mirror of
https://github.com/matter-labs/nixsgx.git
synced 2025-07-21 15:33:56 +02:00
refactor: replace mkSGXContainer with sgxGramineContainer
- Deprecate `mkSGXContainer` in favor of `sgxGramineContainer`. - Update references to use the new container creation function. - Streamline the codebase by simplifying `overlays/libTee/default.nix`. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer
parent
b080c32f2a
commit
1e8c8ed1c7
GPG key ID:
F519A1143B3FBE32
5 changed files with 269 additions and 269 deletions
13
overlays/libTee/default.nix
Normal file
13
overlays/libTee/default.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
{ ... }:
|
||||
final: prev:
|
||||
{
|
||||
nixsgxLib.mkSGXContainer = final.lib.warn "`nixsgxLib.mkSGXContainer` is deprecated, use `pkgs.lib.tee.sgxGramineContainer`" final.lib.tee.sgxGramineContainer;
|
||||
|
||||
lib = prev.lib.extend (libFinal: libPrev: {
|
||||
tee = libPrev.tee or { } // {
|
||||
sgxGramineContainer = args: final.callPackage ./sgxGramineContainer.nix args;
|
||||
};
|
||||
});
|
||||
}
|
||||
253
overlays/libTee/sgxGramineContainer.nix
Normal file
253
overlays/libTee/sgxGramineContainer.nix
Normal file
|
|
@ -0,0 +1,253 @@
|
|||
{ lib
|
||||
, pkgs
|
||||
, writeClosure
|
||||
, coreutils
|
||||
, curl
|
||||
, nixsgx
|
||||
, openssl
|
||||
, packages
|
||||
, rsync
|
||||
, entrypoint
|
||||
, name
|
||||
, tag ? null
|
||||
, keyfile ? ./test-enclave-key.pem
|
||||
, isAzure ? false
|
||||
, manifest ? { }
|
||||
, sgx_default_qcnl_conf ? null
|
||||
, extraCmd ? ":"
|
||||
, extraPostBuild ? ""
|
||||
, extraChrootCommands ? ""
|
||||
, appDir ? "/app"
|
||||
, appName ? "app"
|
||||
, sigFile ? null
|
||||
, extendedPackages ? [ ]
|
||||
, customRecursiveMerge ? null
|
||||
}:
|
||||
assert lib.assertMsg (!(isAzure && sgx_default_qcnl_conf != null)) "sgx_default_qcnl_conf can't be set for Azure";
|
||||
let
|
||||
manifestRecursiveMerge =
|
||||
base: mod: with lib.attrsets; let
|
||||
mergeByPathWithOp = path: action: setAttrByPath path (
|
||||
if hasAttrByPath path mod
|
||||
then action (getAttrFromPath path base) (getAttrFromPath path mod)
|
||||
else getAttrFromPath path base
|
||||
);
|
||||
mergeListByPath = path: mergeByPathWithOp path (a: b: a ++ b);
|
||||
mergeEnvPathByPath = path: mergeByPathWithOp path (a: b: a + ":" + b);
|
||||
in
|
||||
recursiveUpdate base (recursiveUpdate mod (
|
||||
# manually merge the relevant lists / strings
|
||||
mergeListByPath [ "fs" "mounts" ]
|
||||
// mergeListByPath [ "sgx" "trusted_files" ]
|
||||
// mergeEnvPathByPath [ "loader" "env" "LD_LIBRARY_PATH" ]
|
||||
));
|
||||
manifest_base = {
|
||||
libos = { inherit entrypoint; };
|
||||
fs = {
|
||||
mounts = [
|
||||
{ path = "/var/tmp"; type = "tmpfs"; }
|
||||
{ path = "/tmp"; type = "tmpfs"; }
|
||||
{ path = "${appDir}/.dcap-qcnl"; type = "tmpfs"; }
|
||||
{ path = "${appDir}/.az-dcap-client"; type = "tmpfs"; }
|
||||
];
|
||||
root = { uri = "file:/"; };
|
||||
start_dir = "${appDir}";
|
||||
};
|
||||
loader = {
|
||||
argv = [ entrypoint ];
|
||||
entrypoint = "file:{{ gramine.libos }}";
|
||||
env = {
|
||||
AZDCAP_COLLATERAL_VERSION = "v4";
|
||||
AZDCAP_DEBUG_LOG_LEVEL = "ignore";
|
||||
HOME = "${appDir}";
|
||||
LD_LIBRARY_PATH = (lib.makeLibraryPath [
|
||||
(if isAzure then nixsgx.azure-dcap-client.out else nixsgx.sgx-dcap.default_qpl)
