On Tue, May 14, 2019 at 08:08:03AM -0700, Andy Lutomirski wrote:
> > Putting everything together, I'd suggest to:
> > - Change EADD ioctl to take source page's VMA permission as ("upper bound" of) EPCM permission. This make sure no one can circumvent LSM to generate executable code on the fly using SGX driver.
> > - Change EINIT ioctl to invoke (new?) LSM hook to validate SIGSTRUCT before issuing EINIT.
>
> I'm okay with this if the consensus is that having a .sigstruct file
> is too annoying.
SIGSTRUCT has two nice properties from kernel perspective:
- Static structure
- Fully defines enclave contents including the page permissions as
they are part of the measurement.
Making it as the "root of trust" really is the right thing and the most
robust way to deal with this.
/Jarkko
