nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-27 02:34:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

sgx-psw: 2.27 -> 2.29; nixos/aesmd: update

Browse Source
This commit is contained in:
hayao
2026-05-27 00:12:35 +09:00
parent aaee6a0c2e
commit ccf6ab0bff
5 changed files with 115 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

115
nixos/modules/services/security/aesmd.nix
View File

@@ -1,6 +1,5 @@
{
config,
options,
pkgs,
lib,
...
@@ -20,7 +19,6 @@ let
;
cfg = config.services.aesmd;
opt = options.services.aesmd;
sgx-psw = cfg.package;
@@ -28,10 +26,10 @@ let
with cfg.settings;
pkgs.writeText "aesmd.conf" (
concatStringsSep "\n" (
optional (whitelistUrl != null) "whitelist url = ${whitelistUrl}"
optional (defaultQuotingType != null) "default quoting type = ${defaultQuotingType}"
++ optional (qplLogLevel != null) "qpl log level = ${qplLogLevel}"
++ optional (proxy != null) "aesm proxy = ${proxy}"
++ optional (proxyType != null) "proxy type = ${proxyType}"
++ optional (defaultQuotingType != null) "default quoting type = ${defaultQuotingType}"
++
# Newline at end of file
[ "" ]
@@ -45,6 +43,12 @@ in
services.aesmd.package = pkgs.sgx-psw.override { debug = true; };
'')
(mkRemovedOptionModule [
"services"
"aesmd"
"settings"
"whitelistUrl"
] "sgx-psw-v2.28 no longer supports Intel enclave signer cert whitelist management.")
];
options.services.aesmd = {
@@ -66,54 +70,50 @@ in
example = literalExpression "pkgs.sgx-azure-dcap-client";
description = "Custom quote provider library to use.";
};
settings = mkOption {
description = "AESM configuration";
default = { };
type = types.submodule {
options.whitelistUrl = mkOption {
type = with types; nullOr str;
default = null;
example = "http://whitelist.trustedservices.intel.com/SGX/LCWL/Linux/sgx_white_list_cert.bin";
description = "URL to retrieve authorized Intel SGX enclave signers.";
};
options.proxy = mkOption {
type = with types; nullOr str;
default = null;
example = "http://proxy_url:1234";
description = "HTTP network proxy.";
};
options.proxyType = mkOption {
type =
with types;
nullOr (enum [
"default"
"direct"
"manual"
]);
default = if (cfg.settings.proxy != null) then "manual" else null;
defaultText = literalExpression ''
if (config.${opt.settings}.proxy != null) then "manual" else null
'';
example = "default";
description = ''
Type of proxy to use. The `default` uses the system's default proxy.
If `direct` is given, uses no proxy.
A value of `manual` uses the proxy from
{option}`services.aesmd.settings.proxy`.
'';
};
options.defaultQuotingType = mkOption {
type =
with types;
nullOr (enum [
"ecdsa_256"
"epid_linkable"
"epid_unlinkable"
]);
default = null;
example = "ecdsa_256";
description = "Attestation quote type.";
};
settings = {
proxy = mkOption {
type = with types; nullOr str;
default = null;
example = "http://proxy_url:1234";
description = "HTTP network proxy.";
};
proxyType = mkOption {
type =
with types;
nullOr (enum [
"default"
"direct"
"manual"
]);
default = if (cfg.settings.proxy != null) then "manual" else null;
defaultText = literalExpression ''
if (cfg.settings.proxy != null) then "manual" else null
'';
example = "default";
description = ''
Type of proxy to use. The `default` uses the system's default proxy.
If `direct` is given, uses no proxy.
A value of `manual` uses the proxy from
{option}`services.aesmd.settings.proxy`.
'';
};
defaultQuotingType = mkOption {
# sgx-psw 2.28 removed EPID attestation
type = with types; nullOr (enum [ "ecdsa_256" ]);
default = null;
example = "ecdsa_256";
description = "Attestation quote type.";
};
qplLogLevel = mkOption {
type =
with types;
nullOr (enum [
"info"
"error"
]);
default = null;
example = "error";
description = "Log level for the default quote provider library.";
};
};
};
@@ -131,8 +131,6 @@ in
systemd.services.aesmd =
let
storeAesmFolder = "${sgx-psw}/aesm";
# Hardcoded path AESM_DATA_FOLDER in psw/ae/aesm_service/source/oal/linux/aesm_util.cpp
aesmDataFolder = "/var/opt/aesmd/data";
in
{
description = "Intel Architectural Enclave Service Manager";
@@ -154,13 +152,8 @@ in
unitConfig.AssertPathExists = [ "/dev/sgx_enclave" ];
serviceConfig = {
# Run with elevated privileges to create /var/opt/aesmd/... before
# dropping to DynamicUser.
ExecStartPre = ''
+${lib.getExe' pkgs.coreutils "install"} -m 644 -D \
"${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \
"${aesmDataFolder}/white_list_cert_to_be_verify.bin"
'';
# Hardcoded path AESM_DATA_FOLDER in psw/ae/aesm_service/source/oal/linux/aesm_util.cpp
ExecStartPre = "+${lib.getExe' pkgs.coreutils "mkdir"} -p -m 755 /var/opt/aesmd/data";
ExecStart = "${sgx-psw}/bin/aesm_service --no-daemon";
ExecReload = ''${pkgs.coreutils}/bin/kill -SIGHUP "$MAINPID"'';

