Unable to run encrypted filesystem example #1495

lokesh2019 · 2023-08-20T10:31:46Z

lokesh2019
Aug 20, 2023

Hi, I am trying to run a simplified version of Pytorch example (https://gramine.readthedocs.io/en/stable/tutorials/pytorch/index.html) to learn attestation and provisioning basics. I am pretty sure I am missing some basic configuration/setup step. I am finding the intel documentation rather confusing to follow. I'd be grateful for a link showing how to setup a dcap server on a localhost.

I have followed these instructions:
https://www.intel.com/content/www/us/en/developer/articles/guide/intel-software-guard-extensions-data-center-attestation-primitives-quick-install-guide.html

I have set up both PCCS on localhost and the provisioned machine on the same host, and without reinstalling everything. It doesn't seem mandatory. Also it fails to install sgx_linux_x64_driver_1.36.2.bin file but I guess Kernel 6.1.0-11-amd64 comes with built in sgx drivers so that's ok too.

My setup:
Baremetal Debian 12 host with Intel I7-10th Gen processor.
I can run helloworld example, so SGX is working fine.

My encrypted file example code:

#include<stdio.h>
#include<string.h>

void main(){
    int len;
    char content[10000] = {0};
    FILE *fp = fopen("file-encrypted.txt", "r");
    fscanf(fp, "%s", content);
    fclose(fp);

    printf("Content length is %ld\n", strlen(content));
    fflush(stdout);
    getchar();
}

The file-encrypted.txt is the encrypted file (as the name implies) following the pytorch instructions.
And the template file:

# Hello World manifest file example

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/readfile"
loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/lib"

fs.mounts = [
  { path = "/file-encrypted.txt", uri = "file:file-encrypted.txt", type = "encrypted" },
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "/readfile", uri = "file:readfile" },
]

sgx.debug = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:readfile",
  "file:file-encrypted.txt",
  "file:{{ gramine.runtimedir() }}/",
  "file:ssl/ca.crt",
]

sgx.remote_attestation = "dcap"
loader.env.LD_PRELOAD = "libsecret_prov_attest.so"
loader.env.SECRET_PROVISION_CONSTRUCTOR = "1"
loader.env.SECRET_PROVISION_SET_KEY = "default"
loader.env.SECRET_PROVISION_CA_CHAIN_PATH = "ssl/ca.crt"
loader.env.SECRET_PROVISION_SERVERS = "0.0.0.0:4433"

The same example works fine on SGX if I read a plaintext file.

I have the dcap server compiled and running fine as per the instructions:

$ ./server_dcap key
--- Reading the master key for encrypted files from 'key' ---
--- Starting the Secret Provisioning server on port 4433 ---

But when I run the C binary, I get this error (same if I run the command with sudo, so not a user privilege issue):

$ gramine-sgx readfile
Gramine is starting. Parsing TOML manifest file, this may take some time...
error: AESM service returned error 1; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
error: load_enclave() failed with error: Operation not permitted (EPERM)
$

Could someone point me to the documentation to correctly set up a local DCAP server please. Thanks!

lokesh2019 · 2023-08-20T11:50:53Z

lokesh2019
Aug 20, 2023
Author

And same error with log level set to all:

