Skip to content

Commit 62d53b6

Browse files
berrangeberrange
committed
Support build time setting of enclave load directory
The current code for loading enclaves (pce, id_enclave, qe3, tdqe, qve) tries to find the enclave file in the directory of the currently loaded library (as reported by dladdr), or in the directory of the current executable (as reported by /proc/self/exe). Neither of these approaches is sufficiently flexible to work with all Linux distro filesystem layout policies. In particular distros may desire to have a specific directory location exclusively for the shipping of enclaves, separate from any native libraries or executables. This introduces support for an "SGX_ENCLAVE_PATH" variable in the makefiles, which is used to define an SGX_ENCLAVE_PATH symbol in code. By default SGX_ENCLAVE_PATH path will get defined to an empty string at the C level and so current code behaviour will not be changed. If this is set though, then it will be used to locate the enclaves, with no fallback to searching relative to the library or binary. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
1 parent 2562057 commit 62d53b6

12 files changed

Lines changed: 60 additions & 8 deletions

File tree

‎QuoteGeneration/pce_wrapper/linux/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ INCLUDE += -I$(ROOT_DIR)/ae/common \
4040
-I$(ROOT_DIR)/ae/inc \
4141
-I$(ROOT_DIR)/ae/inc/internal
4242

43-
CXXFLAGS += -fPIC -Werror -g
43+
CXXFLAGS += -fPIC -Werror -g -DSGX_ENCLAVE_PATH="\"$(SGX_ENCLAVE_PATH)\""
4444

4545
CFLAGS += -fPIC -Werror -g
4646
Link_Flags := $(SGX_COMMON_CFLAGS) -L$(ROOT_DIR)/build/linux -L$(SGX_SDK)/lib64 -lsgx_urts -lpthread -ldl

‎QuoteGeneration/pce_wrapper/pce_wrapper.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,15 @@ bool get_pce_path(
112112
p_file_path[buf_size - 1] = '\0'; //null terminate the string
113113
return true;
114114
}
115+
else if (*SGX_ENCLAVE_PATH)
116+
{
117+
if ((strlen(SGX_ENCLAVE_PATH) + 1 + strlen(PCE_ENCLAVE_NAME) + 1) > buf_size) {
118+
return false;
119+
}
120+
strcpy(p_file_path, SGX_ENCLAVE_PATH);
121+
strcat(p_file_path, "/");
122+
strcat(p_file_path, PCE_ENCLAVE_NAME);
123+
}
115124
else if(0 != dladdr(__builtin_return_address(0), &dl_info) &&
116125
NULL != dl_info.dli_fname)
117126
{

‎QuoteGeneration/quote_wrapper/quote/linux/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Quote_Include_Paths := -I$(SGX_SDK)/include -I../inc -I../../common/inc -I./ -I.
5151

5252
Quote_C_Flags := $(COMMON_FLAGS) -g -fPIC -Wno-attributes $(Quote_Include_Paths)
5353

54-
Quote_Cpp_Flags := $(Quote_C_Flags) -std=c++11
54+
Quote_Cpp_Flags := $(Quote_C_Flags) -std=c++11 -DSGX_ENCLAVE_PATH="\"$(SGX_ENCLAVE_PATH)\""
5555
Quote_Link_Flags := $(COMMON_FLAGS) -g -L$(ROOT_DIR)/build/linux -L$(SGX_SDK)/lib64 -lsgx_urts -lpthread -ldl
5656

5757
ifndef DEBUG

‎QuoteGeneration/quote_wrapper/quote/qe_logic.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,15 @@ get_qe_path(const TCHAR *p_file_name,
573573
p_file_path[buf_size - 1] = '\0'; //null terminate the string
574574
return true;
575575
}
576+
else if (*SGX_ENCLAVE_PATH)
577+
{
578+
if ((strlen(SGX_ENCLAVE_PATH) + 1 + strlen(p_file_name) + 1) > buf_size) {
579+
return false;
580+
}
581+
strcpy(p_file_path, SGX_ENCLAVE_PATH);
582+
strcat(p_file_path, "/");
583+
strcat(p_file_path, p_file_name);
584+
}
576585
else if(0 != dladdr(__builtin_return_address(0), &dl_info) &&
577586
NULL != dl_info.dli_fname)
578587
{

‎QuoteGeneration/quote_wrapper/tdx_quote/linux/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ Quote_Include_Paths := -I$(SGX_SDK)/include -I../inc -I../../common/inc -I./ \
5656

