On Wed, 15 May 2019, Andy Lutomirski wrote: > On Wed, May 15, 2019 at 3:46 PM James Morris <jmorris@xxxxxxxxx> wrote: > > > > You could try user.sigstruct, which does not require any privs. > > > > I don't think I understand your proposal. What file would this > attribute be on? What would consume it? It would be on the enclave file, so you keep the sigstruct bound to it, rather than needing a separate file to manage. It would simplify any LSM policy check. It would be consumed by (I guess) the SGX_INIT_THE_ENCLAVE ioctl in your example, instead of having a 2nd fd. -- James Morris <jmorris@xxxxxxxxx>
