通过SDK开发和构建一个SGX应用

基本原理

示例

本文通过SDK开发、构建，并部署的一个SGX应用helloworld示例中涉及的应用编译、镜像构建以及部署等示例源码位于github。

sgx-device-plugin/samples/hello_world/
                                    ├── Dockerfile
                                    ├── Makefile
                                    ├── README.md
                                    └── src
                                         ├── App
                                         │   ├── App.cpp
                                         │   └── App.h
                                         ├── Enclave
                                         │   ├── Enclave.config.xml
                                         │   ├── Enclave.cpp
                                         │   ├── Enclave.edl
                                         │   ├── Enclave.h
                                         │   ├── Enclave.lds
                                         │   └── Enclave_private.pem
                                         ├── Include
                                         └── Makefile

1. 在命令行工具连接您创建的加密计算托管集群并编译hello_world。
   在项目目录下执行make后，在项目根目录下会生成一个名为hello_world的Binary文件，然后执行命令./hello_world运行hello_world应用。

   $ make
   GEN  =>  App/Enclave_u.h
   CC   <=  App/Enclave_u.c
   CXX  <=  App/App.cpp
   LINK =>  app
   GEN  =>  Enclave/Enclave_t.h
   CC   <=  Enclave/Enclave_t.c
   CXX  <=  Enclave/Enclave.cpp
   LINK =>  enclave.so
   <EnclaveConfiguration>
       <ProdID>0</ProdID>
       <ISVSVN>0</ISVSVN>
       <StackMaxSize>0x40000</StackMaxSize>
       <HeapMaxSize>0x100000</HeapMaxSize>
       <TCSNum>10</TCSNum>
       <TCSPolicy>1</TCSPolicy>
       <!-- Recommend changing 'DisableDebug' to 1 to make the enclave undebuggable for enclave release -->
       <DisableDebug>0</DisableDebug>
       <MiscSelect>0</MiscSelect>
       <MiscMask>0xFFFFFFFF</MiscMask>
   </EnclaveConfiguration>
   tcs_num 10, tcs_max_num 10, tcs_min_pool 1
   The required memory is 3960832B.
   The required memory is 0x3c7000, 3868 KB.
   Succeed.
   SIGN =>  enclave.signed.so
   The project has been built in debug hardware mode.
   
   $ ./hello_world
   Wed May  6 06:53:33 2020
   Hello world From SGX Enclave!
   Wed May  6 06:53:34 2020
   Hello world From SGX Enclave!
   ...

   编译流程和编译后的代码目录结构说明如下：

   • 编译基本流程（Makefile）。
     1. 通过sgx_edger8r工具在App/目录下生成不可信代码(Enclave_u.c和Enclave_u.h)，这部分生成代码主要会调用ECALL（sgx_ecall）。
     2. 编译不可信部分Binary: app。
     3. 通过sgx_edger8r工具在Enclave/目录下生成可信代码（Enclave_t.c和Enclave_t.h）。
     4. 编译可信动态链接库（enclave.so）。
     5. 通过sgx_sign工具签名可信动态链接库（enclave.signed.so）。
     6. 结束。
   • 编译后的代码目录结构。

     sgx-device-plugin/samples/hello_world/src/
                                              ├── hello_world      #[generated]
                                              ├── App
                                              │   ├── App.cpp
                                              │   ├── App.h
                                              │   ├── App.o        #[generated]
                                              │   ├── Enclave_u.c  #[generated] 
                                              │   ├── Enclave_u.h  #[generated] 
                                              │   └── Enclave_u.o  #[generated]
                                              ├── Enclave
                                              │   ├── Enclave.config.xml
                                              │   ├── Enclave.cpp
                                              │   ├── Enclave.edl
                                              │   ├── Enclave.h
                                              │   ├── Enclave.lds
                                              │   ├── Enclave.o     #[generated]
                                              │   ├── Enclave_private.pem
                                              │   ├── Enclave_t.c   #[generated]
                                              │   ├── Enclave_t.h   #[generated]
                                              │   └── Enclave_t.o   #[generated]
                                              ├── enclave.signed.so #[generated]
                                              ├── enclave.so        #[generated]
                                              ├── Include
                                              └── Makefile

2. 构建镜像并部署helloworld应用。
   编译出的应用程序，须基于alibabatee/centos_sgx:7构建镜像，镜像里面已安装了SGX程序所依赖的动态链接库。

   Dockerfile文件内容如下。

   FROM alibabatee/centos_sgx:7
   
   COPY src/hello_world src/enclave.signed.so /app/
   
   WORKDIR /app
   
   ENTRYPOINT ["/app/hello_world"]

   1. 执行以下命令编译并构建镜像。

      cd sgx-device-plugin/samples/hello_world
      TARGET_IMAGE=registry-vpc.cn-shanghai.aliyuncs.com/${namespace}/${image_name}:${image_tag} make image
      docker push registry-vpc.cn-shanghai.aliyuncs.com/${namespace}/${image_name}:${image_tag}

   2. 执行以下命令部署helloworld应用。

      cat <<EOF | kubectl create -f -
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: helloworld
        namespace: default
      spec:
        replicas: 2
        selector:
          matchLabels:
            app: helloworld
        template:
          metadata:
            labels:
              app: helloworld
          spec:
            containers:
            - command:
              - /app/hello_world
              image: {{TARGET_IMAGE}}
              imagePullPolicy: Always
              name: helloworld
              resources:
                limits:
                  cpu: 250m
                  memory: 512Mi
                  alibabacloud.com/sgx_epc_MiB: 2
              volumeMounts:
              - mountPath: /var/run/aesmd/aesm.socket
                name: aesmsocket
            volumes:
            - hostPath:
                path: /var/run/aesmd/aesm.socket
                type: Socket
              name: aesmsocket
      EOF

enclave {
    trusted {
        public void ecall_hello_from_enclave([out, size=len] char* buf, size_t len);
    };
};

enclave.so
{
    global:
        g_global_data_sim;
        g_global_data;
        enclave_entry;
        g_peak_heap_used;
    local:
        *;
};

<EnclaveConfiguration>
  <ProdID>0</ProdID>
  <ISVSVN>0</ISVSVN>
  <StackMaxSize>0x40000</StackMaxSize>
  <HeapMaxSize>0x100000</HeapMaxSize>
  <TCSNum>10</TCSNum>
  <TCSPolicy>1</TCSPolicy>
  <!-- Recommend changing 'DisableDebug' to 1 to make the enclave undebuggable for enclave release -->
  <DisableDebug>0</DisableDebug>
  <MiscSelect>0</MiscSelect>
  <MiscMask>0xFFFFFFFF</MiscMask>
</EnclaveConfiguration>

#ifndef _ENCLAVE_H_
#define _ENCLAVE_H_
#endif

#include "Enclave.h"
#include "Enclave_t.h" /* print_string */
#include <string.h>

void ecall_hello_from_enclave(char *buf, size_t len)
{
    const char *hello = "Hello world";

    size_t size = len;
    if(strlen(hello) < len)
    {
        size = strlen(hello) + 1;
    }

    memcpy(buf, hello, size - 1);
    buf[size-1] = '\0';
}

$ openssl genrsa -out Enclave/Enclave_private.pem -3 3072

#ifndef _APP_H_
#define _APP_H_

#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>

#include "sgx_error.h"       /* sgx_status_t */
#include "sgx_eid.h"     /* sgx_enclave_id_t */

#ifndef TRUE
# define TRUE 1
#endif

#ifndef FALSE
# define FALSE 0
#endif

# define TOKEN_FILENAME   "enclave.token"
# define ENCLAVE_FILENAME "enclave.signed.so"

extern sgx_enclave_id_t global_eid;    /* global enclave id */

#if defined(__cplusplus)
extern "C" {
#endif


#if defined(__cplusplus)
}
#endif

#endif /* !_APP_H_ */

#include <stdio.h>
#include <string.h>
#include <assert.h>

#include <time.h>
#include <ctime>

# include <unistd.h>
# include <pwd.h>
# define MAX_PATH FILENAME_MAX

#include "sgx_urts.h"
#include "App.h"
#include "Enclave_u.h"

/* Global EID shared by multiple threads */
sgx_enclave_id_t global_eid = 0;

int initialize_enclave(void)
{
    sgx_status_t ret = SGX_ERROR_UNEXPECTED;

    char enclavefile[256];
    getcwd(enclavefile, sizeof(enclavefile));
    strcat(enclavefile, "/enclave.signed.so");

    /* Call sgx_create_enclave to initialize an enclave instance */
    /* Debug Support: set 2nd parameter to 1 */
    ret = sgx_create_enclave(enclavefile, SGX_DEBUG_FLAG, NULL, NULL, &global_eid, NULL);
    if (ret != SGX_SUCCESS) {
        printf("Failed to create enclave, ret code: %d, enclave file: %s\n", ret, enclavefile);
        return -1;
    }

    return 0;
}

tm* get_time() {
    time_t rawtime;
    struct tm * timeinfo;
    time ( &rawtime );
    timeinfo = localtime ( &rawtime );
    return timeinfo;
}

/* Application entry */
int SGX_CDECL main(int argc, char *argv[])
{
    (void)(argc);
    (void)(argv);

    const size_t max_buf_len = 100;
    char buffer[max_buf_len] = {0};


    /* Initialize the enclave */
    if(initialize_enclave() < 0){
        printf("Enter a character before exit ...\n");
        getchar();
        return -1;
    }

    /* Enclave calls */
    while(1) {
        ecall_hello_from_enclave(global_eid, buffer, max_buf_len);

        printf("%s%s\n", asctime(get_time()), buffer);
        fflush(stdout);

        sleep(1);
    }

    /* Destroy the enclave */
    sgx_destroy_enclave(global_eid);

    printf("Info: SampleEnclave successfully returned.\n");

    printf("Enter a character before exit ...\n");
    getchar();
    return 0;
}

参考链接

• ACK-TEE机密计算介绍
• 创建加密计算托管集群
• Intel® Software Guard Extensions Developer Guide