* SGX device & noexec /dev
@ 2020-03-19 11:50 Jethro Beekman
2020-03-19 14:24 ` Sean Christopherson
0 siblings, 1 reply; 2+ messages in thread
From: Jethro Beekman @ 2020-03-19 11:50 UTC (permalink / raw)
To: linux-sgx@vger.kernel.org; +Cc: assaf
[-- Attachment #1: Type: text/plain, Size: 289 bytes --]
Hi all,
One of our users discovered that some distros (notably at least Ubuntu 20.04) mount /dev noexec. This prevents mmap(PROT_EXEC) on the SGX device. Do we have any recourse other than telling distros not to do this if they want to support SGX?
--
Jethro Beekman | Fortanix
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4054 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: SGX device & noexec /dev
2020-03-19 11:50 SGX device & noexec /dev Jethro Beekman
@ 2020-03-19 14:24 ` Sean Christopherson
0 siblings, 0 replies; 2+ messages in thread
From: Sean Christopherson @ 2020-03-19 14:24 UTC (permalink / raw)
To: Jethro Beekman; +Cc: linux-sgx@vger.kernel.org, assaf
On Thu, Mar 19, 2020 at 12:50:05PM +0100, Jethro Beekman wrote:
> Hi all,
>
> One of our users discovered that some distros (notably at least Ubuntu 20.04)
> mount /dev noexec. This prevents mmap(PROT_EXEC) on the SGX device. Do we
> have any recourse other than telling distros not to do this if they want to
> support SGX?
Hmm, going the anon inode approach should avoid that issue, but then folks
running SELinux get the short end of the stick due to EXECMEM triggering.
The SELinux issue can be hacked around, e.g. by adding a way to identify
that a file is an enclave. A similar hack would work for noexec, though
it'd likely be an even uglier hack.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-19 14:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-19 11:50 SGX device & noexec /dev Jethro Beekman
2020-03-19 14:24 ` Sean Christopherson
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.