5757
Quote_C_Flags := $(CFLAGS) -g -MMD -fPIC -Wno-attributes $(Quote_Include_Paths)
5858

59-
Quote_Cpp_Flags := $(CXXFLAGS) -g -MMD -fPIC -Wno-attributes $(Quote_Include_Paths)
59+
Quote_Cpp_Flags := $(CXXFLAGS) -g -MMD -fPIC -Wno-attributes $(Quote_Include_Paths) -DSGX_ENCLAVE_PATH="\"$(SGX_ENCLAVE_PATH)\""
6060
Quote_Link_Flags := $(COMMON_LDFLAGS) -g -L$(ROOT_DIR)/build/linux \
6161
-L$(PCE_Library_Dir) -lsgx_pce_logic -L$(SGX_SDK)/lib64 \
6262
-lsgx_urts -lpthread -ldl

‎QuoteGeneration/quote_wrapper/tdx_quote/td_ql_logic.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,14 @@ bool tee_att_config_t::get_qe_path(tee_att_ae_type_t type,
403403
p_file_path[len] = '\0'; //null terminate the string
404404
return true;
405405
}
406+
else if (*SGX_ENCLAVE_PATH) {
407+
if ((strlen(SGX_ENCLAVE_PATH) + 1 + strlen(p_file_name) + 1) > buf_size) {
408+
return false;
409+
}
410+
strcpy(p_file_path, SGX_ENCLAVE_PATH);
411+
strcat(p_file_path, "/");
412+
strcat(p_file_path, p_file_name);
413+
}
406414
else if(0 != dladdr(__builtin_return_address(0), &dl_info) &&
407415
NULL != dl_info.dli_fname)
408416
{

‎QuoteVerification/appraisal/qal/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ QAL_Include_Path := -I./ \
4949
-I../common/ \
5050
-I$(RAPIDJSON_DIR)/
5151

52-
QAL_Cpp_Flags := $(CXXFLAGS) -g -fPIC $(QAL_Include_Path)
52+
QAL_Cpp_Flags := $(CXXFLAGS) -g -fPIC $(QAL_Include_Path) -DSGX_ENCLAVE_PATH="\"$(SGX_ENCLAVE_PATH)\""
5353
QAL_C_Flags := $(CFLAGS) -g -fPIC $(QAL_Include_Path)
5454

5555
QAL_Link_Flags := $(COMMON_LDFLAGS) -L$(WARM_Lib_Path) -lvmlib -ldl -lm -lpthread \

‎QuoteVerification/appraisal/qal/qae_wrapper.cpp‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,14 @@ static bool get_qae_path(
101101
p_file_path[buf_size - 1] = '\0'; // null terminate the string
102102
return true;
103103
}
104+
else if (*SGX_ENCLAVE_PATH)
105+
{
106+
if ((strlen(SGX_ENCLAVE_PATH) + 1 + 1) > buf_size) {
107+
return false;
108+
}
109+
(void)strcpy(p_file_path, SGX_ENCLAVE_PATH);
110+
(void)strcat(p_file_path, "/");
111+
}
104112
else if (0 != dladdr(__builtin_return_address(0), &dl_info) &&
105113
NULL != dl_info.dli_fname)
106114
{
@@ -360,4 +368,4 @@ quote3_error_t ecall_authenticate_policy_owner(sgx_enclave_id_t eid,
360368
retval = SGX_QL_ERROR_UNEXPECTED;
361369
}
362370
return retval;
363-
}
371+
}

‎QuoteVerification/dcap_quoteverify/linux/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ QVL_VERIFY_INC := -I$(QVE_SRC_PATH)/Include \
5454
QPL_BASE64_CPP_DEP := $(DCAP_QPL_DIR)/sgx_base64.d
5555

5656
SGX_COMMON_CFLAGS += -g -fPIC -Wno-attributes -USGX_TRUSTED
57-
SGX_COMMON_CXXFLAGS += -g -fPIC -USGX_TRUSTED
57+
SGX_COMMON_CXXFLAGS += -g -fPIC -USGX_TRUSTED -DSGX_ENCLAVE_PATH="\"$(SGX_ENCLAVE_PATH)\""
5858

5959
QVL_LIB_OBJS := $(QVL_LIB_FILES:.cpp=_untrusted.o)
6060
QVL_PARSER_OBJS := $(QVL_PARSER_FILES:.cpp=_untrusted.o)

‎QuoteVerification/dcap_quoteverify/linux/qve_parser.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,14 @@ bool get_qve_path(
8888
p_file_path[buf_size - 1] = '\0'; //null terminate the string
8989
return true;
9090
}
91+
else if (*SGX_ENCLAVE_PATH)
92+
{
93+
if ((strlen(SGX_ENCLAVE_PATH) + 1 + 1) > buf_size) {
94+
return false;
95+
}
96+
(void)strcpy(p_file_path, SGX_ENCLAVE_PATH);
97+
(void)strcat(p_file_path, "/");
98+
}
9199
else if(0 != dladdr(__builtin_return_address(0), &dl_info) &&
92100
NULL != dl_info.dli_fname)
93101
{

0 commit comments

Comments
 (0)