Re: [PATCH 2/4] x86/sgx: Put enclaves into anonymous files

From: Jethro Beekman <jethro@fortanix.com>
To: Andy Lutomirski <luto@amacapital.net>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>,
	Andy Lutomirski <luto@kernel.org>,
	casey.schaufler@intel.com,
	Sean Christopherson <sean.j.christopherson@intel.com>,
	linux-sgx@vger.kernel.org, "Svahn, Kai" <kai.svahn@intel.com>,
	"Schlobohm, Bruce" <bruce.schlobohm@intel.com>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	Haitao Huang <haitao.huang@linux.intel.com>,
	ben@decadent.org.uk, toiwoton@gmail.com
Subject: Re: [PATCH 2/4] x86/sgx: Put enclaves into anonymous files
Date: Sat, 4 Apr 2020 07:46:40 +0200	[thread overview]
Message-ID: <454e7252-8827-510d-65f0-f2ca60208e27@fortanix.com> (raw)
In-Reply-To: <F117745A-E01B-499E-B9E4-201C1C08258D@amacapital.net>

[-- Attachment #1: Type: text/plain, Size: 2164 bytes --]

This appears to originate in Debian

Rationale: https://salsa.debian.org/kernel-team/initramfs-tools/-/merge_requests/9

Interestingly, they claim mmap(/dev/zero) is special-cased? Can we do the same for SGX?

Some allowances were made in https://salsa.debian.org/kernel-team/initramfs-tools/-/commit/d6c6eeca3540d18f5bce95b5ffcb1823ab3050ea

Including those people in this conversation.

Ben, Towi: for context, see https://lore.kernel.org/linux-sgx/20200319142434.GA11305@linux.intel.com/T/ and https://lore.kernel.org/linux-sgx/20200401084511.GE17325@linux.intel.com/T/

--
Jethro Beekman | Fortanix

On 2020-04-04 05:54, Andy Lutomirski wrote:
> 
> 
>> On Apr 3, 2020, at 3:08 PM, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> wrote:
>>
>> On Fri, Apr 03, 2020 at 08:50:08AM -0700, Casey Schaufler wrote:
>>>> How does smackfs interact with namespaces?
>>>
>>> Smack attributes are global. Aside from privilege issues, namespaces
>>> ignore and are ignored by Smack.
>>
>> Okay.
>>
>> For SGX, I foresee things as:
>>
>> 1. Existing files are global.
>> 2. If a policy of any kind is ever added it needs to be *per container*.
>>   I'm not sure whether PID or user namespace is the right choice here,
>>   but does not matter right now as the feature is not in the queue.
>>
>> To summarize:
>>
>> 1. We have a heterogeneous set of files (i.e. 'enclave' and 'provision'
>>   are not "different sames").
>> 2. The files probably will have heterogeneous visibility requirements.
>>
>> I think based on these premises own file system would be a more decent
>> choice than populating /dev. Beside, SGX hasn't been a driver for a
>> while.
>>
>> Andy, what do you think of this?
> 
> Probably okay.  There are two semantic questions you’ll have to address, though:
> 
> - What happens if you mount sgxfs twice?  Do you get two copies that can diverge from each other, or do you get two views of the same thing?
> 
> - Can it be instantiated from outside the root initns?
> 
> It’s certainly conceptually simpler to stick with device nodes. Why exactly is Ubuntu noexecing /dev?
> 
>>
>> /Jarkko

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4054 bytes --]