$ gramine-sgx readfile
Gramine is starting. Parsing TOML manifest file, this may take some time...
(host_main.c:967:load_enclave) debug: Gramine parsed TOML manifest file successfully
(host_framework.c:225:create_enclave) debug: Enclave created:
(host_framework.c:226:create_enclave) debug:     base:           0x0000000000000000
(host_framework.c:227:create_enclave) debug:     size:           0x0000000010000000
(host_framework.c:228:create_enclave) debug:     misc_select:    0x00000000
(host_framework.c:229:create_enclave) debug:     attr.flags:     0x0000000000000007
(host_framework.c:230:create_enclave) debug:     attr.xfrm:      0x0000000000000007
(host_framework.c:231:create_enclave) debug:     ssa_frame_size: 4
(host_framework.c:232:create_enclave) debug:     isv_prod_id:    0x00000000
(host_framework.c:233:create_enclave) debug:     isv_svn:        0x00000000
(host_main.c:480:initialize_enclave) debug: Adding pages to SGX enclave, this may take some time...
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfffd000-0x10000000 [REG:R--] (manifest) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffdd000-0xfffd000 [REG:RW-] (ssa) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffd9000-0xffdd000 [TCS:---] (tcs) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffd5000-0xffd9000 [REG:RW-] (tls) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff95000-0xffd5000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff55000-0xff95000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff15000-0xff55000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfed5000-0xff15000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfec5000-0xfed5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfeb5000-0xfec5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfea5000-0xfeb5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe95000-0xfea5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe3b000-0xfe8b000 [REG:R-X] (code) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe8b000-0xfe90000 [REG:RW-] (data) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe90000-0xfe95000 [REG:RW-] (bss) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0x10000-0xfe3b000 [REG:RWX] (free)
(host_main.c:562:initialize_enclave) debug: Added all pages to SGX enclave
(host_framework.c:516:init_enclave) debug: Enclave initializing:
(host_framework.c:517:init_enclave) debug:     enclave id:   0x000000000ffff000
(host_framework.c:518:init_enclave) debug:     mr_enclave:   9f147ffd6963e1da0d08bbe508689c3f8c125a0dbac1caf78df0c4061e322abd
(host_main.c:1039:load_enclave) debug: Using SGX attestation type "dcap"
(host_platform.c:195:init_quoting_enclave_targetinfo) error: AESM service returned error 1; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
(host_main.c:1269:main) error: load_enclave() failed with error: Operation not permitted (EPERM)
$

And aesmd service logs if they are of any use:

# systemctl status aesmd
● aesmd.service - Intel(R) Architectural Enclave Service Manager
     Loaded: loaded (/lib/systemd/system/aesmd.service; enabled; preset: enabled)
     Active: active (running) since Sun 2023-08-20 12:31:57 BST; 20min ago
    Process: 1047 ExecStartPre=/opt/intel/sgx-aesm-service/aesm/linksgx.sh (code=exited, status=0/SUCCESS)
    Process: 1110 ExecStartPre=/bin/mkdir -p /var/run/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 1111 ExecStartPre=/bin/chown -R aesmd:aesmd /var/run/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 1112 ExecStartPre=/bin/chmod 0755 /var/run/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 1115 ExecStartPre=/bin/chown -R aesmd:aesmd /var/opt/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 1118 ExecStartPre=/bin/chmod 0750 /var/opt/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 1121 ExecStart=/opt/intel/sgx-aesm-service/aesm/aesm_service (code=exited, status=0/SUCCESS)
   Main PID: 1123 (aesm_service)
      Tasks: 4 (limit: 38089)
     Memory: 17.3M
        CPU: 72ms
     CGroup: /system.slice/aesmd.service
             └─1123 /opt/intel/sgx-aesm-service/aesm/aesm_service

Aug 20 12:31:57 debby systemd[1]: Started aesmd.service - Intel(R) Architectural Enclave Service Manager.
Aug 20 12:31:57 debby aesm_service[1123]: The server sock is 0x563da2b878f0
Aug 20 12:33:23 debby aesm_service[1123]: [QPL] Failed to get quote config. Error code is 0xb010
Aug 20 12:33:23 debby aesm_service[1123]: [get_platform_quote_cert_data ../qe_logic.cpp:388] Error returned from the p_sgx_get_quote_config API. 0xe047
Aug 20 12:35:37 debby aesm_service[1123]: [QPL] Failed to get quote config. Error code is 0xb010
Aug 20 12:35:37 debby aesm_service[1123]: [get_platform_quote_cert_data ../qe_logic.cpp:388] Error returned from the p_sgx_get_quote_config API. 0xe047
Aug 20 12:35:46 debby aesm_service[1123]: [QPL] Failed to get quote config. Error code is 0xb010
Aug 20 12:35:46 debby aesm_service[1123]: [get_platform_quote_cert_data ../qe_logic.cpp:388] Error returned from the p_sgx_get_quote_config API. 0xe047
Aug 20 12:49:20 debby aesm_service[1123]: [QPL] Failed to get quote config. Error code is 0xb010
Aug 20 12:49:20 debby aesm_service[1123]: [get_platform_quote_cert_data ../qe_logic.cpp:388] Error returned from the p_sgx_get_quote_config API. 0xe047
#

0 replies

kailun-qin · 2023-08-21T01:58:21Z

kailun-qin
Aug 21, 2023
Collaborator

Hi @lokesh2019!

