On 9/24/20 4:05 PM, Sean Christopherson wrote: > The problem is that enforcing permissions via mprotect() needs to be done > unconditionally, otherwise we end up with weird behavior where the existence > of an LSM will change what is/isn't allowed, even if the LSM(s) has no SGX > policy whatsover. Could we make this a bit less abstract, please? Could someone point to code or another examples that demonstrates how the mere existence of an LSM will change what is/isn't allowed? I can't seem to wrap my head around it as-is.
