From: Sean Christopherson <sean.j.christopherson@intel.com>
To: Jethro Beekman <jethro@fortanix.com>
Cc: "linux-sgx@vger.kernel.org" <linux-sgx@vger.kernel.org>, assaf@enigma.co
Subject: Re: SGX device & noexec /dev
Date: Thu, 19 Mar 2020 07:24:35 -0700 [thread overview]
Message-ID: <20200319142434.GA11305@linux.intel.com> (raw)
In-Reply-To: <4db41057-910c-b686-0428-474debe382c1@fortanix.com>
On Thu, Mar 19, 2020 at 12:50:05PM +0100, Jethro Beekman wrote:
> Hi all,
>
> One of our users discovered that some distros (notably at least Ubuntu 20.04)
> mount /dev noexec. This prevents mmap(PROT_EXEC) on the SGX device. Do we
> have any recourse other than telling distros not to do this if they want to
> support SGX?
Hmm, going the anon inode approach should avoid that issue, but then folks
running SELinux get the short end of the stick due to EXECMEM triggering.
The SELinux issue can be hacked around, e.g. by adding a way to identify
that a file is an enclave. A similar hack would work for noexec, though
it'd likely be an even uglier hack.
prev parent reply other threads:[~2020-03-19 14:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-19 11:50 SGX device & noexec /dev Jethro Beekman
2020-03-19 14:24 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200319142434.GA11305@linux.intel.com \
--to=sean.j.christopherson@intel.com \
--cc=assaf@enigma.co \
--cc=jethro@fortanix.com \
--cc=linux-sgx@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).