Facing issues on executing binaries inside enclave

[sroy9gmu]

I have some binaries installed in /usr/local/bin (for ex. binary1) and supporting shared libraries in /usr/local/lib. If I execute this binary in my current working directory (for ex. /Downloads/test/) containing some required files (file 1, 2..) to be passed as parameters to this binary, I get expected result in the same working directory. But when I tried to execute this same command (binary1 file1 file2 ..) using gramine-sgx, I ended up facing errors.

Command: sudo gramine-sgx binary1 file1 file2 string1

Error: [P1:T1:] error: libos_init() failed in init_exec_handle: Permission denied (EACCES)

Makefile:

ARCH_LIBDIR ?= /lib/$(shell $(CC) -dumpmachine)

ifeq ($(DEBUG),1)
GRAMINE_LOG_LEVEL = debug
else
GRAMINE_LOG_LEVEL = error
endif

.PHONY: all
all: binary1.manifest
ifeq ($(SGX),1)
all: binary1.manifest.sgx binary1.sig
endif

binary1.manifest: manifest.template
	gramine-manifest \
		-Dlog_level=$(GRAMINE_LOG_LEVEL) \
		-Dexecdir=/home/<user>/Downloads/test \
		-Darch_libdir=$(ARCH_LIBDIR) \
		$< >$@

binary1.manifest.sgx: binary1.manifest
	gramine-sgx-sign \
		--manifest binary1.manifest \
		--output $@

binary1.sig: binary1.manifest.sgx

ifeq ($(SGX),)
GRAMINE = gramine-direct
else
GRAMINE = gramine-sgx
endif

.PHONY: clean
clean:
	$(RM) *.manifest *.manifest.sgx *.token *.sig

.PHONY: distclean
distclean: clean

manifest.template:

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/home/<user>/Downloads/test"

loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr{{ arch_libdir }}:/usr/local/lib"
loader.env.PATH = "{{ execdir }}"

loader.insecure__use_cmdline_argv = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr/lib", uri = "file:/usr/lib" },
  { path = "{{ execdir }}", uri = "file:{{ execdir }}" },
]

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.nonpie_binary = true
sgx.enclave_size = "512M"
sgx.max_threads = 4

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ execdir }}/",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
]

sgx.allowed_files = [
  "file:file1",
  "file:file2",
  "file:file3",
]

How can resolve this error and generate the same output as obtained without using gramine-sgx?

[dimakuv]

If I understood you correctly, you have some files under the directory /home/<user>/Downloads/test/.

Then this line in the manifest is wrong:

libos.entrypoint = "/home/<user>/Downloads/test"

The entrypoint must be the binary file, not a directory.

To be honest, I don't understand what exactly you want to do. What is the native command that you type in the terminal and it works? You should put the first argument (the binary) of the typed command in the manifest file's libos.entrypoint.

[sroy9gmu]

I apologize for the lack of clarity in my last post. I am mentioning below another example that can be reproduced on any machine running Ubuntu OS:

Working directory: /home/[user]/Downloads/test

Working directory contents: key256.txt, plaintext1kb.txt, Makefile, manifest.template

Non-sgx command: ..test$ openssl aes-256-cbc -in plaintext1kb.txt -out plaintext1kb.txt.enc -kfile key256.txt

Sgx command: ..test$ sudo gramine-sgx openssl aes-256-cbc -in plaintext1kb.txt -out plaintext1kb.txt.enc -kfile key256.txt

Error for sgx command: [P1:T1:] error: libos_init() failed in init_exec_handle: No such file or directory (ENOENT)

Makefile:

ARCH_LIBDIR ?= /lib/$(shell $(CC) -dumpmachine)

ifeq ($(DEBUG),1)
GRAMINE_LOG_LEVEL = debug
else
GRAMINE_LOG_LEVEL = error
endif

.PHONY: all
all: openssl.manifest
ifeq ($(SGX),1)
all: openssl.manifest.sgx openssl.sig
endif

openssl.manifest: manifest.template
	gramine-manifest \
		-Dlog_level=$(GRAMINE_LOG_LEVEL) \
		-Dexecdir=/home/<user>/Downloads/test \
		-Darch_libdir=$(ARCH_LIBDIR) \
		$< >$@

openssl.manifest.sgx: openssl.manifest
	gramine-sgx-sign \
		--manifest openssl.manifest \
		--output $@

openssl.sig: openssl.manifest.sgx

ifeq ($(SGX),)
GRAMINE = gramine-direct
else
GRAMINE = gramine-sgx
endif

.PHONY: clean
clean:
	$(RM) *.manifest *.manifest.sgx *.token *.sig

.PHONY: distclean
distclean: clean

manifest.template:

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/usr/bin/openssl"

loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr{{ arch_libdir }}"
loader.env.PATH = "{{ execdir }}"

loader.insecure__use_cmdline_argv = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr/lib", uri = "file:/usr/lib" },
  { path = "{{ execdir }}", uri = "file:{{ execdir }}" },
]

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.nonpie_binary = true
sgx.enclave_size = "512M"
sgx.max_threads = 4

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ execdir }}/",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
]

sgx.allowed_files = [
  "file:key256.txt",
  "file:plaintext1kb.txt",
  "file:plaintext1kb.txt.enc",
  "file:plaintext1kb.txt.dec",
]

If you need information about the remaining files in working directory, let me know, since I think they might be unnecessary for resolving this issue.

[dimakuv]

Thanks @sroy9gmu, now it got much clearer.

You forgot to add these two snippets:

fs.mounts = [
  ...
  { path = "/usr/bin/openssl", uri = "file:/usr/bin/openssl" },
]

sgx.trusted_files = [
  ...
  "file:/usr/bin/openssl",
]

I think adding these two lines is enough. Basically, you forgot to expose the openssl binary itself to Gramine.

[sroy9gmu]

Thank you very much for the support. These instructions worked for me.