First commit

.gitignore

@@ -0,0 +1,6 @@
+gramine/
+**/*.manifest
+**/*.manifest.sgx
+**/*.sig
+**/*.sgx
+**/*.bin

DockerImages/Dockerfile

@@ -0,0 +1,5 @@
+FROM gramineproject/gramine
+
+RUN apt -y update
+RUN apt -y install build-essential
+RUN gramine-sgx-gen-private-key

DockerImages/ReadMe.md

@@ -0,0 +1,6 @@
+Build and cache updated image with:
+`docker build -t gramine-loki:latest .`
+
+Run the locally built gramine image with:
+
+`docker run --rm --network host -v $(pwd):/work:Z -w /work --device /dev/sgx_enclave --device /dev/sgx_provision --device /dev/sgx_vepc -it gramine-loki:latest`

Encryptedfile/ReadME.md

@@ -0,0 +1,28 @@
+<h1> Useful commands</h1>
+
+<h2> About </h2>
+
+A simple program to read an encrypted file. The file encryption key comes from a local attestation server.
+It is based on the pytorch example: https://gramine.readthedocs.io/en/stable/tutorials/pytorch/index.html
+
+<h2>Build and run </h2>
+
+<li>Compile the C program with standard gcc command line
+
+
+<li>Compile the manitest file:
+
+`gramine-manifest -Dlog_level=error readfile.manifest.template readfile.manifest`
+
+
+<li>Create signed SGX enclave:
+
+
+`gramine-sgx-sign --manifest readfile.manifest --output readfile.manifest.sgx`
+
+
+<li>See pytorch tutorial for instructions on how to set up a DCAP server locally.
+
+<li>Run with:
+
+`gramine-sgx readfile.bin`

Encryptedfile/plaintext/file.txt

@@ -0,0 +1 @@
+Quickfoxjumpsnightlyabovewizard

Encryptedfile/readfile.c

@@ -0,0 +1,14 @@
+#include<stdio.h>
+#include<string.h>
+
+void main(){
+    int len;
+    char content[10000] = {0};
+    FILE *fp = fopen("file-encrypted.txt", "r");
+    fscanf(fp, "%s", content);
+    fclose(fp);
+
+    printf("Content length is %ld\n", strlen(content));
+    fflush(stdout);
+    getchar();
+}

Encryptedfile/readfile.manifest.template

@@ -0,0 +1,31 @@
+# Hello World manifest file example
+
+loader.entrypoint = "file:{{ gramine.libos }}"
+libos.entrypoint = "/readfile"
+loader.log_level = "{{ log_level }}"
+
+loader.env.LD_LIBRARY_PATH = "/lib"
+
+fs.mounts = [
+  { path = "/file-encrypted.txt", uri = "file:file-encrypted.txt", type = "encrypted" },
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "/readfile", uri = "file:readfile" },
+]
+
+sgx.debug = true
+sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
+
+sgx.trusted_files = [
+  "file:{{ gramine.libos }}",
+  "file:readfile",
+  "file:file-encrypted.txt",
+  "file:{{ gramine.runtimedir() }}/",
+  "file:ssl/ca.crt",
+]
+
+sgx.remote_attestation = "dcap"
+loader.env.LD_PRELOAD = "libsecret_prov_attest.so"
+loader.env.SECRET_PROVISION_CONSTRUCTOR = "1"
+loader.env.SECRET_PROVISION_SET_KEY = "default"
+loader.env.SECRET_PROVISION_CA_CHAIN_PATH = "ssl/ca.crt"
+loader.env.SECRET_PROVISION_SERVERS = "0.0.0.0:4433"

Encryptedfile/server/key

@@ -0,0 +1 @@
+j���T�-5س�
�	

Encryptedfile/server/key.txt

@@ -0,0 +1 @@
+"\x91\x6a\x9b\xc1\x54\x1e\x16\xbf\x35\x2d\xb3\xd8\x01\xaf\x09\xab"

Encryptedfile/ssl/ca.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmMCFCAPYJruZVhxViqOLxW4ILZb1uooMA0GCSqGSIb3DQEBCwUAMHox
+CzAJBgNVBAYTAlhYMQ4wDAYDVQQHDAVYWFhYWDETMBEGA1UECgwKTXkgQ29tcGFu
+eTETMBEGA1UECwwKRGVwYXJ0bWVudDESMBAGA1UEAwwJbG9jYWxob3N0MR0wGwYJ
+KoZIhvcNAQkBFg5tZUBleGFtcGxlLmNvbTAeFw0yMzA3MDgyMDE3MDlaFw0yNjA0
+MjcyMDE3MDlaMHoxCzAJBgNVBAYTAlhYMQ4wDAYDVQQHDAVYWFhYWDETMBEGA1UE
+CgwKTXkgQ29tcGFueTETMBEGA1UECwwKRGVwYXJ0bWVudDESMBAGA1UEAwwJbG9j
+YWxob3N0MR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLmNvbTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBALDK+lYajs1Q1UUpZiz5PSPTosGnujyHRA7M
+GPkrIuK5RIV3xqhY97fk4R5qkqz47Yzc/ut2BDVoxcxqJuvpKrl7I23GcbXSQ9bC
+dInUuoIrZ0j+0eHWmF9YyIR93zMNvlDoLgmWxm8brdMbnEctjadVgDkVZYezyTzn
+1QoKVN+KbWY88v4DkUi8UcE7rz0qGKzeIjcXjVcScva6eyj16+FpsXQzqeNBCuX5
+9n7uruOWNybvsRWneTtRlhqRe90IPiAbma6zP/uEMJ1gFbuZxYEwdfbRe8c1lhFg
+DIFYetsu6lUDPkK7U6RIR79+zfK65cP4s4OwN7fkqu5+pI9GpeUCAwEAATANBgkq
+hkiG9w0BAQsFAAOCAQEARjaYNUI+WuMQSiT3DonbeG/o2Uq3baspwEn1YbC6K7x5
+1BBR7sqgeWMOEut5Iw5XV40NxH/AvKOX4ujwdFL4S1OFfUYlRBjDmq7CwxhpaMhH
+Dq3euio865ZLksDm7ivvonuVrHY7FVWqA2V6oLVBJ5uAKq0igmcfRAnD7EckevWS
+gDTXPkXe4S092IgOvgAKiRns/rI7eBCjP8Sp+Isx+O8ynBXvj9xVdkUBJPGamKdg
+/rZudQHAgQ1Nt1L90pC4KvySNunOy6Orh8G0GGovZrLfsFDb64vl9O3MOxmFsBAe
+Rn/GGXnP3TFplkAussGzu7bx1RDWRSaY5ISK+ROWcQ==
+-----END CERTIFICATE-----

Encryptedfile/ssl/ca.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAsMr6VhqOzVDVRSlmLPk9I9Oiwae6PIdEDswY+Ssi4rlEhXfG
+qFj3t+ThHmqSrPjtjNz+63YENWjFzGom6+kquXsjbcZxtdJD1sJ0idS6gitnSP7R
+4daYX1jIhH3fMw2+UOguCZbGbxut0xucRy2Np1WAORVlh7PJPOfVCgpU34ptZjzy
+/gORSLxRwTuvPSoYrN4iNxeNVxJy9rp7KPXr4WmxdDOp40EK5fn2fu6u45Y3Ju+x
+Fad5O1GWGpF73Qg+IBuZrrM/+4QwnWAVu5nFgTB19tF7xzWWEWAMgVh62y7qVQM+
+QrtTpEhHv37N8rrlw/izg7A3t+Sq7n6kj0al5QIDAQABAoIBAEYgfaRh7HsssSw5
++7mjM8leTZUbfxg7X5evBcjwf2oHq1J17Gsiv0BGnbV++Kd8Jl5V2xhzO8AjyzIG
+eWHin3vriGYm7Tv+J8KsZ6W0qDayGMovqfk3MkG/6eoEM+EAdpmJP5m2IQg5pn2y
+2g6x1xqlI7OA9UEa45wxKaRN7NSuX2fr6uXuXAP88zHAAhEfemak6MUp79WYPdcU
+ZCxQRmBgYQ4d73ZmuBatGRP3g99Y0aqYHe2GT0XQw/elQhkpsBPI+Et/CWl9eAze
+T5Q1xXjpyNsWeFEdrzux9L7J+azvmwCUfA/fnkDoILbiu3u07weF/B7aEgBAtsGG
+YNhhgQECgYEA1aRYv34tv1KArDCjt6jWxw3jXfQf77SNXfWl8uKDMGHnPxmjnFTF
+6pWDERWH4utB3gCk4tjh2jvBt7OIYJVU8LHpY/t7sdj0D37eg89C8CgTqScfEg1a
+mb+Ioby7IlYAAX9C4IU/6C4Wt8VX5NWcPZ6WnJEhDDCTmm3OIf3e4XECgYEA09hP
+tb8BaA589utbiypFQtQf1stPpOMowYCvG9NiM4Pa00UGpImnYHfN1XKxIOhUfu5X
+AvcgfM5SwZqV/WXqR5YMl0QkUtjLmBhqrfvinUTLUpzjvGk+DLtlktxC+p+kIwNe
+8luPXrGmaygWQ7AzT1rdn09Nf1Q9VulCtHLk0bUCgYAuT0elirZj6IBX0ttKLmEQ
+GOSWMxrRHPQfz+W+9na1gCNePDKI6p9UMECO7XndKF3Iv57+RUD/y0A8j8AaH4Sg
+ABC1SYgQjxSoXzngnIbIBAfu/Lnxcc+X0DrPxFdUJAwwRuO6Q2gM7iCiiTZ6Ngt+
+F+hR2+ur9sOoD/FE0QEFIQKBgQCf+U9oPc8AF0DC7cR5ePhImQtaFroUF/5k8ZpK
+dvxHTqDmvc9gXRrqPE5Ri4S7BvcXy0Al2xzLYrsXvHbbniSm3mavrCOJ9HD6cCXP
+MNFWVeb8gcFwPEFBOBpiJrblr7wxPJBskDvaFGlJrkHx55M3r7SAY1BwgNq5UPiw
+b7rfqQKBgGFHa+Ba3gVjxZYdlUPn/ER7HG7XRvQBkcgqm4cy8pZ5NFhTG0eb7+zm
+b94JMru5bUAaEPyaX6eH3Mp9HNsHMYhn32cgbpcKluaYVg9GV+2LT3hb12pN/VdS
+kWy9Zl3wYNf4HfzeYRStez4axcRNXag38PtD3s8rOUdaS7NlpCDy
+-----END RSA PRIVATE KEY-----

Encryptedfile/ssl/ca.srl

@@ -0,0 +1 @@
+44CB8AA14956900A482D09308F38B4D14BD95C88

Encryptedfile/ssl/ca_config.conf

@@ -0,0 +1,15 @@
+[ req ]
+default_bits       = 4096
+default_md         = sha512
+default_keyfile    = example.com.key
+prompt             = no
+encrypt_key        = no
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+countryName            = "XX"             # C=
+localityName           = "XXXXX"          # L=
+organizationName       = "My Company"     # O=
+organizationalUnitName = "Department"     # OU=
+commonName             = "localhost"      # CN=
+emailAddress           = "[email protected]" # email

Encryptedfile/ssl/server.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmMCFETLiqFJVpAKSC0JMI84tNFL2VyIMA0GCSqGSIb3DQEBCwUAMHox
+CzAJBgNVBAYTAlhYMQ4wDAYDVQQHDAVYWFhYWDETMBEGA1UECgwKTXkgQ29tcGFu
+eTETMBEGA1UECwwKRGVwYXJ0bWVudDESMBAGA1UEAwwJbG9jYWxob3N0MR0wGwYJ
+KoZIhvcNAQkBFg5tZUBleGFtcGxlLmNvbTAeFw0yMzA3MDgyMDE3MDlaFw0yNDA3
+MDIyMDE3MDlaMHoxCzAJBgNVBAYTAlhYMQ4wDAYDVQQHDAVYWFhYWDETMBEGA1UE
+CgwKTXkgQ29tcGFueTETMBEGA1UECwwKRGVwYXJ0bWVudDESMBAGA1UEAwwJbG9j
+YWxob3N0MR0wGwYJKoZIhvcNAQkBFg5tZUBleGFtcGxlLmNvbTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAOYDi5N2yOxEa9wk6dWHA/tFIlcCTlAofcQ3
+ru5POj45pStkqqQnIsDIDAvuBOIpGUh8NeVX4QV1ssQCi0bwWx5vVppm+dEvQjwu
+PfedtuiU5oIuFv2LlZNPDw2gwKFGCENecqVStIW5FsjHDf3qT0mr/hUChHJhx51t
+jyUyri6Z9mjenQUwsNLJEPpXNrKmTInirvYB3QdOq4JOKe/dwpxOPRyKfXBzUVPW
+hpkXwCQf6d3R9//6E0zxRWMWE0p/0s6qqwXjexFB4mAPaCM+t9nWvvSZZQ7d4poF
+T5ZhplM7q4PCpmLiFHU5mD4JedIjXKFXMprZyrDFDVcm5KqhRgcCAwEAATANBgkq
+hkiG9w0BAQsFAAOCAQEAIpPHXpSjFIXd2Obqd3RWbXNA0oz0BJwRrpfQdW4Mvrmw
+4Ii1pRWRXdojdHpjImxKa8p7ZAXZ7v5BF2FeCKplEl/Ww6scqzV49IYgukPWZ838
+yFfg1oxjZGL6iPXGgBsy7p4fk+D6DHZMgHjbnkM2R8dbiub6qCO/y4BOr2+5kxps
+lO4/lKSSiklSp/geI2BgdmwIYbiVNNJ0iBIePm4RFSuViQbtrBWnfbc9hUZNW6XG
+LXWNRhUXYF/iCxEdpoEtF6u6N62luVHnYdb6bzStddDKyjP5lQ01UQFLr2jlvJB/
+SoL0G4tOWHKCs5yVaFpvXIiR5DjljLqVI8r44v1fQg==
+-----END CERTIFICATE-----

Encryptedfile/ssl/server.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICvzCCAacCAQAwejELMAkGA1UEBhMCWFgxDjAMBgNVBAcMBVhYWFhYMRMwEQYD
+VQQKDApNeSBDb21wYW55MRMwEQYDVQQLDApEZXBhcnRtZW50MRIwEAYDVQQDDAls
+b2NhbGhvc3QxHTAbBgkqhkiG9w0BCQEWDm1lQGV4YW1wbGUuY29tMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5gOLk3bI7ERr3CTp1YcD+0UiVwJOUCh9
+xDeu7k86PjmlK2SqpCciwMgMC+4E4ikZSHw15VfhBXWyxAKLRvBbHm9Wmmb50S9C
+PC4995226JTmgi4W/YuVk08PDaDAoUYIQ15ypVK0hbkWyMcN/epPSav+FQKEcmHH
+nW2PJTKuLpn2aN6dBTCw0skQ+lc2sqZMieKu9gHdB06rgk4p793CnE49HIp9cHNR
+U9aGmRfAJB/p3dH3//oTTPFFYxYTSn/SzqqrBeN7EUHiYA9oIz632da+9JllDt3i
+mgVPlmGmUzurg8KmYuIUdTmYPgl50iNcoVcymtnKsMUNVybkqqFGBwIDAQABoAAw
+DQYJKoZIhvcNAQENBQADggEBAGDKVZ5M2keJf9af1a30E2LZ7rPBDJC/5VLHyohn
+srsE00rfYq6SyX1QzfGCd5w0PVvOuNxdTHGotpror7aStATyCwBhDsgubpXyGBol
+IkC7C3ZKPqol1Nzq6sfMQ1XDRs/o5sZF7OH9QTngtbQ7uxuv7FUDoifYgfYtQ0T4
+a0ZV7rcXg7trVE1cQyhgCv6R3SNdUlDnIx5KXkSWUmbG09hw1FRldlaCjiyxiZlY
+T6WjnOzZlZ8pbFDKwkcz8uYNQUoiyCAWVj6v0dbF8MwSagrnz8RBnHX7RUDBNKuP
+0uudSHXZ17rnHflezkBNCGcOkH+LZ3lydwzym3hmad2G8sw=
+-----END CERTIFICATE REQUEST-----