16
nixos/tests/aesmd.nix
View File

@@ -14,8 +14,8 @@
enable = true;
settings = {
defaultQuotingType = "ecdsa_256";
qplLogLevel = "info";
proxyType = "direct";
whitelistUrl = "http://nixos.org";
};
};
@@ -74,17 +74,17 @@
machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")
with subtest("Copies white_list_cert_to_be_verify.bin"):
whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
whitelist_perms = machine.succeed(
f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
with subtest("Creates aesmd data directory"):
data_dir = "/var/opt/aesmd/data"
data_dir_perms = machine.succeed(
f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {data_dir}"
).strip()
assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"
assert data_dir_perms == "755", f"{data_dir} has permissions {data_dir_perms}"
with subtest("Writes and binds aesm.conf in service namespace"):
aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")
assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
expected = "default quoting type = ecdsa_256\nqpl log level = info\nproxy type = direct\n"
assert aesmd_config == expected, f"aesmd.conf\n\nactual:\n{aesmd_config}\n---\n\nexpected:\n{expected}"
with subtest("aesmd.service without quote provider library has correct LD_LIBRARY_PATH"):
status, environment = machine.systemctl("show --property Environment --value aesmd.service")

79
pkgs/os-specific/linux/sgx/psw/cppmicroservices-compat.patch
View File

@@ -1,87 +1,26 @@
diff --git a/external/CppMicroServices/CMakeLists.txt b/external/CppMicroServices/CMakeLists.txt
index 8d0aff3..44d45d9 100644
--- a/external/CppMicroServices/CMakeLists.txt
+++ b/external/CppMicroServices/CMakeLists.txt
@@ -1,7 +1,7 @@
# Extract the current version from the VERSION file
file(STRINGS VERSION _version LIMIT_COUNT 1)
-set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.2)
+set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.10)
cmake_minimum_required(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION})
diff --git a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
index 3f240f4..e8acef9 100644
index 3f240f4..e9d5880 100644
--- a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
@@ -25,6 +25,7 @@
@@ -25,6 +25,8 @@
#include "cppmicroservices/Any.h"
+#include <cstdint>
+
#include <string>
#include <unordered_map>
diff --git a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
index 9b36a9b..12894fa 100644
--- a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
@@ -25,6 +25,7 @@
#include "cppmicroservices/FrameworkExport.h"
+#include <cstdint>
#include <iostream>
#include <memory>
diff --git a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
index 590a890..cf60926 100644
--- a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
@@ -25,6 +25,7 @@
#include "cppmicroservices/FrameworkConfig.h"
+#include <cstdint>
#include <string>
namespace cppmicroservices {
diff --git a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
index 71caf1b..a29e87c 100644
--- a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
@@ -25,6 +25,7 @@
#include "cppmicroservices/FrameworkExport.h"
+#include <cstdint>
#include <iostream>
#include <memory>
diff --git a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
index 451cb82..da7c5f0 100644
--- a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
@@ -25,6 +25,8 @@
#include "cppmicroservices/ServiceReference.h"
+#include <cstdint>
+
US_MSVC_PUSH_DISABLE_WARNING(
4251) // 'identifier' : class 'type' needs to have dll-interface to be used by clients of class 'type2'
diff --git a/psw/ae/aesm_service/source/CMakeLists.txt b/psw/ae/aesm_service/source/CMakeLists.txt
index 5728e9b..0169263 100644
--- a/psw/ae/aesm_service/source/CMakeLists.txt
+++ b/psw/ae/aesm_service/source/CMakeLists.txt
@@ -30,7 +30,7 @@
#
# [proj-begin]
-cmake_minimum_required(VERSION 3.0.0)
+cmake_minimum_required(VERSION 3.10.0)
project(ModularAESM VERSION 0.1.0)

37
pkgs/os-specific/linux/sgx/psw/default.nix
View File

@@ -17,18 +17,18 @@
which,
debug ? false,
}:
stdenv.mkDerivation rec {
stdenv.mkDerivation (finalAttrs: {
pname = "sgx-psw";
# Version as given in se_version.h
version = "2.27.100.1";
version = "2.29.100.1";
# Version as used in the Git tag
versionTag = "2.27";
versionTag = "2.29";
src = fetchFromGitHub {
owner = "intel";
repo = "linux-sgx";
rev = "sgx_${versionTag}";
hash = "sha256-hNmh4IgNJDNqt2xF8zBnD/x+saMyMk5hZLA3aOqzqEA=";
repo = "confidential-computing.sgx";
rev = "sgx_${finalAttrs.versionTag}";
hash = "sha256-gi4aNXHMHuPmc36JalALAXjIdn4COuXOZzC6dQRB6nU=";
fetchSubmodules = true;
};
@@ -39,37 +39,38 @@ stdenv.mkDerivation rec {
# run user application enclaves, verify launch policies, produce remote
# attestation quotes, and do platform certification.
ae.prebuilt = fetchurl {
url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
url = "https://download.01.org/intel-sgx/sgx-linux/${finalAttrs.versionTag}/prebuilt_ae_${finalAttrs.versionTag}.tar.gz";
hash = "sha256-Hlh96rYOyml2y50d8ASKz6U97Fl0hbGYECeZiG9nMSQ=";
};
# Pre-built ipp-crypto with mitigations.
optlib.prebuilt = fetchurl {
url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/optimized_libs_${versionTag}.tar.gz";
url = "https://download.01.org/intel-sgx/sgx-linux/${finalAttrs.versionTag}/optimized_libs_${finalAttrs.versionTag}.tar.gz";
hash = "sha256-7mDTaLtpOQLHQ6Fv+FWJ2k/veJZPXIcuj7kOdRtRqhg=";
};
# Fetch the Data Center Attestation Primitives (DCAP) platform enclaves
# and pre-built sgxssl.
dcap = rec {
version = "1.24";
version = "1.26";
filename = "prebuilt_dcap_${version}.tar.gz";
prebuilt = fetchurl {
url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
hash = "sha256-sc/eYIPdhwAyDk2Zh1HU6yuFlobqVy/4++m5OnQE3Bc=";
hash = "sha256-TXQ8xh0q9RKPyKqjMvxoQtIH2lxbhCiwpV+HvQxACaw=";
};
};
in
''
# Make sure this is the right version of linux-sgx
grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
|| (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
grep -q '"${finalAttrs.version}"' "$src/common/inc/internal/se_version.h" \
|| (echo "Could not find expected version ${finalAttrs.version} in linux-sgx source" >&2 && exit 1)
tar -xzvf ${ae.prebuilt} -C $sourceRoot/
tar -xzvf ${optlib.prebuilt} -C $sourceRoot/
# Make sure we use the correct version of prebuilt DCAP
grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \
grep -qE '(dcap_version=${dcap.version}|ae_file_name=${dcap.filename})' \
"$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \
|| (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1)
tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source prebuilt/
@@ -91,11 +92,7 @@ stdenv.mkDerivation rec {
# build because the embedded zip file contents have different modified times.
./cppmicroservices-no-mtime.patch
# CppMicroServices is failing to build with CMake 4 and GCC 15
# PR: <https://github.com/intel/confidential-computing.sgx/pull/1098>
# - CMake 4 dropped support for <3.5 and warns on <3.10, so bump the
# `cmake_minimum_required` to 3.10
# - Various header files now need `#include <cstdint>` to compile
# Add `#include <cstdint>` to CppMicroServices headers that GCC 15 needs
./cppmicroservices-compat.patch
];
@@ -270,7 +267,7 @@ stdenv.mkDerivation rec {
meta = {
description = "Intel SGX Architectural Enclave Service Manager";
homepage = "https://github.com/intel/linux-sgx";
homepage = "https://github.com/intel/confidential-computing.sgx";
maintainers = with lib.maintainers; [
phlip9
veehaitch
@@ -279,4 +276,4 @@ stdenv.mkDerivation rec {
platforms = [ "x86_64-linux" ];
license = [ lib.licenses.bsd3 ];
};
}
})

