On Mon, May 13, 2019 at 01:29:26PM +0300, Jarkko Sakkinen wrote: > I did study through SDK's file format and realized that it does not > does make sense after all to embed one. > > To implement it properly you would probably need a new syscall (lets say > sgx_load_enclave) and also that enclaves are not just executables > binaries. It is hard to find a generic format for them as applications > range from simply protecting part of an application to running a > containter inside enclave. When I looked at SDK's data structures embedded to the ELF they contain data that is also used by the run-time. Thus, run-time would anyway need to also parse the file containing the enclave. There is not same way a single rigid structure of what executable means as for normal application and in many cases enclave could be just used to seal a portion of the code. In extreme case you might construct enclave even on run-time. I think SIGSTRUCT in a file is the right choice. It is the lowest common denominator for enclaves that locks in its contents and is same for any enclave. Practicing access control to that file should be enough to define whatever security policy required. I'm still puzzling what kind of changes you were discussing considering SGX_IOC_ENCLAVE_ADD_PAGE. /Jarkko
