linux-sgx: Implement SGX IPFS as POSIX backend for files interaction #1489
Conversation
core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c
Outdated
Show resolved
Hide resolved
core/iwasm/libraries/libc-wasi/sandboxed-system-primitives/src/posix.c
Outdated
Show resolved
Hide resolved
|
Hey @wenyongh, many thanks for this great feedback. I have improved the aspects you mentioned in your previous comments/reviews. Notably, I restored the initial state of the Let me know if you see other points to fix/refactor. Cheers! |
@JamesMenetrey Thanks a lot for implementing this feature, it is very helpful to SGX users! The PR seems good and there are only several comments from me, could you help check them? |
|
Hey @wenyongh, Thanks for this second pass of review. I have completed the different points you mentioned. Don't hesitate to check it out and give me feedback on it! Cheers |
|
LGTM |
|
Great, thanks! 🎉🚀 |
linux-sgx: Implement SGX IPFS as POSIX backend for file interaction (bytecodealliance#1489)
…ytecodealliance#1489) This PR integrates an Intel SGX feature called Intel Protection File System Library (IPFS) into the runtime to create, operate and delete files inside the enclave, while guaranteeing the confidentiality and integrity of the data persisted. IPFS can be referred to here: https://www.intel.com/content/www/us/en/developer/articles/technical/overview-of-intel-protected-file-system-library-using-software-guard-extensions.html Introduce a cmake variable `WAMR_BUILD_SGX_IPFS`, when enabled, the files interaction API of WASI will leverage IPFS, instead of the regular POSIX OCALLs. The implementation has been written with light changes to sgx platform layer, so all the security aspects WAMR relies on are conserved. In addition to this integration, the following changes have been made: - The CI workflow has been adapted to test the compilation of the runtime and sample with the flag `WAMR_BUILD_SGX_IPFS` set to true - Introduction of a new sample that demonstrates the interaction of the files (called `file`), - Documentation of this new feature
Dear WAMR developers,
Here is a PR that contributes to integrating an Intel SGX feature called Intel Protection File System Library (IPFS) in the runtime to create, operate and delete files inside the enclave, while guaranteeing the confidentiality and integrity of the data persisted.
This feature has been implemented so that when the runtime is compiled with a newly-introduced flag (
WAMR_SGX_IPFS), the files interaction API of WASI will leverage IPFS, instead of the regular POSIX OCALLs. The implementation has been written with light changes to the POSIX sandbox for WASI, so all the security aspects WAMR relies on are conserved.In addition to this integration, the following changes have been made:
WAMR_SGX_IPFSset to true,file),A proof of concept regarding WAMR and IPFS was already published by my university and me a year ago with many benchmarks to evaluate the overheads of IPFS file interaction. You can see our results in this paper. With the help of the company Credora, we thought it would be a great asset to WAMR to push this research into the upstream WAMR.
Feel free to discuss the changes here, as I would be glad to perform any changes that are not compliant with the best practices of this project.
Cheers