Skip to content

Commit 8bb2a40

Browse files
symphoriensymphorien
authored
sgx-psw+aesmd: 2.24 -> 2.25 (#353041)
2 parents 6664a9d + 6524b07 commit 8bb2a40

File tree

4 files changed

+183
-37
lines changed

4 files changed

+183
-37
lines changed

‎nixos/modules/services/security/aesmd.nix‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
{ config, options, pkgs, lib, ... }:
2-
with lib;
32
let
3+
inherit (lib) concatStringsSep literalExpression makeLibraryPath mkEnableOption
4+
mkForce mkIf mkOption mkPackageOption mkRemovedOptionModule optional types;
5+
46
cfg = config.services.aesmd;
57
opt = options.services.aesmd;
68

7-
sgx-psw = pkgs.sgx-psw.override { inherit (cfg) debug; };
9+
sgx-psw = cfg.package;
810

911
configFile = with cfg.settings; pkgs.writeText "aesmd.conf" (
1012
concatStringsSep "\n" (
@@ -18,13 +20,17 @@ let
1820
);
1921
in
2022
{
23+
imports = [
24+
(mkRemovedOptionModule [ "debug" ] ''
25+
Enable debug mode by overriding the aesmd package directly:
26+
27+
services.aesmd.package = pkgs.sgx-psw.override { debug = true; };
28+
'')
29+
];
30+
2131
options.services.aesmd = {
2232
enable = mkEnableOption "Intel's Architectural Enclave Service Manager (AESM) for Intel SGX";
23-
debug = mkOption {
24-
type = types.bool;
25-
default = false;
26-
description = "Whether to build the PSW package in debug mode.";
27-
};
33+
package = mkPackageOption pkgs "sgx-psw" { };
2834
environment = mkOption {
2935
type = with types; attrsOf str;
3036
default = { };
@@ -126,7 +132,7 @@ in
126132
"|/dev/sgx_enclave"
127133
];
128134

129-
serviceConfig = rec {
135+
serviceConfig = {
130136
ExecStartPre = pkgs.writeShellScript "copy-aesmd-data-files.sh" ''
131137
set -euo pipefail
132138
whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin"

‎pkgs/os-specific/linux/sgx/psw/cppmicroservices-no-mtime.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
2+
index aee499e9..13fa89d4 100644
3+
--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
4+
+++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
5+
@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index,
6+
const_cast<mz_zip_archive*>(&m_ZipArchive), index)
7+
? true
8+
: false;
9+
- stat.modifiedTime = zipStat.m_time;
10+
+ stat.modifiedTime = 0;
11+
stat.crc32 = zipStat.m_crc32;
12+
// This will limit the size info from uint64 to uint32 on 32-bit
13+
// architectures. We don't care because we assume resources > 2GB
14+
diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c
15+
index 6b0ebd7a..fa2aebca 100644
16+
--- a/external/CppMicroServices/third_party/miniz.c
17+
+++ b/external/CppMicroServices/third_party/miniz.c
18+
@@ -170,7 +170,7 @@
19+
// If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or
20+
// get/set file times, and the C run-time funcs that get/set times won't be called.
21+
// The current downside is the times written to your archives will be from 1979.
22+
-//#define MINIZ_NO_TIME
23+
+#define MINIZ_NO_TIME
24+
25+
// Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's.
26+
//#define MINIZ_NO_ARCHIVE_APIS

‎pkgs/os-specific/linux/sgx/psw/default.nix‎

Lines changed: 111 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,142 @@
11
{ stdenv
22
, lib
33
, fetchurl
4+
, fetchFromGitHub
45
, cmake
56
, coreutils
67
, curl
78
, file
9+
, git
810
, makeWrapper
911
, nixosTests
1012
, protobuf
1113
, python3
12-
, sgx-sdk
14+
, ocaml
15+
, ocamlPackages
1316
, which
1417
, debug ? false
1518
}:
1619
stdenv.mkDerivation rec {
17-
inherit (sgx-sdk) patches src version versionTag;
1820
pname = "sgx-psw";
21+
# Version as given in se_version.h
22+
version = "2.25.100.3";
23+
# Version as used in the Git tag
24+
versionTag = "2.25";
1925