Encryptedfile/ssl/server.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA5gOLk3bI7ERr3CTp1YcD+0UiVwJOUCh9xDeu7k86PjmlK2Sq
+pCciwMgMC+4E4ikZSHw15VfhBXWyxAKLRvBbHm9Wmmb50S9CPC4995226JTmgi4W
+/YuVk08PDaDAoUYIQ15ypVK0hbkWyMcN/epPSav+FQKEcmHHnW2PJTKuLpn2aN6d
+BTCw0skQ+lc2sqZMieKu9gHdB06rgk4p793CnE49HIp9cHNRU9aGmRfAJB/p3dH3
+//oTTPFFYxYTSn/SzqqrBeN7EUHiYA9oIz632da+9JllDt3imgVPlmGmUzurg8Km
+YuIUdTmYPgl50iNcoVcymtnKsMUNVybkqqFGBwIDAQABAoIBAE1vHhsL30JjGmin
+aK1A4d9Ce/gMx66Goyhekp6Zv4LZRzifkC7pGfMKpbuSasR0j5Vuc3p9Jjz/Tapd
+LOQ54IMTenVKe4mnvkWiT6w/xSbxkdR7jbPXvQg1klzFJHRmrjt33WK4wBtQn1IC
+aTx1GDI2G7iY+1vCfUALdShRsn/vI5/ABT/uIhjgfzlatfGBFsq1vDJoDFEKnxRV
+uVju76E8SfYx9wXXOmuRTRpS5FPJTABhIox5qa5MOShXw1M5inUjdR3L95ObUaHk
+YF3/CNh5epOHnGsS7qkQ/1aBnJsTl0ej/PLJz9qfxb6ykD14vixlpL84KAbHGX2t
++FtWy6kCgYEA+2Feq/+vbwVVRV6IRLlzcbJefeWzw05Qd5/K1k4eOlpKJoGY9e1E
+rtHezWGKxdilR8nZrErQakO6Oj5lWSKLU6E8Wz+NmCzreKR7JuvqdZ5Y+QZb9Vcm
+OHa4AzAwkyKhVi77sDxHDGyuwhQopwezExcQ2nDa9UQwDy7BEk2UOO0CgYEA6j2n
+3i23iUQiSDpgqmEsihArGpY2ywGDZ8BYEunbvprfrOUigO+Ke3E6QnyICfCJuzPa
+jsc/491GaZMeSa/gMep4Xltgdspb/clLPqu0NPbO/pmpnPBQP7m9lsICBd+BmlgL
+0b4lNKdqtAWOi9lKdBxEf3E3dEKfpDCMpTlD4EMCgYEAr8FzTLR29xt2dArVIZ+7
+7Gl2kXWRiuLtdcXeLpntnoTURTnlNUTP+Z64tUYWnZ+MZ7XkIAcq0rFJukE34Os7
+GJyps26q1BPMCsyNYjgd9GBi+rGMh+uHyICQxYHi5GyY+sXcqWprjm9KfF1V0vqa
+JKXC3cd7/3HOXD8nNGHTWT0CgYEA6Ys7mbu/KG70N0ttIbLtM2JXd5SZYOJLX+BY
+b9MWsv27UajLM/6g9d64lZ2QDUj0Kd/TY1OpkckG8TArnJBsWZhLFtjIXuf3vBs8
+mGmdrMj/LL2MbNr1R/Qq4OriFXT4xShP8HlCozLgokiADVNCdm3Qpbf98D6U6KE3
+OWzVDf0CgYEA3Izg4PpLeZMqRS+oQ0DP+f3ieCew2GljBJNMNJcUrV/mvj9HamAi
+IbxZ0d5VDeuzaH1pCsXSNDiZpu5pfFfKxGBkNZckqi56VDUVgKeC4QKT9kdFswdu
+haKEwPuAv9n8MGWN4FfX5xsaxGQ6fVgVwCM8J1jNY0ZGm/8sZUussNE=
+-----END RSA PRIVATE KEY-----

