diff --git a/rune/libcontainer/configs/enclave.go b/rune/libcontainer/configs/enclave.go index d34ba6214f766c5c506ee260b89da3854ce3842a..739e5e099a6ef9f095c2f892d900ec9b2fb581c6 100644 --- a/rune/libcontainer/configs/enclave.go +++ b/rune/libcontainer/configs/enclave.go @@ -10,6 +10,7 @@ type Enclave struct { Type string `json:"type"` Path string `json:"path"` Args string `json:"args,omitempty"` + IsProductEnclave uint32 `json:"is_product_enclave,omitempty"` RaType uint32 `json:"ra_type,omitempty"` RaEpidSpid string `json:"ra_epid_spid,omitempty"` RaEpidSubscriptionKey string `json:"ra_epid_subscription_key,omitempty"` diff --git a/rune/libcontainer/configs/validate/validator.go b/rune/libcontainer/configs/validate/validator.go index 8167064df6474cff3e0ef00ca17386f559158b27..c456f60a80832678aeeb205e04fb0dc1c8b0808c 100644 --- a/rune/libcontainer/configs/validate/validator.go +++ b/rune/libcontainer/configs/validate/validator.go @@ -226,13 +226,18 @@ func (v *ConfigValidator) enclave(config *configs.Config) error { return err } + if config.Enclave.IsProductEnclave == sgx.InvalidEnclaveType { + return fmt.Errorf("Unsupported enclave.is_product_enclave Configuration %v!\n", config.Enclave.IsProductEnclave) + } + if config.Enclave.RaType == sgx.InvalidRaType { - return fmt.Errorf("Unsupported ra_type Configuration %v!\n", config.Enclave.RaType) + return fmt.Errorf("Unsupported enclave.attestation.ra_type Configuration %v!\n", config.Enclave.RaType) } if config.Enclave.RaEpidIsLinkable == intelsgx.InvalidQuoteSignatureType { - return fmt.Errorf("Unsupported ra_epid_is_linkable Configuration %v!\n", config.Enclave.RaEpidIsLinkable) + return fmt.Errorf("Unsupported enclave.attestation.ra_epid_is_linkable Configuration %v!\n", config.Enclave.RaEpidIsLinkable) } + return nil } diff --git a/rune/libcontainer/process_linux.go b/rune/libcontainer/process_linux.go index 1032586986ef9bc78139dcd7e7f5091360b546a0..19bdd5a97cc7f6ed2dcd17a35d990458214e8d11 100644 --- a/rune/libcontainer/process_linux.go +++ b/rune/libcontainer/process_linux.go @@ -144,6 +144,7 @@ func (p *setnsProcess) start() (err error) { Type: p.config.Config.Enclave.Type, Path: p.config.Config.Enclave.Path, Args: p.config.Config.Enclave.Args, + IsProductEnclave: p.config.Config.Enclave.IsProductEnclave, RaType: p.config.Config.Enclave.RaType, RaEpidSpid: p.config.Config.Enclave.RaEpidSpid, RaEpidSubscriptionKey: p.config.Config.Enclave.RaEpidSubscriptionKey, @@ -478,6 +479,7 @@ func (p *initProcess) start() (retErr error) { Type: p.config.Config.Enclave.Type, Path: p.config.Config.Enclave.Path, Args: p.config.Config.Enclave.Args, + IsProductEnclave: p.config.Config.Enclave.IsProductEnclave, RaType: p.config.Config.Enclave.RaType, RaEpidSpid: p.config.Config.Enclave.RaEpidSpid, RaEpidSubscriptionKey: p.config.Config.Enclave.RaEpidSubscriptionKey, diff --git a/rune/libcontainer/specconv/spec_linux.go b/rune/libcontainer/specconv/spec_linux.go index e515c87b8f3bdd2035ad37db90561a11783bff30..cb7d12f621cfbd049041ca9c5a1aacb5f7f35831 100644 --- a/rune/libcontainer/specconv/spec_linux.go +++ b/rune/libcontainer/specconv/spec_linux.go @@ -334,9 +334,22 @@ func createEnclaveConfig(spec *specs.Spec, config *configs.Config) { args = strings.Join(a, " ") } + isProductEnclave := filterOut(env, "ENCLAVE_IS_PRODUCT_ENCLAVE") + if isProductEnclave == "" { + isProductEnclave = libcontainerUtils.SearchLabels(config.Labels, "enclave.is_product_enclave") + } + var is_product_enclave uint32 + if strings.EqualFold(isProductEnclave, "false") { + is_product_enclave = sgx.DebugEnclave + } else if strings.EqualFold(isProductEnclave, "true") { + is_product_enclave = sgx.ProductEnclave + } else { + is_product_enclave = sgx.InvalidEnclaveType + } + raType := filterOut(env, "ENCLAVE_RA_TYPE") if raType == "" { - raType = libcontainerUtils.SearchLabels(config.Labels, "ra_type") + raType = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_type") } var ra_type uint32 if strings.EqualFold(raType, "EPID") { @@ -349,17 +362,17 @@ func createEnclaveConfig(spec *specs.Spec, config *configs.Config) { ra_epid_spid := filterOut(env, "ENCLAVE_RA_EPID_SPID") if ra_epid_spid == "" { - ra_epid_spid = libcontainerUtils.SearchLabels(config.Labels, "ra_epid_spid") + ra_epid_spid = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_spid") } ra_epid_subscription_key := filterOut(env, "ENCLAVE_RA_EPID_SUB_KEY") if ra_epid_subscription_key == "" { - ra_epid_subscription_key = libcontainerUtils.SearchLabels(config.Labels, "ra_epid_subscription_key") + ra_epid_subscription_key = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_subscription_key") } linkable := filterOut(env, "ENCLAVE_RA_EPID_IS_LINKABLE") if linkable == "" { - linkable = libcontainerUtils.SearchLabels(config.Labels, "ra_epid_is_linkable") + linkable = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_is_linkable") } var ra_epid_is_linkable uint32 if strings.EqualFold(linkable, "true") { @@ -375,6 +388,7 @@ func createEnclaveConfig(spec *specs.Spec, config *configs.Config) { Type: etype, Path: path, Args: args, + IsProductEnclave: is_product_enclave, RaType: ra_type, RaEpidSpid: ra_epid_spid, RaEpidSubscriptionKey: ra_epid_subscription_key, diff --git a/rune/libenclave/attestation/sgx/attest.go b/rune/libenclave/attestation/sgx/attest.go index c2e1082cbcbde04203c7b255328ddb3213a655e5..27ceddb0dffde9a765d895dfbf1dc0436d26cf6c 100644 --- a/rune/libenclave/attestation/sgx/attest.go +++ b/rune/libenclave/attestation/sgx/attest.go @@ -6,3 +6,10 @@ const ( EPID DCAP ) + +// RA Enclave Type +const ( + InvalidEnclaveType = iota + DebugEnclave + ProductEnclave +) diff --git a/rune/libenclave/configs/config.go b/rune/libenclave/configs/config.go index f06fffb95d7e97161e60e2200e308afb76e93de2..364584818d7829f5184b7e933a2b71ef4b288d9a 100644 --- a/rune/libenclave/configs/config.go +++ b/rune/libenclave/configs/config.go @@ -4,6 +4,7 @@ type InitEnclaveConfig struct { Type string `json:"type"` Path string `json:"path"` Args string `json:"args"` + IsProductEnclave uint32 `json:"is_product_enclave"` RaType uint32 `json:"ra_type"` RaEpidSpid string `json:"ra_epid_spid"` RaEpidSubscriptionKey string `json:"ra_epid_subscription_key"`