gsce 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. #!/usr/bin/env python2
  2. import sys,os
  3. import subprocess
  4. import re
  5. def gen_dockerfile( image_name, app_name, bin_name, proj_dir):
  6. if not os.path.exists(proj_dir + '/Tools/build'):
  7. os.makedirs(proj_dir + '/Tools/build')
  8. df =open(proj_dir + '/Tools/build/Dockerfile' + '.' + app_name, 'w')
  9. df.write('# This file is auto-generated, any edits will be overwritten\n')
  10. df.write('\n')
  11. # Choose the base image from the user input
  12. df.write('FROM '+ image_name + '\n')
  13. df.write('\n')
  14. # SWITCH to ROOT
  15. df.write('# SWITCH to root\n')
  16. df.write('USER root\n\n')
  17. # DOWNLOAD dependencies
  18. df.write('# Download dependencies\n')
  19. df.write('RUN apt-get update && \\\n')
  20. df.write(' apt-get install -y openssl libjemalloc-dev python python-pip python-dev\n')
  21. df.write('RUN pip install protobuf && \\\n')
  22. df.write(' pip install pycrypto\n')
  23. df.write('# Temporal fixes for Dependencies Issue #1: libcrypto.so.1.0.0 and libssl.so.1.0.0 have different locations\n')
  24. if not os.path.isfile('/lib/x86_64-linux-gnu/libcrypto.so.1.0.0'):
  25. df.write('RUN ln -s /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 \\\n')
  26. if not os.path.isfile('/lib/x86_64-linux-gnu/libssl.so.1.0.0'):
  27. df.write('RUN ln -s /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 /lib/x86_64-linux-gnu/libssl.so.1.0.0\n')
  28. # SETUP Directory Structure
  29. df.write('# Setup Directory Structure\n')
  30. df.write('RUN mkdir -p ' + proj_dir + '/LibOS/shim/test/apps/' + app_name + ' \\\n')
  31. df.write(' && mkdir -p ' + proj_dir + '/Pal/src/host/Linux-SGX/signer \\\n')
  32. df.write(' && mkdir -p ' + proj_dir + '/Runtime \\\n')
  33. df.write(' && mkdir /gbin\n')
  34. # COPY system files
  35. df.write('# Copy system files\n')
  36. df.write('COPY Runtime/* ' + proj_dir + '/Runtime/\n')
  37. df.write('COPY Pal/src/Makefile.Host ' + proj_dir + '/Pal/src/Makefile.Host\n')
  38. df.write('COPY Pal/src/host/Linux-SGX/signer/* ' + proj_dir + '/Pal/src/host/Linux-SGX/signer/\n')
  39. # COPY tools for building app instance
  40. df.write('# Copy tools for building app instance\n')
  41. df.write('COPY Tools/build/tools/* /gbin/\n')
  42. df.write('COPY Tools/gen_manifest /gbin/\n')
  43. # Generating manifest file for target app
  44. df.write('# Generating manifest for target app\n')
  45. df.write('RUN /gbin/gen_manifest ' + app_name + ' ' + bin_name + ' ' + proj_dir + '\n')
  46. # Sign Enclave
  47. df.write('# Signing Enclave\n')
  48. df.write('RUN cd ' + proj_dir + '/LibOS/shim/test/apps/' + app_name + ' && \\\n'
  49. ' '+ proj_dir + '/Pal/src/host/Linux-SGX/signer/pal-sgx-sign -libpal ' + proj_dir +
  50. '/Pal/src/host/Linux-SGX/../../../../Runtime/libpal-Linux-SGX.so -key ' + proj_dir +
  51. '/Pal/src/host/Linux-SGX/signer/enclave-key.pem -output ' + app_name + '.manifest.sgx ' +
  52. '-manifest ' + app_name + '.manifest\n')
  53. # Remove signing key
  54. df.write('# Removing key after signing\n')
  55. # Overwrite Entry Point
  56. df.write('ENTRYPOINT ["/bin/bash", "/gbin/app_exec"]\n')
  57. df.close()
  58. def make_executable(path):
  59. mode = os.stat(path).st_mode
  60. mode |= (mode & 0o444) >> 2 # copy R bits to X
  61. os.chmod(path, mode)
  62. def gen_app_executor(app_name, bin_cmd, proj_dir):
  63. if not os.path.exists(proj_dir + '/Tools/build/tools'):
  64. os.makedirs(proj_dir + '/Tools/build/tools')
  65. e_path = proj_dir + '/Tools/build/tools/app_exec'
  66. ef = open(e_path, 'w')
  67. make_executable(e_path)
  68. ef.write('#!/usr/bin/env bash\n\n')
  69. ef.write('cd ' + proj_dir + '/LibOS/shim/test/apps/' + app_name +'\n')
  70. ef.write('# Generate EINITOKEN\n')
  71. ef.write(proj_dir + '/Pal/src/host/Linux-SGX/signer/pal-sgx-get-token -output '
  72. + app_name + '.token -sig ' + app_name + '.sig\n')
  73. ef.write('# Run the application\n')
  74. ef.write('SGX=1 ./' + app_name + '.manifest.sgx ' + bin_cmd + '\n')
  75. ef.close()
  76. if __name__ == '__main__':
  77. if len(sys.argv) < 3:
  78. print('Usage: gsce run [Image name]')
  79. exit()
  80. image_name = sys.argv[-1]
  81. image_match = re.match(r'([^:]*)(:*)(.*)', image_name)
  82. if image_match:
  83. app_name = image_match.group(1)
  84. # application name may contain '/', remove it
  85. app_name = app_name.split('/')[0]
  86. inspect_cmd = 'sudo docker inspect --format \'{{.Config.Cmd}}\' ' + image_name
  87. res = subprocess.check_output(inspect_cmd, shell=True).strip()
  88. # Docker image may execute '[/bin/sh -c command]', replace with just '[command]'
  89. if res.startswith('[/bin/sh -c '):
  90. res = '[' + res[len('[/bin/sh -c '):]
  91. match = re.match(r'\[([^\s]*)\s*(.*)\]', res)
  92. bin_name = match.group(1)
  93. bin_cmd = ''
  94. if match.group(2):
  95. bin_cmd = match.group(2)
  96. # Store the rest arguments as Docker run arguments
  97. docker_str = ' ' + ' '.join(sys.argv[2:-1])
  98. # print image_cmd
  99. proj_dir = os.path.abspath(os.getcwd() + '/../')
  100. # STEP 1: Generating Dockerfile
  101. gen_dockerfile(image_name, app_name, bin_name, proj_dir)
  102. # STEP 2: Generating entry point execute script
  103. gen_app_executor(app_name, bin_cmd, proj_dir)
  104. # STEP 3: Building new docker image with generated Dockerfile
  105. os.chdir('..')
  106. os.system('sudo docker build -f Tools/build/Dockerfile.' + app_name + ' -t gsc_' + app_name + ' .\n')
  107. # STEP 4: Run GSC with the target app
  108. os.system('sudo docker run -i -t' + docker_str +' --device=/dev/gsgx --device=/dev/isgx ' +
  109. '-v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket gsc_' + app_name + '\n')