[lkml]   [2019]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: SGX vs LSM (Re: [PATCH v20 00/28] Intel SGX1 support)
On Wed, 15 May 2019, Andy Lutomirski wrote:

> On Wed, May 15, 2019 at 3:46 PM James Morris <> wrote:
> >
> > You could try user.sigstruct, which does not require any privs.
> >
> I don't think I understand your proposal. What file would this
> attribute be on? What would consume it?

It would be on the enclave file, so you keep the sigstruct bound to it,
rather than needing a separate file to manage. It would simplify any LSM
policy check.

It would be consumed by (I guess) the SGX_INIT_THE_ENCLAVE ioctl in your
example, instead of having a 2nd fd.

James Morris

 \ /
  Last update: 2019-05-16 09:26    [W:0.148 / U:1.404 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site