Graphene itself is licensed under the LGPL.

Graphene on an SGX host requires a kernel driver (in
Pal/src/host/Linux-SGX/sgx-driver), which is separately licensed under
the GPL.  

Graphene also includes the following third party sources (and licenses):

mbedtls crypto libraries - Apache 2.0

RSA's MD5 algorithm (LibOS/shim/src/utils/md5.c) - RSA custom attribution license

Internet Software Consortium (permissive license): Pal/lib/network/inet_pton.c

MIT JOS (mix of MIT and BSD licenses:
* Pal/lib/stdlib/printfmt.c

A number of files taken from other C libraries:
* musl - MIT
* glibc - LGPL
 ** clone, sysdeps.h (and variants) used in code
 ** Pal/src/host/Linux/clone-x86_64.S
 ** LibOS/shim/include/elf.h
 ** LibOS/shim/src/elf/ - basically the whole directory, and most code related to linking and loading (e.g., Pal/src/db_rtld.c)
 ** Pal/include/elf/elf.h
 ** Pal/include/sysdeps/generic/ldsodefs.h
 ** Pal/include/sysdeps/generic/memcopy.h
 ** Pal/include/sysdeps/generic/sysdep.h
 ** Pal/lib/network/hton.c
 ** Pal/lib/string/ - the whole directory
 ** Pal/src/dynamic_link.h, do-rel.h , dl-machine-x86_64.h
 ** Pal/src/host/Linux/gettimeofday-x86_64.S
 ** Pal/src/host/Linux/include/ - whole directory - for signal API definitions
 ** We also build a patched glibc, but this could be moved into a separate repo

Some app and benchmark sources are redistributed under
LibOS/shim/test/apps.  These will be migrated to subrepositories, as
needed, and should be considered separate projects, subject to their
original licenses.