On Fri, May 10, 2019 at 12:04 PM Jethro Beekman <jethro@xxxxxxxxxxxx> wrote: > > On 2019-05-10 11:56, Xing, Cedric wrote: > > Hi Jethro, > > > >> ELF files are explicitly designed such that you can map them (with mmap) > >> in 4096-byte chunks. However, sometimes there's overlap and you will > >> sometimes see that a particular offset is mapped twice because the first > >> half of the page in the file belongs to an RX range and the second half > >> to an R-only range. Also, ELF files don't (normally) describe stack, > >> heap, etc. which you do need for enclaves. > > > > You have probably misread my email. By mmap(), I meant the enclave file would be mapped via *multiple* mmap() calls, in the same way as what dlopen() would do in loading regular shared object. The intention here is to make the enclave file subject to the same checks as regular shared objects. > > No, I didn't misread your email. My original point still stands: > requiring that an enclave's memory is created from one or more mmap > calls of a file puts significant restrictions on the enclave's on-disk > representation. > For a tiny bit of background, Linux (AFAIK*) makes no effort to ensure the complete integrity of DSOs. What Linux *does* do (if so configured) is to make sure that only approved data is mapped executable. So, if you want to have some bytes be executable, those bytes have to come from a file that passes the relevant LSM and IMA checks. So we have two valid approaches, I think. Approach 1: we treat SGX exactly the same way and make it so that only bytes that pass the relevant checks can be mapped as code within an enclave. This imposes no particular restrictions on the file format -- we just need some API that takes an fd, an offset, and a length, and adds those bytes as code to an enclave. (It could also take a pointer and a length and make sure that the pointer points to executable memory -- same effect.) Approach 2: we decide that we want a stronger guarantee and that we *will* ensure the integrity of the enclave. This means: 2a) that we either need to load the entire thing from some approved file, and we commit to supporting one or more file formats. 2b) we need to check that the eventual enclave hash is approved. Or we could have a much shorter file that is just the hash and we check that. At its simplest, the file could be *only* the hash, and there could be an LSM callback to check it. In the future, if someone wants to allow enclaves to be embedded in DSOs, we could have a special ELF note or similar that contains an enclave hash or similar. 2c) same as 2b except that we expose the whole SIGSTRUCT, not just the hash. Here are some pros and cons of various bits: 1 and 2a allow anti-virus software to scan the enclave code, and 2a allows it to scan the whole enclave. I don't know if this is actually imporant. 2a is by far the most complicated kernel implementation. 2b and 2c are almost file-format agnostic. 1 is completely file format agnostic but, in exchange, it's much weaker. 2b and 2c should solve most (but not all) of the launch control complaints that Dr. Greg cares about, in the sense that the LSM policy quite literally validates that the enclave is approved. As a straw man design, I propose the following, which is mostly 2c. The whole loading process works almost as in Jarkko's current driver, but the actual ioctl that triggers EINIT changes. When you issue the ioctl, you pass in an fd and the SIGSTRUCT is loaded and checked from the fd. The idea is that software that ships an enclave will ship a .sgxsig file that is literally a SIGSTRUCT for the enclave. With SELinux, that file gets labeled something like sgx_enclave_sigstruct_t. And we have the following extra twist: if you're calling the EADD ioctl to add *code* to the enclave, the driver checks that the code being loaded is mapped executable. This way existing code-signing policies don't get subverted, and policies that want to impose full verification on the enclave can do so by verifying the .sigstruct file. What do you all think? * It's certainly the case that Linux does not *succeed* at preserving the overall integrity of shared objects. If nothing else, you can freely mremap() them however you like. And you can jump into them wherever you like.