Woud you pls try to run curl -k -G "https://localhost:8081/sgx/certification/v4/rootcacrl in your env, share its output and the below PCCS-related information w/ us?

PCCS status (sudo systemctl status pccs) / PCCS log (/opt/intel/sgx-dcap-pccs/logs/pccs_server.log)
PCCS config (/opt/intel/sgx-dcap-pccs/config/default.json)

Thanks!

5 replies

dimakuv Aug 21, 2023
Maintainer

+1 to what Kailun said. Also, see this link intel/linux-sgx#828

lokesh2019 Sep 1, 2023
Author

Hi, apologies for late response. Summer holidays.

While googling around, I found somewhere a suggestion to upgrade my BIOS to the latest version. I did that and the bios broke secure boot. I am working with MSI to get that sorted.

In the meantime, I have setup another machine following the same steps etc. And I am getting similar (but not identical) error.

Same example run on the new machine with all the debug logs (https://github.com/lokesh2019/gramine-sgx/tree/main/Encryptedfile):

$ gramine-sgx readfile
Gramine is starting. Parsing TOML manifest file, this may take some time...
(host_main.c:967:load_enclave) debug: Gramine parsed TOML manifest file successfully
(host_framework.c:225:create_enclave) debug: Enclave created:
(host_framework.c:226:create_enclave) debug:     base:           0x0000000000000000
(host_framework.c:227:create_enclave) debug:     size:           0x0000000010000000
(host_framework.c:228:create_enclave) debug:     misc_select:    0x00000000
(host_framework.c:229:create_enclave) debug:     attr.flags:     0x0000000000000007
(host_framework.c:230:create_enclave) debug:     attr.xfrm:      0x0000000000000007
(host_framework.c:231:create_enclave) debug:     ssa_frame_size: 4
(host_framework.c:232:create_enclave) debug:     isv_prod_id:    0x00000000
(host_framework.c:233:create_enclave) debug:     isv_svn:        0x00000000
(host_main.c:480:initialize_enclave) debug: Adding pages to SGX enclave, this may take some time...
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfffd000-0x10000000 [REG:R--] (manifest) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffdd000-0xfffd000 [REG:RW-] (ssa) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffd9000-0xffdd000 [TCS:---] (tcs) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xffd5000-0xffd9000 [REG:RW-] (tls) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff95000-0xffd5000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff55000-0xff95000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xff15000-0xff55000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfed5000-0xff15000 [REG:RW-] (stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfec5000-0xfed5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfeb5000-0xfec5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfea5000-0xfeb5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe95000-0xfea5000 [REG:RW-] (sig_stack) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe3b000-0xfe8b000 [REG:R-X] (code) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe8b000-0xfe90000 [REG:RW-] (data) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0xfe90000-0xfe95000 [REG:RW-] (bss) measured
(host_framework.c:313:add_pages_to_enclave) debug: Adding pages to enclave: 0x10000-0xfe3b000 [REG:RWX] (free)
(host_main.c:562:initialize_enclave) debug: Added all pages to SGX enclave
(host_framework.c:516:init_enclave) debug: Enclave initializing:
(host_framework.c:517:init_enclave) debug:     enclave id:   0x000000000ffff000
(host_framework.c:518:init_enclave) debug:     mr_enclave:   9f147ffd6963e1da0d08bbe508689c3f8c125a0dbac1caf78df0c4061e322abd
(host_main.c:1039:load_enclave) debug: Using SGX attestation type "dcap"
(host_platform.c:195:init_quoting_enclave_targetinfo) error: AESM service returned error 30; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
(host_main.c:1269:main) error: load_enclave() failed with error: Operation not permitted (EPERM)
$

This time aesmd service reports no errors unlike the previous PC.

root@playstation:~# systemctl status aesmd
● aesmd.service - Intel(R) Architectural Enclave Service Manager
     Loaded: loaded (/lib/systemd/system/aesmd.service; enabled; preset: enabled)
     Active: active (running) since Fri 2023-09-01 13:20:41 BST; 23min ago
    Process: 758 ExecStartPre=/opt/intel/sgx-aesm-service/aesm/linksgx.sh (code=exited, sta>
    Process: 771 ExecStartPre=/bin/mkdir -p /var/run/aesmd/ (code=exited, status=0/SUCCESS)
    Process: 772 ExecStartPre=/bin/chown -R aesmd:aesmd /var/run/aesmd/ (code=exited, statu>
    Process: 773 ExecStartPre=/bin/chmod 0755 /var/run/aesmd/ (code=exited, status=0/SUCCES>
    Process: 774 ExecStartPre=/bin/chown -R aesmd:aesmd /var/opt/aesmd/ (code=exited, statu>
    Process: 775 ExecStartPre=/bin/chmod 0750 /var/opt/aesmd/ (code=exited, status=0/SUCCES>
    Process: 776 ExecStart=/opt/intel/sgx-aesm-service/aesm/aesm_service (code=exited, stat>
   Main PID: 778 (aesm_service)
      Tasks: 4 (limit: 38042)
     Memory: 4.1M
        CPU: 78ms
     CGroup: /system.slice/aesmd.service
             └─778 /opt/intel/sgx-aesm-service/aesm/aesm_service

Sep 01 13:20:41 playstation systemd[1]: Starting aesmd.service - Intel(R) Architectural Enc>
Sep 01 13:20:41 playstation aesm_service[776]: aesm_service: warning: Turn to daemon. Use ">
Sep 01 13:20:41 playstation systemd[1]: Started aesmd.service - Intel(R) Architectural Encl>
Sep 01 13:20:41 playstation aesm_service[778]: The server sock is 0x5603ff087790
root@playstation:~#

And here is the information @kailun-qin requested:

root@playstation:~# curl -k -G "https://localhost:8081/sgx/certification/v4/rootcacrl"
308201213081c8020101300a06082a8648ce3d0403023068311a301806035504030c11496e74656c2053475820526f6f74204341311a3018060355040a0c11496e74656c20436f72706f726174696f6e3114301206035504070c0b53616e746120436c617261310b300906035504080c024341310b3009060355040613025553170d3233303430333130323235315a170d3234303430323130323235315aa02f302d300a0603551d140403020101301f0603551d2304183016801422650cd65a9d3489f383b49552bf501b392706ac300a06082a8648ce3d0403020348003045022051577d47d9fba157b65f1eb5f4657bbc5e56ccaf735a03f1b963d704805ab118022100939015ec1636e7eafa5f426c1e402647c673132b6850cabd68cef6bad7682a03
root@playstation:~#

root@playstation:~# systemctl status pccs
● pccs.service - Provisioning Certificate Caching Service (PCCS)
     Loaded: loaded (/lib/systemd/system/pccs.service; enabled; preset: enabled)
     Active: active (running) since Fri 2023-09-01 13:14:17 BST; 16min ago
       Docs: https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteGeneration/pccs/README.md
   Main PID: 575 (node)
      Tasks: 11 (limit: 38042)
     Memory: 114.4M
        CPU: 1.222s
     CGroup: /system.slice/pccs.service
             └─575 /usr/bin/node /opt/intel/sgx-dcap-pccs/pccs_server.js

Sep 01 13:14:17 playstation systemd[1]: Started pccs.service - Provisioning Certificate Caching Service (PCCS).
Sep 01 13:14:18 playstation node[575]: 2023-09-01 13:14:18.446 [info]: HTTPS Server is running on: https://localhost:8081
Sep 01 13:26:06 playstation node[575]: 2023-09-01 13:26:06.076 [info]: Client Request-ID : f5015cc064f54ecf9f78e34d3d73b864
Sep 01 13:26:06 playstation node[575]: 2023-09-01 13:26:06.086 [info]: 127.0.0.1 - - [01/Sep/2023:12:26:06 +0000] "GET /sgx/certification/v4/rootcacrl HTTP/1.1" 200 586 "-" "curl/7.88.1"
root@playstation:~#

root@playstation:~# cat /opt/intel/sgx-dcap-pccs/logs/pccs_server.log
2023-09-01 13:00:04.575 [info]: DB Migration (Ver.0 -> 1) -- Start
2023-09-01 13:00:04.586 [info]: DB Migration -- Done.
2023-09-01 13:00:04.635 [info]: DB Migration (Ver.1 -> 2) -- Start
2023-09-01 13:00:04.640 [info]: DB Migration -- Done.
2023-09-01 13:00:04.689 [info]: DB Migration (Ver.2 -> 3) -- Start
2023-09-01 13:00:04.702 [info]: DB Migration -- Done.
2023-09-01 13:00:04.833 [info]: HTTPS Server is running on: https://localhost:8081
2023-09-01 13:03:45.041 [info]: Client Request-ID : 56a6bda934fa46fb8cd251a4f12bf158
2023-09-01 13:03:45.839 [info]: Request-ID is : 6f2990400910498b9e2ae9cc4c92487f
2023-09-01 13:03:46.157 [info]: Request-ID is : c2f076a580ba4e98bfbe1bcb3456b013
2023-09-01 13:03:46.473 [info]: Request-ID is : 22cc24f95ae947ada38765d489b59900
2023-09-01 13:03:46.475 [error]: Intel PCS server returns error(404).
2023-09-01 13:03:46.874 [info]: Request-ID is : f17c0659382d40f881956ba21daddc1f
2023-09-01 13:03:47.207 [info]: Request-ID is : 8f8f44111a724ea384acf3f96d00f83f
2023-09-01 13:03:47.511 [info]: Request-ID is : 22079b0f53334676bcb7e63b81cad6ed
2023-09-01 13:03:47.818 [info]: Request-ID is : dab2c9b6a60a4f6fab361735cf6cbcca
2023-09-01 13:03:48.113 [info]: Request-ID is : 21705b7f01294266a341e6d6b5246836
2023-09-01 13:03:48.481 [info]: Request-ID is : 338a89a4b57d4a6a9f03bff6fb3f5a5f
2023-09-01 13:03:49.141 [info]: Request-ID is : 3ae5c0adee2b4adbabdc1a34b91c3d19
2023-09-01 13:03:49.701 [info]: 127.0.0.1 - - [01/Sep/2023:12:03:49 +0000] "POST /sgx/certification/v3/platforms HTTP/1.1" 200 21 "-" "-"

2023-09-01 13:14:18.446 [info]: HTTPS Server is running on: https://localhost:8081
2023-09-01 13:26:06.076 [info]: Client Request-ID : f5015cc064f54ecf9f78e34d3d73b864
2023-09-01 13:26:06.086 [info]: 127.0.0.1 - - [01/Sep/2023:12:26:06 +0000] "GET /sgx/certification/v4/rootcacrl HTTP/1.1" 200 586 "-" "curl/7.88.1"
root@playstation:~#

root@playstation:~# cat /opt/intel/sgx-dcap-pccs/config/default.json
{
    "HTTPS_PORT" : 8081,
    "hosts" : "0.0.0.0",
    "uri": "https://api.trustedservices.intel.com/sgx/certification/v4/",
    "ApiKey" : "bd7f3d9ce6304a9d886659175390bd41",
    "proxy" : "",
    "RefreshSchedule": "0 0 1 * * *",
    "UserTokenHash" : "417b5e588a5ff9c78e8e14e0222e768dbdb2203576b7ad81ab32b5b0d46f285783a8424c437090b0db23bb75cf02d1e8f632524fc88eb98bba3d8000bbd6535b",
    "AdminTokenHash" : "b6feb52d5a341739f9a4629c5571a9f3927510de56700f6e7b24a0d72ff1de327128039bfa8d55041b23247db93c554a07464ada571ac4511d3c65d78fbb55eb",
    "CachingFillMode" : "LAZY",
    "LogLevel" : "info",
    "DB_CONFIG" : "sqlite",
    "sqlite" : {
        "database" : "database",
        "username" : "username",
        "password" : "password",
        "options" : {
            "host": "localhost",
            "dialect": "sqlite",
            "pool": {
                "max": 5,
                "min": 0,
                "acquire": 30000,
                "idle": 10000
            },
            "define": {
                "freezeTableName": true
            },
            "logging" : false, 
            "storage": "pckcache.db"
        }
    }, 
    "mysql" : {
        "database" : "pckcache",
        "username" : "root",
        "password" : "mypass",
        "options" : {
            "host": "localhost",
            "port": "3306",
            "dialect": "mysql",
            "pool": {
                "max": 5,
                "min": 0,
                "acquire": 30000,
                "idle": 10000
            },
            "define": {
                "freezeTableName": true
            },
            "logging" : false
        }
    }
}
root@playstation:~#