37
pkgs/os-specific/linux/sgx/psw/disable-downloads.patch
View File

@@ -1,27 +1,44 @@
diff --git a/Makefile b/Makefile
index 144f4e4..834c23e 100644
index 597f167..f59bacc 100644
--- a/Makefile
+++ b/Makefile
@@ -50,22 +50,17 @@ tips:
@@ -25,12 +25,10 @@ tips:
preparation:
# As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
# Only enable the download from git
- git submodule update --init --recursive
cd external/dcap_source/external/jwt-cpp && git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch >/dev/null 2>&1 || \
git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch -R --check
cd external/dcap_source/external/wasm-micro-runtime && git apply ../0001-wasm-micro-runtime.patch >/dev/null 2>&1 || \
git apply ../0001-wasm-micro-runtime.patch -R --check
- ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R
cd external/protobuf/protobuf_code && git apply ../0001-bumped-protobuf-to-1.33.0.patch >/dev/null 2>&1 || git apply ../0001-bumped-protobuf-to-1.33.0.patch --check -R
- cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
./external/sgx-emm/create_symlink.sh
cd external/cbor && cp -r libcbor sgx_libcbor
cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
# TODO refactor to remove duplication with the ./external/protobuf/Makefile.
@@ -38,8 +36,7 @@ preparation:
# If you are adding a new patch over this one, write your patch's name to .sgx_patched
@if ! grep -q "sgx_protobuf" external/protobuf/protobuf_code/.sgx_patched 2>/dev/null; then \
cd external/protobuf/protobuf_code && \
- git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R && \
- git submodule update --init --recursive; \
+ git apply ../sgx_protobuf.patch >/dev/null 2>&1 || git apply ../sgx_protobuf.patch --check -R; \
fi
# If you are adding a new patch over this one, write your patch's name to .sgx_patched
@if ! grep -q "sgx_abseil" external/protobuf/abseil-cpp/.sgx_patched 2>/dev/null; then \
@@ -52,8 +49,6 @@ preparation:
cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
cd external/ippcp_internal/ipp-crypto && git apply ../0001-IPP-crypto-for-SGX.patch > /dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX.patch --check -R
cd external/ippcp_internal/ipp-crypto && mkdir -p build
- ./download_prebuilt.sh
- ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
cd external/libcxxrt/libcxxrt_code && git apply ../sgx_libcxxrt.patch >/dev/null 2>&1 || git apply ../sgx_libcxxrt.patch --check -R
psw:
$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
@@ -87,7 +82,6 @@ servtd_attest_preparation:
# Only enable the download from git
git submodule update --init --recursive external/dcap_source external/sgx-emm/emm_src external/libcxxrt/libcxxrt_code
./external/sgx-emm/create_symlink.sh
- ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
cd external/libcxxrt/libcxxrt_code && (git apply ../sgx_libcxxrt.patch >/dev/null 2>&1 || git apply ../sgx_libcxxrt.patch --check -R)
ipp: