From: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
To: Dave Hansen <dave.hansen@intel.com>,
jarkko@kernel.org, linux-sgx@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: dave.hansen@linux.intel.com
Subject: Re: [PATCH v2 0/4] selftests/sgx: Harden test enclave
Date: Mon, 24 Jul 2023 12:33:27 +0200 [thread overview]
Message-ID: <1805e583-6986-79ff-36b1-7b71e32e6eb0@cs.kuleuven.be> (raw)
In-Reply-To: <da0cfb1e-e347-f7f2-ac72-aec0ee0d867d@intel.com>
On 21.07.23 02:24, Dave Hansen wrote:
> I wholeheartedly agree with the desire to spin up enclaves without the
> overhead or complexity of the SDK. I think I'm the one that asked for
> this test enclave in the first place. There *IS* a gap here. Those who
> care about SGX would be wise to close this gap in _some_ way.
>
> But I don't think the kernel should be the place this is done. The
> kernel should not be hosting a real-world (userspace) SGX reference
> implementation.
Okay, makes sense.
> I'd fully support if you'd like to take the selftest code, fork it, and
> maintain it. The SGX ecosystem would be better off if such a project
> existed. If I can help here in some way like (trying to) release the
> SGX selftest under a different license, please let me know.
Thank you! I agree this would benefit the SGX ecosystem and I'll go
ahead with further developing such a standalone fork when I find time
probably in the next month or so. For future reference, in case people
end up reading this discussion thread, I created a placeholder (atm
emtpy) repo here:
https://github.com/jovanbulck/bare-sgx
Re licensing: no need to re-license, I think GPL would be the best
license for such a project anyway.
> The only patches I want for the kernel are to make the test enclave more
> *obviously* insecure.
Makes sense. I'll see if I can create a new proposed minimal patch in
this spirit (e.g., removing existing register cleansing and adding an
explicit comment) to take away any misguided impression that the test
enclave would be a representative example of secure code and make its
real purpose clearer.
> So, it's a NAK from me for this series. I won't support merging this
> into the kernel. But at the same time, I'm very sympathetic to your
> cause, and I do appreciate your effort here.
Thank you, appreciated!
prev parent reply other threads:[~2023-07-24 10:33 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-20 22:16 [PATCH v2 0/4] selftests/sgx: Harden test enclave Jo Van Bulck
2023-07-20 22:16 ` [PATCH 1/4] selftests/sgx: Harden test enclave ABI Jo Van Bulck
2023-07-20 22:16 ` [PATCH 2/4] selftests/sgx: Store base address and size in test enclave Jo Van Bulck
2023-07-20 22:16 ` [PATCH 3/4] selftests/sgx: Harden test enclave API Jo Van Bulck
2023-07-20 22:16 ` [PATCH 4/4] selftests/sgx: Fix compiler optimizations in test enclave Jo Van Bulck
2023-07-21 0:24 ` [PATCH v2 0/4] selftests/sgx: Harden " Dave Hansen
2023-07-24 10:33 ` Jo Van Bulck [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1805e583-6986-79ff-36b1-7b71e32e6eb0@cs.kuleuven.be \
--to=jo.vanbulck@cs.kuleuven.be \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=jarkko@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sgx@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).