|
||||
pkgs.curl.out
|
||||
]) + ":{{ gramine.runtimedir() }}:/lib";
|
||||
MALLOC_ARENA_MAX = "1";
|
||||
PATH = "/bin";
|
||||
SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
|
||||
};
|
||||
log_level = "error";
|
||||
};
|
||||
sgx = {
|
||||
remote_attestation = "dcap";
|
||||
trusted_files = [
|
||||
"file:${appDir}/"
|
||||
"file:/bin/"
|
||||
"file:/etc/gai.conf"
|
||||
"file:/etc/ssl/certs/ca-bundle.crt"
|
||||
"file:/lib/"
|
||||
"file:/nix/"
|
||||
"file:{{ gramine.libos }}"
|
||||
"file:{{ gramine.runtimedir() }}/"
|
||||
] ++ (if !isAzure then [
|
||||
"file:/etc/sgx_default_qcnl.conf"
|
||||
] else [ ]);
|
||||
};
|
||||
sys = {
|
||||
enable_extra_runtime_domain_names_conf = true;
|
||||
enable_sigterm_injection = true;
|
||||
};
|
||||
};
|
||||
|
||||
mergedManifest = (if customRecursiveMerge == null then manifestRecursiveMerge else customRecursiveMerge) manifest_base manifest;
|
||||
|
||||
tomlFormat = pkgs.formats.toml { };
|
||||
manifestFile = tomlFormat.generate "${name}.manifest.toml" mergedManifest;
|
||||
|
||||
contents = pkgs.buildEnv {
|
||||
name = "image-root-${appName}";
|
||||
|
||||
paths = with pkgs.dockerTools; with nixsgx;[
|
||||
openssl.out
|
||||
curl.out
|
||||
gramine
|
||||
sgx-dcap.quote_verify
|
||||
caCertificates
|
||||
]
|
||||
++ (if isAzure then [
|
||||
azure-dcap-client
|
||||
] else [
|
||||
sgx-dcap.default_qpl
|
||||
])
|
||||
++ packages;
|
||||
|
||||
pathsToLink = [ "/bin" "/lib" "/etc" "/share" "${appDir}" ];
|
||||
postBuild = ''
|
||||
(
|
||||
set -e
|
||||
mkdir -p $out/{etc,var/run}
|
||||
mkdir -p $out/${appDir}/{.dcap-qcnl,.az-dcap-client}
|
||||
ln -s ${manifestFile} $out/${appDir}/${appName}.manifest.toml
|
||||
# Increase IPv4 address priority
|
||||
printf "precedence ::ffff:0:0/96 100\n" > $out/etc/gai.conf
|
||||
${
|
||||
if sgx_default_qcnl_conf != null then
|
||||
"rm -f $out/etc/sgx_default_qcnl.conf; ln -s ${sgx_default_qcnl_conf} $out/etc/sgx_default_qcnl.conf;"
|
||||
else ""
|
||||
}
|
||||
eval "${extraPostBuild}"
|
||||
)
|
||||
'';
|
||||
};
|
||||
|
||||
extendedContents = pkgs.buildEnv {
|
||||
name = "extended-root-${appName}";
|
||||
|
||||
paths = with pkgs.dockerTools; with nixsgx;[
|
||||
coreutils
|
||||
restart-aesmd
|
||||
sgx-psw
|
||||
usrBinEnv
|
||||
binSh
|
||||
fakeNss
|
||||
] ++ extendedPackages;
|
||||
|
||||
pathsToLink = [ "/bin" "/lib" "/etc" "/share" ];
|
||||
|
||||
postBuild =
|
||||
if sgx_default_qcnl_conf != null then ''
|
||||
(
|
||||
set -e
|
||||
mkdir -p $out/etc
|
||||
rm -f $out/etc/sgx_default_qcnl.conf
|
||||
ln -s ${sgx_default_qcnl_conf} $out/etc/sgx_default_qcnl.conf
|
||||
)
|
||||
'' else null;
|
||||
};
|
||||
|
||||
config = {
|
||||
Env = [
|
||||
"SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt"
|
||||
"HOME=${appDir}"
|
||||
"LD_LIBRARY_PATH=${lib.makeLibraryPath [ pkgs.curl.out (if isAzure then nixsgx.azure-dcap-client.out else nixsgx.sgx-dcap.default_qpl)]}"
|
||||
];
|
||||
Entrypoint = [ "/bin/sh" "-c" ];
|
||||
Cmd = [
|
||||
''
|
||||
${extraCmd};
|
||||
if [ -n "$GRAMINE_DIRECT" ]; then
|
||||
exec gramine-direct ${appName};
|
||||
else
|
||||
[[ -r /var/run/aesmd/aesm.socket ]] || restart-aesmd >&2;
|
||||
exec gramine-sgx ${appName};
|
||||
fi
|
||||
''
|
||||
];
|
||||
WorkingDir = "${appDir}";
|
||||
};
