal
|
|
# thread for handling inter-process communication (IPC), and potentially another
|
|
# thread for asynchronous events. Therefore, the actual number of threads that
|
|
# the application can create is (sgx.thread_num - 2).
|
|
sgx.thread_num = 4
|
|
|
|
# SGX trusted libraries
|
|
|
|
# Glibc libraries
|
|
sgx.trusted_files.ld = "file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2"
|
|
sgx.trusted_files.libc = "file:$(GRAPHENEDIR)/Runtime/libc.so.6"
|
|
sgx.trusted_files.libm = "file:$(GRAPHENEDIR)/Runtime/libm.so.6"
|
|
sgx.trusted_files.libdl = "file:$(GRAPHENEDIR)/Runtime/libdl.so.2"
|
|
sgx.trusted_files.librt = "file:$(GRAPHENEDIR)/Runtime/librt.so.1"
|
|
sgx.trusted_files.libutil = "file:$(GRAPHENEDIR)/Runtime/libutil.so.1"
|
|
sgx.trusted_files.libpthread = "file:$(GRAPHENEDIR)/Runtime/libpthread.so.0"
|
|
|
|
# Name Service Switch (NSS) libraries (Glibc dependencies)
|
|
sgx.trusted_files.libnsscompat = "file:$(ARCH_LIBDIR)/libnss_compat.so.2"
|
|
sgx.trusted_files.libnssfiles = "file:$(ARCH_LIBDIR)/libnss_files.so.2"
|
|
sgx.trusted_files.libnssnis = "file:$(ARCH_LIBDIR)/libnss_nis.so.2"
|
|
|
|
# Additional libs opened by Bash at runtime
|
|
sgx.trusted_files.libselinux1 = "file:$(ARCH_LIBDIR)/libselinux.so.1"
|
|
sgx.trusted_files.libpcre = "file:$(ARCH_LIBDIR)/libpcre.so.3"
|
|
sgx.trusted_files.libacl = "file:$(ARCH_LIBDIR)/libacl.so.1"
|
|
sgx.trusted_files.libattr = "file:$(ARCH_LIBDIR)/libattr.so.1"
|
|
|
|
# Other required libraries
|
|
$(TRUSTED_LIBS)
|
|
|
|
# Signatures of child enclaves
|
|
$(TRUSTED_CHILDREN)
|
|
|
|
sgx.allowed_files.scripts = "file:scripts"
|