Dmitrii Kuvaiskii 0a06c898d4 [Pal/Linux-SGX] Provision wrap key for protected files at runtime ...

This commit adds the ability to provision the wrap (master) key for
protected files at runtime (in contrast to previous approach of
hard-coding `protected_files_key` in the manifest as a temporary
solution). This is achieved as follows:

- New PAL API `DkSetProtectedFilesKey()` is added.
- New writable pseudo-file `/dev/attestation/protected_files_key` is
  added. It calls `DkSetProtectedFilesKey()` after it was written to.
- New `SECRET_PROVISION_SET_PF_KEY` option is added to the Secret
  Provisioning library. If it is set, the library assumes that the
  first provisioned secret is the wrap key for PF and writes it into
  the new pseudo-file.

The Secret Provisioning example `ra-tls-secret-prov` is updated to
include the new protected-files client. This client receives the wrap
key for PF via secret provisioning and reads & outputs the protected
file `files/input.txt`.

*NOTE*: The current implementation of provisioning the wrap key does
not work for `loader.argv_src_file` and `loader.env_src_file` if they
point to protected files (because provisioning happens after setting
up arguments and environment variables).

2020-07-19 21:50:45 +00:00

..

host-abi.rst

[Pal/Linux-SGX] Provision wrap key for protected files at runtime

2020-07-19 21:50:45 +00:00

porting.rst

[Pal] Prefix globals with g_

2020-07-06 17:58:07 +02:00