|
||||
|
||||
|
||||
# create a base image with the nix store included, because the derived image
|
||||
# will run gramine-sgx-sign and has does not include store paths,
|
||||
# otherwise all store paths from the `fakeRootCommands` will be included.
|
||||
appImage = pkgs.dockerTools.buildLayeredImage { name = "${name}-app"; inherit contents; };
|
||||
|
||||
addGramineManifest = fromImage:
|
||||
let
|
||||
mkNixStore = contents:
|
||||
let
|
||||
contentsList = if builtins.isList contents then contents else [ contents ];
|
||||
in
|
||||
''
|
||||
${rsync}/bin/rsync -ar --files-from=${writeClosure contentsList} / ./
|
||||
'';
|
||||
|
||||
in
|
||||
pkgs.dockerTools.buildLayeredImage
|
||||
{
|
||||
name = "${name}-manifest-${appName}";
|
||||
inherit tag;
|
||||
inherit contents;
|
||||
inherit fromImage;
|
||||
|
||||
includeStorePaths = false;
|
||||
extraCommands = (mkNixStore contents) + ''
|
||||
(
|
||||
set -e
|
||||
CHROOT=$(pwd)
|
||||
appDir="${appDir}"
|
||||
cd "''${appDir#/}"
|
||||
HOME="''${appDir#/}" ${nixsgx.gramine}/bin/gramine-manifest ${manifestFile} ${appName}.manifest;
|
||||
${nixsgx.gramine}/bin/gramine-sgx-sign \
|
||||
--chroot "$CHROOT" \
|
||||
--manifest ${appName}.manifest \
|
||||
--output ${appName}.manifest.sgx \
|
||||
--key ${keyfile};
|
||||
eval "${extraChrootCommands}"
|
||||
cd "$CHROOT"
|
||||
chmod u+wx -R nix
|
||||
rm -fr nix
|
||||
)
|
||||
'';
|
||||
};
|
||||
|
||||
injectSigFile = fromImage:
|
||||
if sigFile != null then
|
||||
pkgs.dockerTools.buildLayeredImage
|
||||
{
|
||||
inherit name;
|
||||
inherit config;
|
||||
inherit tag;
|
||||
inherit fromImage;
|
||||
|
||||
includeStorePaths = false;
|
||||
extraCommands = ''
|
||||
mkdir -p ${appDir}
|
||||
cp ${sigFile} ${appDir}/${appName}.sig
|
||||
'';
|
||||
}
|
||||
else fromImage;
|
||||
|
||||
extendImage = fromImage:
|
||||
pkgs.dockerTools.buildLayeredImage
|
||||
{
|
||||
inherit name;
|
||||
inherit tag;
|
||||
inherit config;
|
||||
inherit fromImage;
|
||||
contents = extendedContents;
|
||||
};
|
||||
in
|
||||
injectSigFile (extendImage (addGramineManifest appImage))
|
||||
39
overlays/libTee/test-enclave-key.pem
Normal file
39
overlays/libTee/test-enclave-key.pem
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIG5AIBAAKCAYEAwDrEJDyGnIGv/xWF4/MQtVEshpft/xGECSdjuHOU87nwCWon
|
||||
hirmOyggPPU772tobmaqRhAMHn0NwvRyFCQcSwTIjd0e/cfwH/QtEd/fp4yaw/z7
|
||||
FZmesTm+wjaobnRfPwrNHAfM8U2EQPXp1yYyjUqPVEXb/7ivdR+u7qnb0o6oNfzA
|
||||
