constants.go 7.4 KB
Newer Older
S
stormgbs 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90
package constants

type EnclaveType string

const (
	IntelSGX = EnclaveType("intelSgx")
)

const (
	EnclaveTypeKeyName        = "ENCLAVE_TYPE"
	EnclaveRuntimePathKeyName = "ENCLAVE_RUNTIME_PATH"
	EnclaveRuntimeArgsKeyName = "ENCLAVE_RUNTIME_ARGS"
	DefaultEnclaveRuntimeArgs = ".occlum"
)

const (
	ReplaceOcclumImageScript = `#!/bin/bash
set -xe
function usage() {
  if [ $# -lt 2 ]; then
    echo "usage: $0 src_dir dst_dir"
    exit 1
  fi
}

function deep_copy_link() {
  local link_symbol=$1
  local link_target=$2
  rm -f ${link_symbol}
  mkdir -p ${link_symbol}
  /bin/cp -rdf ${link_target}/* ${link_symbol} || true
}

function copy(){
  local src_dir=$1
  local dst_dir=$2
  local dst_root_dir=$3

  if [ ! -d ${dst_dir} ]; then
    mkdir -p ${dst_dir}
  fi

  for file in $(ls ${src_dir}/)
  do
    src_file=${src_dir}/${file}
    dst_file=${dst_dir}/${file}
    if [ -f ${src_file} ]; then
      rm -fr ${dst_file}
      /bin/cp -df ${src_file} ${dst_file}
    elif [ -d ${src_file} ]; then
	    link_target=$(stat -c "%N" ${dst_file} | awk '-F-> ' '{print $2}' | awk -F"'" '{print $2}')
      if [ "${link_target}" != "" ]; then
        reg='^/.*'
        if [[  ${link_target} =~ ${reg}  ]]; then
          link_target=${dst_root_dir}${link_target}
        else
          link_target=${dst_file}/../${link_target}
        fi
        deep_copy_link "${dst_file}" "${link_target}"
      fi
      copy "${src_file}" "${dst_file}" "${dst_root_dir}"
    fi
  done
}

function compact() {
  local src_dir=$1
  local dst_dir=$2
  backup_dir=/tmp/dst_backup
  # step1: backup files in directory dst_dir
  rm -fr ${backup_dir}
  mkdir -p ${backup_dir}
  /bin/cp -rdf ${dst_dir}/* ${backup_dir}/ || true
  # step2: clean dirctory dst_dir
  rm -rf ${dst_dir}/*
  # step3: copy files in directory src_dir to directory dst_dir
  /bin/cp -rdf ${src_dir}/* ${dst_dir}/ || true
  # step4: restore backuped failes to directory ${dst_dir}
  copy ${backup_dir} ${dst_dir} ${dst_dir}
  # step5: remove backuped files
  rm -rf ${backup_dir}
}

function start() {
  usage $@
  compact $@
}

start $@`

91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142
	CarrierScript = `#!/bin/bash
set -xe
base_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
occlum_workspace=/occlum_workspace

temp=$(getopt -a -o a:r:w:p:c:e:u:m:s:k:n: -l action:,rootfs:,work_dir:,entry_point:,occlum_config_path:,enclave_config_path:,\
unsigned_encalve_path:,unsigned_material_path:,signed_enclave_path:,public_key_path:,signature_path: -- "$@")
eval set -- "$temp"

while true
do
  case "$1" in
    -a|--action)
      action=$2; shift;;
    -r|--rootfs)
      rootfs=$2; shift;;
    -w|--work_dir)
      work_dir=$2; shift;;
    -p|--entry_point)
      entry_point=$2; shift;;
    -c|--occlum_config_path)
      occlum_config_path=$2; shift;;
    -e|--enclave_config_path)
      enclave_config_path=$2; shift;;
    -u|--unsigned_encalve_path)
      unsigned_encalve_path=$2; shift;;
    -m|--unsigned_material_path)
      unsigned_material_path=$2; shift;;
    -s|--signed_enclave_path)
      signed_enclave_path=$2; shift;;
    -k|--public_key_path)
      public_key_path=$2; shift;;
    -n|--signature_path)
      signature_path=$2; shift;;
    --)
      shift
      break
      ;;
    *)
      echo "Unknown argument: $1"; shift;;
  esac
shift
done

function copyOcclumLiberaries() {
  pushd ${rootfs}/${work_dir}
  local lib_dir=${rootfs}/lib
  /bin/cp -f /usr/lib/x86_64-linux-gnu/libprotobuf.so ${lib_dir}
  /bin/cp -f /lib/x86_64-linux-gnu/libseccomp.so.2 ${lib_dir}
  /bin/cp -f /usr/lib/libsgx_u*.so* ${lib_dir}
  /bin/cp -f /usr/lib/libsgx_enclave_common.so.1 ${lib_dir}
  /bin/cp -f /usr/lib/libsgx_launch.so.1 ${lib_dir}
143 144 145
  #/bin/cp -f .occlum/build/lib/libocclum-pal.so ${lib_dir}/liberpal-occlum.so
  #ln -sfn .occlum/build/lib/libocclum-pal.so liberpal-occlum.so
  #chroot ${rootfs} /sbin/ldconfig
146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164
  popd
}

