Re: [PATCH 0/6] Intel Secure Guard Extensions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 9 May 2016, Jarkko Sakkinen wrote:
> On Fri, May 06, 2016 at 01:54:14PM +0200, Thomas Gleixner wrote:
> > On Fri, 6 May 2016, Jarkko Sakkinen wrote:
> > 
> > > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> > > > It would be helpful and instructive for anyone involved in this debate
> > > > to review the following URL which details Intel's SGX licening
> > > > program:
> > > > 
> > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing
> > > 
> > > I think it would be good  to note that the licensing process is available
> > > only for Windows. For Linux you can only use debug enclaves at the
> > > moment. The default LE has "allow-all" policy for debug enclaves.
> > 
> > Which makes the feature pretty useless.
> >  
> > > > I think the only way forward to make all of this palatable is to
> > > > embrace something similar to what has been done with Secure Boot.  The
> > > > Root Enclave Key will need to be something which can be reconfigured
> > > > by the Platform Owner through BIOS/EFI.  That model would take Intel
> > > > off the hook from a security perspective and establish the notion of
> > > > platform trust to be a bilateral relationship between a service
> > > > provider and client.
> > > 
> > > This concern has been raised many times now. Sadly this did not make
> > > into Skyle but in future we will have one shot MSRs (can be set only
> > > once per boot cycle) for defining your own root of trust.
> > 
> > We'll wait for that to happen.
> 
> I fully understand if you (and others) want to keep this standpoint but
> what if we could get it to staging after I've revised it with suggested

This should not go to staging at all. Either this is going to be a real useful
driver or we just keep it out of tree.

> changes and internal changes in my TODO? Then it would not pollute the
> mainline kernel but still would be easily available for experimentation.

How are we supposed to experiment with that if there is no launch enclave for
Linux available?

Thanks,

	tglx
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel



[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux