diff --git a/rune/libcontainer/configs/validate/validator.go b/rune/libcontainer/configs/validate/validator.go index c456f60a80832678aeeb205e04fb0dc1c8b0808c..b032e518bf9d2a6ed6a2a852815dee1ef53621b5 100644 --- a/rune/libcontainer/configs/validate/validator.go +++ b/rune/libcontainer/configs/validate/validator.go @@ -226,16 +226,22 @@ func (v *ConfigValidator) enclave(config *configs.Config) error { return err } - if config.Enclave.IsProductEnclave == sgx.InvalidEnclaveType { - return fmt.Errorf("Unsupported enclave.is_product_enclave Configuration %v!\n", config.Enclave.IsProductEnclave) - } + if config.Enclave.RaType != sgx.UnknownRaType { + if config.Enclave.IsProductEnclave == sgx.InvalidEnclaveType { + return fmt.Errorf("Unsupported enclave.is_product_enclave Configuration!\n") + } - if config.Enclave.RaType == sgx.InvalidRaType { - return fmt.Errorf("Unsupported enclave.attestation.ra_type Configuration %v!\n", config.Enclave.RaType) - } + if config.Enclave.RaEpidSpid == "" { + return fmt.Errorf("The enclave.attestation.ra_epid_spid Configuration isn't set!\n") + } - if config.Enclave.RaEpidIsLinkable == intelsgx.InvalidQuoteSignatureType { - return fmt.Errorf("Unsupported enclave.attestation.ra_epid_is_linkable Configuration %v!\n", config.Enclave.RaEpidIsLinkable) + if config.Enclave.RaEpidSubscriptionKey == "" { + return fmt.Errorf("The enclave.attestation.ra_epid_subscription_key Configuration isn't set!\n") + } + + if config.Enclave.RaEpidIsLinkable == intelsgx.InvalidQuoteSignatureType { + return fmt.Errorf("Unsupported enclave.attestation.ra_epid_is_linkable Configuration!\n") + } } return nil diff --git a/rune/libcontainer/specconv/spec_linux.go b/rune/libcontainer/specconv/spec_linux.go index cb7d12f621cfbd049041ca9c5a1aacb5f7f35831..901903bbf551798f1c53583ef208df6c10cf5857 100644 --- a/rune/libcontainer/specconv/spec_linux.go +++ b/rune/libcontainer/specconv/spec_linux.go @@ -334,53 +334,49 @@ func createEnclaveConfig(spec *specs.Spec, config *configs.Config) { args = strings.Join(a, " ") } - isProductEnclave := filterOut(env, "ENCLAVE_IS_PRODUCT_ENCLAVE") - if isProductEnclave == "" { - isProductEnclave = libcontainerUtils.SearchLabels(config.Labels, "enclave.is_product_enclave") - } - var is_product_enclave uint32 - if strings.EqualFold(isProductEnclave, "false") { - is_product_enclave = sgx.DebugEnclave - } else if strings.EqualFold(isProductEnclave, "true") { - is_product_enclave = sgx.ProductEnclave - } else { - is_product_enclave = sgx.InvalidEnclaveType - } - raType := filterOut(env, "ENCLAVE_RA_TYPE") if raType == "" { raType = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_type") } - var ra_type uint32 - if strings.EqualFold(raType, "EPID") { - ra_type = sgx.EPID - } else if strings.EqualFold(raType, "DCAP") { - ra_type = sgx.DCAP - } else { - ra_type = sgx.InvalidRaType - } - ra_epid_spid := filterOut(env, "ENCLAVE_RA_EPID_SPID") - if ra_epid_spid == "" { - ra_epid_spid = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_spid") - } + var enclaveRaType, sgxEnclaveType, raEpidIsLinkable uint32 = sgx.UnknownRaType, sgx.InvalidEnclaveType, intelsgx.InvalidQuoteSignatureType + var raEpidSpid, raEpidSubscriptionKey string + if raType != "" { + if strings.EqualFold(raType, "EPID") { + enclaveRaType = sgx.EPID + } else if strings.EqualFold(raType, "DCAP") { + enclaveRaType = sgx.DCAP + } - ra_epid_subscription_key := filterOut(env, "ENCLAVE_RA_EPID_SUB_KEY") - if ra_epid_subscription_key == "" { - ra_epid_subscription_key = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_subscription_key") - } + isProductEnclave := filterOut(env, "ENCLAVE_IS_PRODUCT_ENCLAVE") + if isProductEnclave == "" { + isProductEnclave = libcontainerUtils.SearchLabels(config.Labels, "enclave.is_product_enclave") + } + if strings.EqualFold(isProductEnclave, "false") { + sgxEnclaveType = sgx.DebugEnclave + } else if strings.EqualFold(isProductEnclave, "true") { + sgxEnclaveType = sgx.ProductEnclave + } - linkable := filterOut(env, "ENCLAVE_RA_EPID_IS_LINKABLE") - if linkable == "" { - linkable = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_is_linkable") - } - var ra_epid_is_linkable uint32 - if strings.EqualFold(linkable, "true") { - ra_epid_is_linkable = intelsgx.QuoteSignatureTypeLinkable - } else if strings.EqualFold(linkable, "false") { - ra_epid_is_linkable = intelsgx.QuoteSignatureTypeUnlinkable - } else { - ra_epid_is_linkable = intelsgx.InvalidQuoteSignatureType + raEpidSpid = filterOut(env, "ENCLAVE_RA_EPID_SPID") + if raEpidSpid == "" { + raEpidSpid = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_spid") + } + + raEpidSubscriptionKey = filterOut(env, "ENCLAVE_RA_EPID_SUB_KEY") + if raEpidSubscriptionKey == "" { + raEpidSubscriptionKey = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_subscription_key") + } + + linkable := filterOut(env, "ENCLAVE_RA_EPID_IS_LINKABLE") + if linkable == "" { + linkable = libcontainerUtils.SearchLabels(config.Labels, "enclave.attestation.ra_epid_is_linkable") + } + if strings.EqualFold(linkable, "true") { + raEpidIsLinkable = intelsgx.QuoteSignatureTypeLinkable + } else if strings.EqualFold(linkable, "false") { + raEpidIsLinkable = intelsgx.QuoteSignatureTypeUnlinkable + } } if etype != "" { @@ -388,11 +384,11 @@ func createEnclaveConfig(spec *specs.Spec, config *configs.Config) { Type: etype, Path: path, Args: args, - IsProductEnclave: is_product_enclave, - RaType: ra_type, - RaEpidSpid: ra_epid_spid, - RaEpidSubscriptionKey: ra_epid_subscription_key, - RaEpidIsLinkable: ra_epid_is_linkable, + IsProductEnclave: sgxEnclaveType, + RaType: enclaveRaType, + RaEpidSpid: raEpidSpid, + RaEpidSubscriptionKey: raEpidSubscriptionKey, + RaEpidIsLinkable: raEpidIsLinkable, } } } diff --git a/rune/libenclave/attestation/sgx/attest.go b/rune/libenclave/attestation/sgx/attest.go index 27ceddb0dffde9a765d895dfbf1dc0436d26cf6c..219bfaa324831c37ab72bf9f22ad19f0163f12d2 100644 --- a/rune/libenclave/attestation/sgx/attest.go +++ b/rune/libenclave/attestation/sgx/attest.go @@ -2,7 +2,7 @@ package sgx // import "github.com/opencontainers/runc/libenclave/attestation/sgx // RA Type const ( - InvalidRaType = iota + UnknownRaType = iota EPID DCAP )