26+
src = fetchFromGitHub {
27+
owner = "intel";
28+
repo = "linux-sgx";
29+
rev = "sgx_${versionTag}";
30+
hash = "sha256-RR+vFTd9ZM6XUn3KgQeUM+xoj1Ava4zQzFYA/nfXyaw=";
31+
fetchSubmodules = true;
32+
};
33+
34+
# Extract Intel-provided, pre-built enclaves and libs.
2035
postUnpack =
2136
let
2237
# Fetch the pre-built, Intel-signed Architectural Enclaves (AE). They help
2338
# run user application enclaves, verify launch policies, produce remote
2439
# attestation quotes, and do platform certification.
2540
ae.prebuilt = fetchurl {
2641
url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
27-
hash = "sha256-IGV9VEwY/cQBV4Vz2sps4JgRweWRl/l08ocb9P4SH8Q=";
42+
hash = "sha256-Hlh96rYOyml2y50d8ASKz6U97Fl0hbGYECeZiG9nMSQ=";
43+
};
44+
45+
# Pre-built ipp-crypto with mitigations.
46+
optlib.prebuilt = fetchurl {
47+
url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/optimized_libs_${versionTag}.tar.gz";
48+
hash = "sha256-7mDTaLtpOQLHQ6Fv+FWJ2k/veJZPXIcuj7kOdRtRqhg=";
2849
};
29-
# Also include the Data Center Attestation Primitives (DCAP) platform
30-
# enclaves.
50+
51+
# Fetch the Data Center Attestation Primitives (DCAP) platform enclaves
52+
# and pre-built sgxssl.
3153
dcap = rec {
32-
version = "1.21";
54+
version = "1.22";
3355
filename = "prebuilt_dcap_${version}.tar.gz";
3456
prebuilt = fetchurl {
3557
url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
36-
hash = "sha256-/PPD2MyNxoCwzNljIFcpkFvItXbyvymsJ7+Uf4IyZuk=";
58+
hash = "sha256-RTpJQ6epoAN8YQXSJUjJQ5mPaQIiQpStTWFsnspjjDQ=";
3759
};
3860
};
3961
in
40-
sgx-sdk.postUnpack + ''
62+
''
63+
# Make sure this is the right version of linux-sgx
64+
grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
65+
|| (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
66+
67+
tar -xzvf ${ae.prebuilt} -C $sourceRoot/
68+
tar -xzvf ${optlib.prebuilt} -C $sourceRoot/
69+
4170
# Make sure we use the correct version of prebuilt DCAP
4271
grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \
4372
|| (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1)
4473
45-
tar -zxf ${ae.prebuilt} -C $sourceRoot/
46-
tar -zxf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration/
74+
tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source ./prebuilt/
75+
tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration ./psw/
76+
'';
77+
78+
patches = [
79+
# There's a `make preparation` step that downloads some prebuilt binaries
80+
# and applies some patches to the in-repo git submodules. This patch removes
81+
# the parts that download things, since we can't do that inside the sandbox.
82+
./disable-downloads.patch
83+
84+
# This patch disables mtime in bundled zip file for reproducible builds.
85+
#
86+
# Context: The `aesm_service` binary depends on a vendored library called
87+
# `CppMicroServices`. At build time, this lib creates and then bundles
88+
# service resources into a zip file and then embeds this zip into the
89+
# binary. Without changes, the `aesm_service` will be different after every
90+
# build because the embedded zip file contents have different modified times.
91+
./cppmicroservices-no-mtime.patch
92+
];
93+
94+
postPatch =
95+
let
96+
# The base directories we want to copy headers from. The exact headers are
97+
# parsed from <linux/installer/common/sdk/BOMs/sdk_base.txt>
98+
bomDirsToCopyFrom = builtins.concatStringsSep "|" [
99+
"common/"
100+
"external/dcap_source/"
101+
"external/ippcp_internal/"
102+
"external/sgx-emm/"
103+
"psw/"
104+
"sdk/tlibcxx/"
105+
];
106+
in
107+
''
108+
patchShebangs \
109+
external/sgx-emm/create_symlink.sh \
110+
linux/installer/bin/build-installpkg.sh \
111+
linux/installer/common/psw/createTarball.sh \
112+
linux/installer/common/psw/install.sh
113+
114+
# Run sgx-sdk preparation step
115+
make preparation
116+
117+
# Build a fake SGX_SDK directory. Normally sgx-psw depends on first building
118+
# all of sgx-sdk, however we can actually build them independently by just
119+
# copying a few header files and building `sgx_edger8r` separately.
120+
mkdir .sgxsdk
121+
export SGX_SDK="$(readlink -f .sgxsdk)"
122+
123+
# Parse the BOM for the headers we need, then copy them into SGX_SDK
124+
# Each line in the BOM.txt looks like:
125+
# <deliverydir>/...\t<installdir>/package/...\t....
126+
# TODO(phlip9): hardlink?
127+
sed -n -r 's:^<deliverydir>/(${bomDirsToCopyFrom})(\S+)\s<installdir>/package/(\S+)\s.*$:\1\2\n.sgxsdk/\3:p' \
128+
< linux/installer/common/sdk/BOMs/sdk_base.txt \
129+
| xargs --max-args=2 install -v -D
47130
'';
48131

49132
nativeBuildInputs = [
50133
cmake
51134
file
135+
git
52136
makeWrapper
137+
ocaml
138+
ocamlPackages.ocamlbuild
53139
python3
54-
sgx-sdk
55140
which
56141
];
57142

@@ -60,27 +145,24 @@ stdenv.mkDerivation rec {
60145
protobuf
61146
];
62147

63-
hardeningDisable = [
64-
# causes redefinition of _FORTIFY_SOURCE
65-
"fortify3"
66-
] ++ lib.optionals debug [
67-
"fortify"
68-
];
148+
dontUseCmakeConfigure = true;
69149

70-
postPatch = ''
71-
patchShebangs \
72-
linux/installer/bin/build-installpkg.sh \
73-
linux/installer/common/psw/createTarball.sh \
74-
linux/installer/common/psw/install.sh
75-
'';
150+
preBuild = ''
151+
# Build `sgx_edger8r`, the enclave .edl -> .h file codegen tool.
152+
# Then place it in `$SGX_SDK/bin` and `$SGX_SDK/bin/x64`.
153+
make -C sdk/edger8r/linux
154+
mkdir -p $SGX_SDK/bin/x64
155+
sgx_edger8r_bin="$(readlink -f build/linux/sgx_edger8r)"
156+
ln -s $sgx_edger8r_bin $SGX_SDK/bin/
157+
ln -s $sgx_edger8r_bin $SGX_SDK/bin/x64/
76158
77-
dontUseCmakeConfigure = true;
159+
# Add this so we can link against libsgx_urts.
160+
build_dir="$(readlink -f build/linux)"
161+
ln -s $build_dir $SGX_SDK/lib
162+
ln -s $build_dir $SGX_SDK/lib64
163+
'';
78164

79-
buildFlags = [
80-
"psw_install_pkg"
81-
] ++ lib.optionals debug [
82-
"DEBUG=1"
83-
];
165+
buildFlags = [ "psw_install_pkg" ] ++ lib.optionals debug [ "DEBUG=1" ];
84166

85167
installFlags = [
86168
"-C linux/installer/common/psw/output"

‎pkgs/os-specific/linux/sgx/psw/disable-downloads.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
diff --git a/Makefile b/Makefile
2+
index 19bc05a..6b1acd4 100644
3+
--- a/Makefile
4+
+++ b/Makefile
5+
@@ -50,13 +50,13 @@ tips:
6+
preparation:
7+
# As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
8+
# Only enable the download from git
9+
- git submodule update --init --recursive
10+
+ # git submodule update --init --recursive
11+
cd external/dcap_source/external/jwt-cpp && git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch >/dev/null 2>&1 || \
12+
git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch -R --check
13+
- ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
14+
+ # ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
15+
cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
16+
cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R
17+
- cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
18+
+ cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
19+
./external/sgx-emm/create_symlink.sh
20+
cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R
21+
cd external/cbor && cp -r libcbor sgx_libcbor
22+
@@ -64,8 +64,8 @@ preparation:
23+
cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
24+
cd external/ippcp_internal/ipp-crypto && git apply ../0001-IPP-crypto-for-SGX.patch > /dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX.patch --check -R
25+
cd external/ippcp_internal/ipp-crypto && mkdir -p build
26+
- ./download_prebuilt.sh
27+
- ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
28+
+ # ./download_prebuilt.sh
29+
+ # ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
30+
31+
psw:
32+
$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)

0 commit comments

Comments
 (0)