Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] [libOS] Single Process lifetime rollback protection for Protected Files #1856

Draft
wants to merge 22 commits into
base: master
Choose a base branch
from

Conversation

g2flyer
Copy link
Contributor

@g2flyer g2flyer commented Apr 23, 2024

Description of the changes

This is a WIP PR addresses issue #1835, i.e., rollback protection of protected files beyond a single open-to-close window but across the whole runtime of gramine. Released as draft PR in anticipation of 23. April 2024 Community Call. It depends on closing PR #1874 and PR #1875 (and is currently rebased on the current version of these to work)

Steps:

How to test this PR?


This change is Reviewable

@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from 2233cf6 to f42b179 Compare April 23, 2024 04:51
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from 11858ac to 79890bf Compare May 6, 2024 15:36
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from 79890bf to 95c577f Compare May 10, 2024 22:53
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 4 times, most recently from ee4c0c4 to 17d0062 Compare May 23, 2024 18:08
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 7 times, most recently from 2e9c69e to 71ef5c8 Compare June 4, 2024 19:11
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 2 times, most recently from d220ddb to 50794dd Compare June 11, 2024 22:15
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 3 times, most recently from d555d18 to 681307a Compare June 14, 2024 19:33
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 2 times, most recently from 8eeed74 to 47cc591 Compare July 9, 2024 22:55
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 2 times, most recently from 2c7435e to cd25ee0 Compare July 26, 2024 18:37
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 2 times, most recently from 4b0b0b6 to cd03cef Compare August 14, 2024 17:44
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from 6f71463 to 39e2dc4 Compare August 22, 2024 18:21
* also fixes one missing call to put_handle in error handling

Signed-off-by: g2flyer <[email protected]>
* use --skip-teardown to prevent removal of artifacts
* for tamper tests, run all of them instead of abort on first failure

Signed-off-by: g2flyer <[email protected]>
* Make sure decrypt is called on correct path (or it will fail always
  due to invalid path it didn't fail already due to plain text tampering)
* Remove undetectable "tampering" test-cases but also add a few use-cases
  tampering with header ciphertext

Signed-off-by: g2flyer <[email protected]>
…es (SPLRB)

* adds libos_encrypted_volume as mount-data for protected fileystem which
  includes map <name, <last-root-hash, ...>> to keep track of root hashes
  across open/close cycles of a particular value, ensuring consistency across
  the whole enclave life-time

Signed-off-by: g2flyer <[email protected]>
* Updated existing non-adverserial ones

Signed-off-by: g2flyer <[email protected]>
* New adverserial ones

Signed-off-by: g2flyer <[email protected]>
* make corruption status for encrypted files sticky
* update filemap state for any corruption also encountered
  during operations other than open, close, unlink and rename

Signed-off-by: g2flyer <[email protected]>
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch 2 times, most recently from 364defc to 00e1010 Compare August 23, 2024 23:05
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from 00e1010 to f15133b Compare August 26, 2024 21:02
@g2flyer g2flyer force-pushed the msteiner/enclave-lifetime-rollback-protection branch from d412869 to 977e999 Compare August 27, 2024 00:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Working on it
Development

Successfully merging this pull request may close these issues.

1 participant