dimakuv Sep 3, 2023
Maintainer

AESM error 30 is AESM_SERVICE_UNAVAILABLE. Looks like Gramine cannot connect to the AESM daemon...

Could you show the outputs of these also:

sudo journalctl -u aesmd -b
cat /etc/sgx_default_qcnl.conf

dimakuv Sep 3, 2023
Maintainer

Are you running Gramine normally on this machine, or maybe it's through Docker, or something special?

lokesh2019 Sep 4, 2023
Author

root@playstation:~# journalctl -u aesmd -b
Sep 04 09:18:46 playstation systemd[1]: Starting aesmd.service - Intel(R) Architectural Enclave Service Manager...
Sep 04 09:18:46 playstation aesm_service[608]: aesm_service: warning: Turn to daemon. Use "--no-daemon" option to>
Sep 04 09:18:46 playstation systemd[1]: Started aesmd.service - Intel(R) Architectural Enclave Service Manager.
Sep 04 09:18:46 playstation aesm_service[609]: The server sock is 0x563734d86790
root@playstation:~#

root@playstation:~# cat /etc/sgx_default_qcnl.conf
{
  // *** ATTENTION : This file is in JSON format so the keys are case sensitive. Don't change them.
  
  //PCCS server address
  "pccs_url": "https://localhost:8081/sgx/certification/v4/"

  // To accept insecure HTTPS certificate, set this option to false
  ,"use_secure_cert": false

  // You can use the Intel PCS or another PCCS to get quote verification collateral.  Retrieval of PCK 
  // Certificates will always use the PCCS described in pccs_url.  When collateral_service is not defined, both 
  // PCK Certs and verification collateral will be retrieved using pccs_url  
  //,"collateral_service": "https://api.trustedservices.intel.com/sgx/certification/v4/"

  // If you use a PCCS service to get the quote verification collateral, you can specify which PCCS API version is to be used.
  // The legacy 3.0 API will return CRLs in HEX encoded DER format and the sgx_ql_qve_collateral_t.version will be set to 3.0, while
  // the new 3.1 API will return raw DER format and the sgx_ql_qve_collateral_t.version will be set to 3.1. The pccs_api_version 
  // setting is ignored if collateral_service is set to the Intel PCS. In this case, the pccs_api_version is forced to be 3.1 
  // internally.  Currently, only values of 3.0 and 3.1 are valid.  Note, if you set this to 3.1, the PCCS use to retrieve 
  // verification collateral must support the new 3.1 APIs.
  //,"pccs_api_version": "3.1"

  // Maximum retry times for QCNL. If RETRY is not defined or set to 0, no retry will be performed.
  // It will first wait one second and then for all forthcoming retries it will double the waiting time.
  // By using retry_delay you disable this exponential backoff algorithm
  ,"retry_times": 6

  // Sleep this amount of seconds before each retry when a transfer has failed with a transient error
  ,"retry_delay": 10

  // If local_pck_url is defined, the QCNL will try to retrieve PCK cert chain from local_pck_url first,
  // and failover to pccs_url as in legacy mode.
  //,"local_pck_url": "http://localhost:8081/sgx/certification/v4/"

