Project: Inclavare Containers (Runtime / Container Runtime)
File: intergrate_skeleton_with_enclave_tls.md

This guide will show you how to use remote attestation in skeleton with rune and enclave-tls. Build and install `rune` according to this . Build and install `enclave-tls` according to this . Please refer to to install the dependencies of skeleton enclave runtime. Then type the following commands to build and install the PAL of the skeleton enclave runtime. ```shell cd "${pathtoinclavare_containers}/rune/libenclave/internal/runtime/pal/skeleton" make TLS_SERVER=1 cp liberpal-skeleton-v3.so /usr/lib ``` Type the following commands to create a Dockerfile: ```Shell cp /opt/enclave-tls/bin/sgxstubenclave.signed.so ./ cp /etc/sgxdefaultqcnl.conf ./ cp /usr/lib/x8664-linux-gnu/libsgxpce.signed.so ./ cp /usr/lib/x8664-linux-gnu/libsgxqe3.signed.so ./ cat >Dockerfile <<EOF FROM ubuntu:18.04 WORKDIR / COPY sgxstubenclave.signed.so / COPY sgxdefaultqcnl.conf /etc/ COPY libsgxpce.signed.so /usr/lib/x8664-linux-gnu COPY libsgxqe3.signed.so /usr/lib/x8664-linux-gnu EOF ``` Then build the skeleton docker image with the command: ```shell docker build . -t skeleton-enclave ``` Type the following commands to create a Dockerfile: ```Shell cp /opt/enclave-tls/bin/sgxstubenclave.signed.so ./ cat >Dockerfile <<EOF FROM ubuntu:18.04 WORKDIR / COPY sgxstubenclave.signed.so / EOF ``` Then build the skeleton docker image with the command: ```shell docker build . -t skeleton-enclave ``` Please refer to to integrate OCI runtime rune with docker. At present, TLS server based on `enclave-tls` is only implemented in skeleton v3. ```shell docker run -i --rm --net=host --runtime=rune \ -e ENCLAVE_TYPE=intelSgx \ -e ENCLAVERUNTIMEPATH=/usr/lib/liberpal-skeleton-v3.so \ -e ENCLAVERUNTIMEARGS="debug attester=sgx_ecdsa tls=openssl crypto=openssl" \ skeleton-enclave:latest ``` ```shell docker run -i --rm --net=host --runtime=rune \ -e ENCLAVE_TYPE=intelSgx \ -e ENCLAVERUNTIMEPATH=/usr/lib/liberpal-skeleton-v3.so \ -e ENCLAVERUNTIMEARGS="debug attester=sgx_la tls=openssl crypto=openssl" \ skeleton-enclave:latest ``` The following method to run skeleton bundle with rune is usually provided for development purposes. Assuming you have an OCI bundle according to , please add config into config.json as following: ```shell "cwd": "/", "annotations": { "enclave.type": "intelSgx", "enclave.runtime.path": "/usr/lib/liberpal-skeleton-v3.so", "enclave.runtime.args": "debug attester=sgx_ecdsa tls=openssl crypto=openssl" } ``` If you do NOT set runtime parameters in `enclave.runtime.args`, TLS server will run the highest priority `enclave quote/tls wrapper/crypto` instance. Please refer to this for more information. Remember that you also need to delete the network namespace configuration in config.json to ensure you run skeleton in host network mode. After doing this, your namespaces are as following without the network type namespace: ```shell "namespaces": [ { "type": "pid" }, { "type": "ipc" }, { "type": "uts" }, { "type": "mount" } ], ``` Assuming you have an OCI bundle from the previous step you can execute the container in this way. ```shell cd "$HOME/rune_workdir/rune-container" sudo rune run skeleton-enclave-container ``` If you run the skeleton image in the docker environment, you might meet the problem as follow. ``` [getplatformquotecertdata ../qelogic.cpp:346] Error returned from the psgxgetquote_config API. 0xe019 [ERROR] sgxqegettargetinfo() with error code 0xe019 [getplatformquotecertdata ../qelogic.cpp:346] Error returned from the psgxgetquote_config API. 0xe019 [ERROR] sgxqegetquotesize(): 0xe019 ``` Please type the following code to solve the problem ```shell cp /etc/resolv.conf rootfs/etc/ ``` ```shell cd /opt/enclave-tls/bin ./enclave-tls-client -a sgx_ecdsa -t openssl -c openssl ./enclave-tls-client -a sgx_la -t openssl -c openssl ``` Only support run remote attestation based on ecdsa. ```shell cd /opt/enclave-tls/bin ./enclave-tls-client -v sgx_ecdsa -t openssl -c openssl ```