go-ethereum private network sgx implementation

[sho4510]

I'm currently trying out the implementation of geth on a private network using sgx (gramine), and I'm testing this project with reference to https://github.com/flashbots/geth-sgx-gramine/tree/main .

The device I'm using is an azure VM

Linux (Free 20.04)
Size: Standard DC2s v3 (2 VCPU count, 16 GiB memory)　-- sgx2

The command line arguments to geth are:

		./geth \
		    --datadir.ancient=/go-ethereum/geth-network/miner/geth/chaindata/ancient \
		    --networkid=15 \
		    --port=30305 \
			--verbosity=5 \
			--nodiscover \
			--nat=none \
			--http \
			--http.api=eth,net,engine,admin \
			--http.port=8552 \
			--http.corsdomain=* \
			--http.addr=0.0.0.0 \
			--http.api=personal,eth,net,web3,txpool,miner,admin \
			--ws \
			--ws.api=engine,eth,web3,net,debug \
			--authrpc.jwtsecret=/etc/jwt.hex \
			--authrpc.vhosts=* \
			--authrpc.addr=0.0.0.0 \
			--rpc.allow-unprotected-txs \
			--authrpc.port=8553 \
			--allow-insecure-unlock \
			--keystore=/go-ethereum/geth-network/miner/keystore/ \
			--unlock=0x456dfBE5E94ac5915eD811423E97bcdc1C464446 \
			--password=/go-ethereum/geth-network/miner/keystore/pw1.txt \
			--mine \
			--miner.etherbase 0x456dfBE5E94ac5915eD811423E97bcdc1C464446 \
		> $@

The manifest template is:

libos.entrypoint = "{{ entrypoint }}"

loader.log_level = "debug"

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr/lib:/usr/{{ arch_libdir }}"

loader.argv_src_file = "file:geth.args"

sys.enable_sigterm_injection = true
sys.enable_extra_runtime_domain_names_conf = true
sys.insecure__allow_eventfd = true

sgx.remote_attestation = "none"

fs.mounts = [
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
{ path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
{ path = "/usr", uri = "file:/usr" },
{ path = "/etc", uri = "file:/etc" },
{ type = "tmpfs", path = "/root/.ethereum" },
{ type = "tmpfs", path = "/tmp" },
{ path = "/geth", uri = "file:geth" },
{ path = "/go-ethereum/geth-network/", uri = "file:go-ethereum/geth-network/" },
{ path = "/go-ethereum/geth-network/miner/geth/", uri = "file:go-ethereum/geth-network/miner/geth/" },
{ path = "/go-ethereum/geth-network/miner/", uri = "file:go-ethereum/geth-network/miner/" },
{ path = "/go-ethereum/geth-network/miner/geth/chaindata/", uri = "file:go-ethereum/geth-network/miner/geth/chaindata/" },
{ path = "/go-ethereum/geth-network/miner/geth/chaindata/ancient/", uri = "file:go-ethereum/geth-network/miner/geth/chaindata/ancient/" },
{ path = "/lib/ssl/certs/", uri = "file:/lib/ssl/certs/" },
{ path = "/etc/ssl/certs/", uri = "file:/etc/ssl/certs/" },
]

sgx.nonpie_binary = true
sgx.enclave_size = "{{ enclave_size }}"
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.thread_num = 16
sgx.debug = true

sgx.trusted_files = [
"file:{{ gramine.libos }}",
"file:{{ entrypoint }}",
"file:{{ gramine.runtimedir() }}/",
"file:{{ arch_libdir }}/",
"file:/usr/{{ arch_libdir }}/",
"file:geth",
"file:geth.args",
"file:/etc/ssl/certs/ca-certificates.crt",
"file:/lib/ssl/certs/",
"file:/etc/ssl/certs/",
"file:go-ethereum/geth-network/miner/keystore/",
"file:go-ethereum/geth-network/miner/geth/chaindata/",
"file:go-ethereum/geth-network/miner/geth/",
"file:go-ethereum/geth-network/miner/",
]

sgx.allowed_files = [
"file:/etc/nsswitch.conf",
"file:/etc/localtime",
"file:/etc/hosts",
"file:/etc/passwd",
"file:/etc/jwt.hex",
"file:/data",
"file:data",
]

The execution result is (excerpt of the error part):

DEBUG[01-05|07:57:30.401] Failed to decode keystore key            path=/go-ethereum/geth-network/miner/keystore/pw1.txt err="json: cannot unmarshal number into Go value of type struct { Address string \"json:\\\"address\\\"\" }"

error: Disallowing create/write/append to a trusted file 'go-ethereum/geth-network/miner/geth/chaindata/ancient/chain/bodies.cidx'

Fatal: Failed to register the Ethereum service: open /go-ethereum/geth-network/miner/geth/chaindata/ancient/chain/bodies.cidx: permission denied 

[sho4510]

If I add --dev to the geth command line and run it in developer mode, it will work, but instead it will not be able to process transactions.

What should I do if I am not allowed to write or append files?

[fnerdman]

Moving all discussion to: flashbots/geth-sgx-gramine#18