  // If local_pck_url is not defined, set pck_cache_expire_hours to a none-zero value will enable local cache. 
  // The PCK certificates will be cached in memory and then to the disk drive. 
  // ===== Important: Once the local cache files are created, currently there is no other way to clean them other
  //                  than to delete them manually, or wait for them to expire after "pck_cache_expire_hours" hours.
  //                  To delete the cache files manually, go to these foders:
  //                       Linux : $AZDCAP_CACHE, $XDG_CACHE_HOME, $HOME, $TMPDIR, /tmp/
  //                       Windows : $AZDCAP_CACHE, $LOCALAPPDATA\..\..\LocalLow
  //                  If there is a folder called .dcap-qcnl, delete it. Restart the service after all cache 
  //                  folders were deleted. The same method applies to "verify_collateral_cache_expire_hours"
  ,"pck_cache_expire_hours": 168

  // To set cache expire time for quote verification collateral in hours
  // See the above comment for pck_cache_expire_hours for more information on the local cache.
  ,"verify_collateral_cache_expire_hours": 168

  // When the "local_cache_only" parameter is set to true, the QPL/QCNL will exclusively use PCK certificates 
  // from local cache files and will not request any PCK certificates from service providers, whether local or remote. 
  // To ensure that the PCK cache is available for use, an administrator must pre-populate the cache folders with 
  // the appropriate cache files. To generate these cache files for specific platforms, the administrator can use 
  // the PCCS admin tool. Once the cache files are generated, the administrator must distribute them to each platform 
  // that requires provisioning.
  ,"local_cache_only": false

  // You can add custom request headers and parameters to the get certificate API.
  // But the default PCCS implementation just ignores them. 
  //,"custom_request_options" : {
  //  "get_cert" : {
  //    "headers": {
  //      "head1": "value1"
  //    },
  //    "params": {
  //      "param1": "value1",
  //      "param2": "value2"
  //    }
  //  }
  //}
}
root@playstation:~#

I am running Gramine on a bare metal Debian 12 PC. I tried docker early on but it seemed like too much work to set up attestation etc.

dimakuv · 2023-09-04T14:43:56Z

dimakuv
Sep 4, 2023
Maintainer

The only weird thing to me is this snippet:

root@playstation:~# cat /opt/intel/sgx-dcap-pccs/logs/pccs_server.log
...
2023-09-01 13:03:49.701 [info]: 127.0.0.1 - - [01/Sep/2023:12:03:49 +0000] "POST /sgx/certification/v3/platforms HTTP/1.1" 200 21 "-" "-"

2023-09-01 13:14:18.446 [info]: HTTPS Server is running on: https://localhost:8081
2023-09-01 13:26:06.076 [info]: Client Request-ID : f5015cc064f54ecf9f78e34d3d73b864
2023-09-01 13:26:06.086 [info]: 127.0.0.1 - - [01/Sep/2023:12:26:06 +0000] "GET /sgx/certification/v4/rootcacrl HTTP/1.1" 200 586 "-" "curl/7.88.1"

I don't know if this is normal to mix v3 and v4 requests to the same PCCS server. Maybe @ScottR-Intel knows?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to run encrypted filesystem example #1495

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 5 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Unable to run encrypted filesystem example #1495

lokesh2019 Aug 20, 2023

Replies: 3 comments · 5 replies

lokesh2019 Aug 20, 2023 Author

kailun-qin Aug 21, 2023 Collaborator

dimakuv Aug 21, 2023 Maintainer

lokesh2019 Sep 1, 2023 Author

dimakuv Sep 3, 2023 Maintainer

dimakuv Sep 3, 2023 Maintainer

lokesh2019 Sep 4, 2023 Author

dimakuv Sep 4, 2023 Maintainer

lokesh2019
Aug 20, 2023

Replies: 3 comments 5 replies

lokesh2019
Aug 20, 2023
Author

kailun-qin
Aug 21, 2023
Collaborator

dimakuv Aug 21, 2023
Maintainer

lokesh2019 Sep 1, 2023
Author

dimakuv Sep 3, 2023
Maintainer

dimakuv Sep 3, 2023
Maintainer

lokesh2019 Sep 4, 2023
Author

dimakuv
Sep 4, 2023
Maintainer