httpd.manifest.template 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122
  1. # Apache manifest example
  2. #
  3. # This manifest was prepared and tested on Ubuntu 16.04.
  4. #
  5. # Apache must be run with the pal_loader:
  6. #
  7. # ./pal_loader httpd.manifest <script>
  8. # The executable to load in Graphene.
  9. loader.exec = file:$(INSTALL_DIR)/bin/httpd
  10. loader.execname = httpd
  11. # Graphene environment, including the path to the library OS and the debug
  12. # option (inline/none).
  13. loader.preload = file:$(GRAPHENEDIR)/Runtime/libsysdb.so
  14. loader.debug_type = $(GRAPHENEDEBUG)
  15. # Environment variables
  16. loader.env.LD_LIBRARY_PATH = /lib:/lib/x86_64-linux-gnu:/usr/lib:/usr/lib/x86_64-linux-gnu
  17. # Mounted FSes. The following "chroot" FSes mount a part of the host FS into the
  18. # guest. Other parts of the host FS will not be available in the guest.
  19. # Default glibc files, mounted from the Runtime directory in GRAPHENEDIR.
  20. fs.mount.lib.type = chroot
  21. fs.mount.lib.path = /lib
  22. fs.mount.lib.uri = file:$(GRAPHENEDIR)/Runtime
  23. # Host-level libraries (/lib/x86_64-linux-gnu) required by Apache
  24. fs.mount.lib2.type = chroot
  25. fs.mount.lib2.path = /lib/x86_64-linux-gnu
  26. fs.mount.lib2.uri = file:/lib/x86_64-linux-gnu
  27. # Host-level directory (/usr) required by Apache (needed for libaprutil-1.so)
  28. fs.mount.usr.type = chroot
  29. fs.mount.usr.path = /usr
  30. fs.mount.usr.uri = file:/usr
  31. # Host-level directory (/etc) required by Apache (needed mostly for SSL/TLS)
  32. fs.mount.etc.type = chroot
  33. fs.mount.etc.path = /etc
  34. fs.mount.etc.uri = file:/etc
  35. # Mount the current working directory
  36. fs.mount.cwd.type = chroot
  37. fs.mount.cwd.path = $(INSTALL_DIR_ABSPATH)
  38. fs.mount.cwd.uri = file:$(INSTALL_DIR)
  39. # SGX general options
  40. # Set the virtual memory size of the SGX enclave. For SGX v1, the enclave
  41. # size must be specified during signing. If Apache needs more virtual memory
  42. # than the enclave size, Graphene will not be able to allocate it.
  43. sgx.enclave_size = 512M
  44. # Set the maximum number of enclave threads. For SGX v1, the number of enclave
  45. # TCSes must be specified during signing, so the application cannot use more
  46. # threads than the number of TCSes. Note that Graphene also creates an internal
  47. # thread for handling inter-process communication (IPC), and potentially another
  48. # thread for asynchronous events. Therefore, the actual number of threads that
  49. # the application can create is (sgx.thread_num - 2).
  50. #
  51. # We (somewhat arbitrarily) specify 32 threads since mpm_worker_module can create
  52. # up to 25 threads/process.
  53. sgx.thread_num = 32
  54. # SGX trusted libraries
  55. # Glibc libraries
  56. sgx.trusted_files.ld = file:$(GRAPHENEDIR)/Runtime/ld-linux-x86-64.so.2
  57. sgx.trusted_files.libc = file:$(GRAPHENEDIR)/Runtime/libc.so.6
  58. sgx.trusted_files.libm = file:$(GRAPHENEDIR)/Runtime/libm.so.6
  59. sgx.trusted_files.libdl = file:$(GRAPHENEDIR)/Runtime/libdl.so.2
  60. sgx.trusted_files.librt = file:$(GRAPHENEDIR)/Runtime/librt.so.1
  61. sgx.trusted_files.libutil = file:$(GRAPHENEDIR)/Runtime/libutil.so.1
  62. sgx.trusted_files.libpthread = file:$(GRAPHENEDIR)/Runtime/libpthread.so.0
  63. sgx.trusted_files.libresolvOrig = file:$(GRAPHENEDIR)/Runtime/libresolv.so.2 #This library is needed for libphp7.so. If the original library (in /lib/x...) is loaded, then it relies on a different libc version and throws a runtime linker error, so we add this library before and by the first FS mapping rule, it will find the correct library at runtime.
  64. # Other libraries required by Apache - it looks like the underscores in the next two libs gave nasty errors at runtime?
  65. sgx.trusted_files.libgccs = file:/lib/x86_64-linux-gnu/libgcc_s.so.1
  66. sgx.trusted_files.nssfiles = file:/lib/x86_64-linux-gnu/libnss_files.so.2
  67. sgx.trusted_files.libnsscompat = file:/lib/x86_64-linux-gnu/libnss_compat.so.2
  68. sgx.trusted_files.libnssnis = file:/lib/x86_64-linux-gnu/libnss_nis.so.2
  69. sgx.trusted_files.libnsl = file:/lib/x86_64-linux-gnu/libnsl.so.1
  70. # Apache modules and dependencies
  71. $(HTTPD_TRUSTED_MODS)
  72. $(HTTPD_TRUSTED_LIBS)
  73. # Apache configuration (trusted)
  74. sgx.trusted_files.conf1 = file:$(INSTALL_DIR)/conf/httpd-graphene.conf
  75. sgx.trusted_files.conf2 = file:$(INSTALL_DIR)/conf/extra/httpd-ssl-graphene.conf
  76. sgx.trusted_files.conf3 = file:$(INSTALL_DIR)/conf/mime.types
  77. # Apache SSL/TLS files (trusted)
  78. sgx.trusted_files.server_cert = file:$(INSTALL_DIR)/conf/server.crt
  79. sgx.trusted_files.server_key = file:$(INSTALL_DIR)/conf/server.key
  80. # Apache HTTP documents (trusted)
  81. # We only specify those documents used in our tests/benchmarks.
  82. sgx.trusted_files.htdocs1 = file:$(INSTALL_DIR)/htdocs/index.html
  83. sgx.trusted_files.htdocs2 = file:$(INSTALL_DIR)/htdocs/random/10K.1.html
  84. # Apache logs directory (untrusted and allowed, since log files are not security-critical)
  85. sgx.allowed_files.logs = file:$(INSTALL_DIR)/logs
  86. # Name Service Switch (NSS) files, see 'man nsswitch.conf'
  87. sgx.allowed_files.nsswitch = file:/etc/nsswitch.conf
  88. sgx.allowed_files.ethers = file:/etc/ethers
  89. sgx.allowed_files.hosts = file:/etc/hosts
  90. sgx.allowed_files.group = file:/etc/group
  91. sgx.allowed_files.passwd = file:/etc/passwd
  92. # getaddrinfo(3) configuration file, see 'man gai.conf'
  93. sgx.allowed_files.gaiconf = file:/etc/gai.conf
  94. sgx.trusted_files.indexphp = file:$(INSTALL_DIR)/htdocs/index.php
  95. sgx.trusted_files.actionphp = file:$(INSTALL_DIR)/htdocs/action.php
  96. sgx.trusted_files.phpini = file:$(INSTALL_DIR)/lib/php.ini
  97. sgx.trusted_files.mainextension=file:$(INSTALL_DIR)/modules/localattestation_decryption.so
  98. sgx.trusted_files.libphpcpp=file:/usr/lib/libphpcpp.so.2.1
  99. sgx.trusted_files.libprotobuf=file:/usr/lib/x86_64-linux-gnu/libprotobuf.so.9