function buildUnsignedEnclave(){
  if [[ "${entry_point}" == "" || "${rootfs}" == "" || "${work_dir}" == "" ]]; then
    echo "BuildUnsignedEnclave:: the argumentes should not be empty: entry_point, rootfs, work_dir"
    exit 1
  fi

  rm -fr ${occlum_workspace}
  mkdir -p ${occlum_workspace}
  pushd ${occlum_workspace}
  # occlum init
  occlum init
  # replace Occlum.json with user-supplied Occlum.json
  if [[ "${occlum_config_path}" != "" && -f ${occlum_config_path} ]];then
    /bin/cp -f ${occlum_config_path} Occlum.json
  fi
  # set occlum entrypoint
165
  # sed -i "s#/bin#${entry_point}#g" Occlum.json
166 167
  # generate the configuration file Enclave.xml that used by enclave from Occlum.json
  /opt/occlum/build/bin/gen_enclave_conf -i Occlum.json -o Enclave.xml
168 169 170 171
  # build occlum image
  /bin/bash ${base_dir}/replace_occlum_image.sh ${rootfs} image
  # occlum build
  occlum build
J
jiazhiguang 已提交
172 173 174 175 176 177 178
  if [ ! -f .occlum/build/lib/libocclum-libos.so ]; then
    if [ -f .occlum/build/lib/libocclum-libos.so.0 ]; then
      pushd .occlum/build/lib/
      ln -s libocclum-libos.so.0 libocclum-libos.so
      popd
    fi
  fi
179 180 181
  mkdir -p ${rootfs}/${work_dir} || true
  /bin/cp -fr .occlum ${rootfs}/${work_dir}
  /bin/cp -f Enclave.xml ${rootfs}/${work_dir}
182
  /bin/cp -f Occlum.json ${rootfs}/${work_dir}
183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260
  popd
}

function generateSigningMaterial() {
  if [[ "${enclave_config_path}" == "" || "${unsigned_encalve_path}" == "" || "${unsigned_material_path}" == ""  ]]; then
    echo "GenerateSigningMaterial:: the argumentes should not be empty: enclave_config_path, unsigned_encalve_path, unsigned_material_path"
    exit 1
  fi
  /opt/intel/sgxsdk/bin/x64/sgx_sign gendata -enclave ${unsigned_encalve_path} -config ${enclave_config_path} -out ${unsigned_material_path}
}

function cascadeEnclaveSignature() {
  if [[ "${enclave_config_path}" == "" || "${unsigned_encalve_path}" == "" || "${unsigned_material_path}" == "" \
	|| "${signed_enclave_path}" == "" || "${public_key_path}" == "" || "${signature_path}" == "" ]]; then
    echo "CascadeEnclaveSignature:: the argumentes should not be empty: enclave_config_path, unsigned_encalve_path, unsigned_material_path, signed_enclave_path, public_key_path, signature_path"
    exit 1
  fi
  /opt/intel/sgxsdk/bin/x64/sgx_sign catsig -enclave ${unsigned_encalve_path} -config ${enclave_config_path} -out ${signed_enclave_path} -key ${public_key_path} \
    -sig ${signature_path} -unsigned ${unsigned_material_path}
}

function mockSignature() {
  if [[ "${public_key_path}" == "" || "${signature_path}" == "" || "${unsigned_material_path}" == "" ]]; then
    echo "MockSignature:: the argumentes should not be empty: public_key_path, signature_path, unsigned_material_path"
    exit 1
  fi
  dir=$(mktemp -d)
  openssl genrsa -out ${dir}/privatekey.pem -3 3072
  openssl rsa -in ${dir}/privatekey.pem -pubout -out ${public_key_path}
  openssl dgst -sha256 -out ${signature_path} -sign ${dir}/privatekey.pem -keyform PEM ${unsigned_material_path}
  rm -fr ${dir}
}

function doAction(){
  if [ "${action}" == "" ]; then
    echo "the argument should not be empty: action"
    exit 1
  fi
  case ${action} in
    buildUnsignedEnclave)
      buildUnsignedEnclave
      ;;
    generateSigningMaterial)
      generateSigningMaterial
      ;;
    cascadeEnclaveSignature)
      cascadeEnclaveSignature
      ;;
    mockSignature)
      mockSignature
      ;;
    *)
      echo "unknown action: ${action}"
      exit 1
      ;;
  esac
}

doAction`

	StartScript = `#!/bin/bash
function handle_TERM() {
  echo "recevied signal SIGTERM, exit now"
  exit 0
}

function handle_INT() {
  echo "recevied signal SIGINT, exit now"
  exit 0
}

trap 'handle_INT' SIGINT
trap 'handle_TERM' SIGTERM

while true
do
  sleep 1
done`
S
stormgbs 已提交
261
)