ibRF6H+Fozj5FwepfbQ1DTauTEwdjywD+/21W+Ru5qF7SQVHYwf9OuyD4yZBm9os
|
||||
0Aqnk1nO6ZUSJfrL1gd10LoblnPUjNxwQtWhxIPyeKRYwmVpoaYL45U+6iNOkBiL
|
||||
PyGJDC+lq+AS8YtwzPOt3pUUpFh/XZyxSHla3Q8qPAikjcv1DvTiK+NVEVXoFrbs
|
||||
/uG6Ii9BSRbZ3NQH1bOLtdkW7W6GPGCMr/KuXEvIQaOpDb27/DEtvCh3T/9vrKsO
|
||||
etpTI0an6NZ1oshZ3X2TxZ9nNxh9zMvPswXBdy9O9/WybAN6a1PvIb3v66bxJW6T
|
||||
Pu87/q0DKzeMM20pAgEDAoIBgQCAJy1tfa8TAR//Y66X92B44MhZup6qC61bb5fQ
|
||||
TQ330Uqw8W+ux0QncBV9+NKfnPBJmcbZYAgUU16B+EwNbWgyAzBek2n+hUq/+B4L
|
||||
6pUaXbyCqKdju78g0SnWzxr0TZTUsd4Sr932M62Ao/E6GXcI3F+Ng+f/0HT4v8n0
|
||||
cT03CcV5UysGeC6a/65s0KYPWnD+eCNeJHQy3WkKHVf9U849QvSZwPzbWNpCBVN8
|
||||
na1CGYESkXM1XG+3kTSbuLbD/Ia8KvGsaOeVORvhXr04kD9qW2ioaisSAcXELHY7
|
||||
qFcktM1cYnDJn1/LcCH6tUlnJdGIKWYlbBcmJvhT2FqpULg5IPldNiu9ybh5yQY9
|
||||
HB0pnzg6Ldcb/aunyjdwXgcaPgdkOOpnqRYGq6yrmWk6WsnNMK/QFmgxadbfOU0i
|
||||
xjSrSYVItugHwOrH2eH842jBP2wbe1UJCOrKNytzZ3mBcb0RJbbFYjV0QzdPeVTN
|
||||
Y9ermQTt29tJVrd+Emzo8CK4+gMCgcEA4sXchskGNcoChkDpAqie0W2YLm2XDyPY
|
||||
CoiA+OVLc5lDd995Vqe2kCIC8VMMGIHhxG3NIqxrfxpH5LvqDczphyH6dlWl/O2M
|
||||
CrS/67NjCTm6935ADeR0qndYdMm5XyfYEjl5qESoq4oNq4Pg/0/P1Q/mhN8GQiKb
|
||||
qYAIHE/28dw1tsF6Kl7oqALpBXLQ/iRuFqJmrSPgQ32c5bEQUBD3F7HZq8T7V+O2
|
||||
7/jH8A1A2XddnddIe6fTqboFsghcPAHrAoHBANkBLsdTugDUKDSNa2tUo9ONPU2X
|
||||
gRg+6PDa2ZEzcL961w2laLoKwsrlb8J9GL5Q1LxHx4PGhmwDwvscPzyzXQA7ubnh
|
||||
vPQv1E2SmOSFxkmtWMfz6kcAw/wIlavAFdZPJK0ksnIWzTfi9Y92jdkar9Ny2gSj
|
||||
BoF8XgPbMeuvMV008gjXOETaCk986+gOh4LEyZ2iLYruJsRIH7n/iSDKLsXE4yQd
|
||||
ZuW68IQlJ/2a65DKDCLNgdVFVRfXWhvG++H0OwKBwQCXLpMEhgQj3AGu1fCscGng
|
||||
87rJnmS0wpAHBatQmNz3u4JP6lDkb88KwVdLjLK7AUEtnojByEeqEYVDJ/FeiJuv
|
||||
a/xO48P987KxzdVHzOyw0SdPqYAJQvhxpOWjMSY/b+Vhe6ZwLcXHsV5yV+tU39/j
|
||||
X+8DP1mBbGfGVVq9iqShPXkkgPwcP0XFV0YDoeCpbZ65wZnIwpWCU73udgrgC09l
|
||||
ITvH2KeP7SSf+y/1Xis7pOkT5Nr9Go0b0VkhWugoAUcCgcEAkKt0hOJ8AI1wIwjy
|
||||
R43CjQjTiQ+rZX9F9ec7tiJLKlHks8ObJrHXMe5Kgai7KYs4fYUvrS8ESAKB/L1/
|
||||
fczoqtJ70UEoosqNiQxl7a6EMR47L/fxhKstUrBjx9Vj5DTDHhh29rneJUH5Ck8J
|
||||
O2cf4kyRWGyvAP2UApIhR8og6M32sI962JFcNP3ymrRaVy3bvmweXJ7Egtq/0VUG
|
||||
FdwfLoNCGBOZ7nygWBjFU7ydCzFdbIkBONjjZTo8EoSn6/gnAoHBAJ/XSbhoVzkI
|
||||
CgW7gXSp+qKMhtbR2QawL3006KfQbK/sdcJ0Cyd4IfHXswrFQKV4BrL4tOxay1PT
|
||||
HoQZW5+pLTbZjz3d0tDU9WpSd6FNovoxB6lUA3ymD4ay8Zysy3FflNqOSO6XkwKq
|
||||
0GApQ6pIiDTst+LpnfgvQBDAnJXK3Hik2wDgXThXEofUoMDcGNsQ+NbdackR7/yL
|
||||
8ep5ZLAhczGi4XE471ut48CHtxKq0eGde/lHx0Origk9PPbsNoH2XA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue