> On 2/28/22 04:24, Jarkko Sakkinen wrote:
> >> Regarding the recent update of splitting the page permissions change
> >> request into two IOCTLS (RELAX and RESTRICT), can we combine them
> >> into one? That is, revert to how it was done in the v1 version?
> > They are logically separate complex functionalities:
> >
> > 1. "restrict" calls EMODPR and requires EACCEPT 2. "relax" increases
> > permissions up to vetted ("EADD") and could be
> > combined with EMODPE called inside enclave.
>
> It would be great to have a _slightly_ better justification than that.
> Existing permission interfaces like chmod or mprotect() don't have this
> asymmetry.
>
> I think you're saying that the underlying hardware implementation is
> asymmetric, so the interface should be too. I don't find that argument very
> convincing. If the hardware interface is arcane and we can make it look more
> sane in the ioctl() layer, we should that, asymmetry or not.
>
Very nice analogy with `mprotect` and agree to this. It would be simpler from
user space point of view if we can abstract this and maintain a single interface
to relax or restrict permission. But if committee feels having two IOCTLS is the way,
then will modify Gramine to adopt this approach.