PlaintextFile/ReadME.md

@@ -0,0 +1,39 @@
+<h1> Useful commands</h1>
+
+<h2> About </h2>
+
+First differentiator between an untrusted process vs trusted process.
+
+A simple program to read a plaintext file. When the program is run on the untrusted side, the process dump shows the file content in plaintext.
+But when it is run on SGX, the file content isn't visible in the process dump. (Obviously!)
+
+<h2>Build and run </h2>
+
+<li>Compile the C program with standard gcc command line. I have added .bin extension to the binaries to help .gitignore
+
+
+<li>Compile the manitest file:
+
+`gramine-manifest -Dlog_level=error readfile.manifest.template readfile.manifest`
+
+<li>Create signed SGX enclave:
+
+`gramine-sgx-sign --manifest readfile.manifest --output readfile.manifest.sgx`
+
+<li> Dump process memory
+
+Install gdb for this one. Not needed for all the examples so I haven't included in the docker image
+
+`apt -y install gdb`
+
+Find the PID of the running binary. It waits for a char indefinitely for this purpose. And dump memory
+`gcore -o readfile PID`
+
+Look for the plaintext string from the file - it should appear only when not running in SGX
+
+`strings readfile.PID | grep 'wizard'`
+
+
+<li>Run on SGX with:
+
+`gramine-sgx readfile`

PlaintextFile/file.txt

@@ -0,0 +1 @@
+Quickfoxjumpsnightlyabovewizard

PlaintextFile/readfile.c

@@ -0,0 +1,14 @@
+#include<stdio.h>
+#include<string.h>
+
+void main(){
+    int len;
+    char content[10000] = {0};
+    FILE *fp = fopen("file.txt", "r");
+    fscanf(fp, "%s", content);
+    fclose(fp);
+    // Notice we don't print the file content. It is simply held in memory.
+    printf("Content length is %ld\n", strlen(content));
+    fflush(stdout);
+    getchar();
+}

PlaintextFile/readfile.manifest.template

@@ -0,0 +1,22 @@
+# Hello World manifest file example
+
+loader.entrypoint = "file:{{ gramine.libos }}"
+libos.entrypoint = "/readfile"
+loader.log_level = "{{ log_level }}"
+
+loader.env.LD_LIBRARY_PATH = "/lib"
+
+fs.mounts = [
+  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
+  { path = "/readfile", uri = "file:readfile" },
+]
+
+sgx.debug = true
+sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
+
+sgx.trusted_files = [
+  "file:{{ gramine.libos }}",
+  "file:readfile",
+  "file:file.txt",
+  "file:{{ gramine.runtimedir() }}/",
+]

ReadMe.md

@@ -0,0 +1,9 @@
+<h1>About</h1>
+<p>Some home brewed examples to learn basics of Gramine LibOS.
+Work in progress. More examples will be added as I dig deeper.
+</p>
+
+<p>
+All examples are built and run on a docker image on a Fedora workstation.
+See DockerImages for instructions.
+</p>