Dockerfile 5.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798
  1. FROM graphene
  2. ENV SGX_SDK=/opt/intel/sgxsdk/
  3. RUN mkdir source
  4. WORKDIR source
  5. ## Setting up prereqs for decryptor - Intel SGX SSL
  6. # Just curling the tar.gz file and then running the build script didn't work as the extracted folder had a different name (dependent on the foldername which was compressed) --- I didnt want to make a new fork of the sgxssl script for that.
  7. RUN git clone https://github.com/openssl/openssl.git OpenSSL_1.1.1d && \
  8. cd OpenSSL_1.1.1d && git checkout tags/OpenSSL_1_1_1d && \
  9. cd ../ && tar -cf OpenSSL_1.1.1d.tar.gz OpenSSL_1.1.1d/
  10. #Setting up SGXSSL with the version of OpenSSL that we downloaded in the previous step.
  11. RUN git clone https://github.com/intel/intel-sgx-ssl.git && \
  12. cd intel-sgx-ssl && git checkout tags/lin_2.5_1.1.1d && \
  13. cp ../OpenSSL_1.1.1d.tar.gz ./openssl_source/ && \
  14. cd Linux && make && make install
  15. #Setting up protobuf definitions for exchanging LA and post-LA messages between enclaves.
  16. RUN git clone https://git-crysp.uwaterloo.ca/miti/dhmsgs_proto_defs.git && \
  17. cd dhmsgs_proto_defs/ && protoc --cpp_out=./ ./*.proto
  18. #Setting up the decryptor enclave itself.
  19. RUN git clone https://git-crysp.uwaterloo.ca/miti/Decryptor.git && \
  20. cd Decryptor/ && make
  21. #Setting up common files used in the verifier, PHP extension for LA/post-LA message processing.
  22. RUN git clone https://git-crysp.uwaterloo.ca/miti/commonVerifierPHPfiles.git
  23. #Setting up a patched version of the linux-sgx repo's SDK for running LA on graphene.
  24. RUN git clone https://git-crysp.uwaterloo.ca/miti/linux-sgx-trts-modified.git && \
  25. cd linux-sgx-trts-modified && git checkout local_attestation_for_graphene && \
  26. bash ./download_prebuilt.sh && make USE_OPT_LIBS=0
  27. #Setting up the verifier.
  28. RUN git clone https://git-crysp.uwaterloo.ca/miti/verifier.git && \
  29. cd verifier/ && git checkout recreating_state_for_teeter && \
  30. export SGX_SDK_TRTS_MODIFIED=/root/source/linux-sgx-trts-modified/build/linux && make && \
  31. cp verifier /root/graphene/LibOS/shim/test/native && \
  32. git checkout master && \
  33. cp verifier.manifest.template /root/graphene/LibOS/shim/test/native
  34. #Build the verifier
  35. WORKDIR /root/graphene/LibOS/shim/test/native
  36. #Treat the verifier as an executable whose manifest is to be generated from its manifest.template file in this folder.
  37. RUN sed -i s/ls.manifest/'ls.manifest verifier.manifest'/g Makefile
  38. RUN make SGX=1
  39. RUN apt update && apt install -y php7.0-dev tmux libxml2-dev
  40. WORKDIR /root/source
  41. RUN git clone --recursive https://github.com/CopernicaMarketingSoftware/PHP-CPP.git && \
  42. cd PHP-CPP/ && git checkout tags/v2.1.4 && make all && \
  43. cp libphpcpp.so.* /usr/lib/ && make install
  44. #Dependencies for Apache
  45. RUN apt update && apt install -y build-essential flex libapr1-dev libaprutil1-dev libpcre2-dev apache2-utils libssl-dev
  46. RUN git clone https://git-crysp.uwaterloo.ca/miti/Apache_PHP_extension.git && \
  47. cd Apache_PHP_extension && git checkout recreating_state_for_teeter && \
  48. make
  49. WORKDIR /root/graphene/LibOS/shim/test/apps/apache
  50. #Modifying the Makefile to generate the php module.
  51. RUN sed -i s/'LISTEN_HOST ?= 127.0.0.1'/'LISTEN_HOST ?= 0.0.0.0'/g Makefile
  52. RUN sed -i s/'LISTEN_PORT ?= 8001'/'LISTEN_PORT ?= 80'/g Makefile
  53. RUN sed -i 's:testdata ssldata:ssldata $(INSTALL_DIR)/modules/libphp7.so:' Makefile
  54. RUN sed -i s/"'-'"/"'-' | tr '+' 'p'"/g Makefile #Fix for stdc++ to be named as a key sgx.trusted_files.stdcpp in the autogenerated manifest.
  55. #Copy the PHP 7 archive (PHPCPP requires at least version 7)
  56. RUN cp /root/source/Apache_PHP_extension/*.tar.gz ./
  57. #Copy targets for generating the php module library from the archive to the makefile.
  58. RUN cat /root/source/Apache_PHP_extension/apacheMakefile >> Makefile
  59. #Install dependencies for Apache
  60. RUN apt update && apt install -y build-essential flex libapr1-dev libaprutil1-dev libpcre2-dev apache2-utils libssl-dev
  61. #Make the apache/php build first
  62. #In the new graphene version, runtime tokens are also generated along with the manifests, and these tokens require the AESMD service.
  63. #We start the aesmd service at runtime and generate all targets by running 'make SGX=1' on this folder at runtime.
  64. RUN make SGX=1 build-apache-with-php
  65. #Add the updated httpd.manifest.template #Todo update manifest.
  66. RUN cp /root/source/Apache_PHP_extension/httpd.manifest.template ./
  67. #Add the extension to the modules folder.
  68. RUN cp /root/source/Apache_PHP_extension/localattestation_decryption.so install/modules/
  69. #Add the PHP .ini file from the PHP folder to the location accessed by the PHP setup at runtime
  70. RUN cp ./php-7.0.7/php.ini-development install/lib/php.ini
  71. #Add the extension path and the extension name to the php.ini
  72. RUN echo "extension_dir=/root/graphene/LibOS/shim/test/apps/apache/install/modules" >> install/lib/php.ini && \
  73. echo "extension=localattestation_decryption.so" >> install/lib/php.ini
  74. #Add all php source code files to the right place.
  75. RUN cp /root/source/Apache_PHP_extension/*.php install/htdocs
  76. #Fix the configuration file for Apache
  77. RUN printf '\nAcceptFilter http none\n<IfModule mime_module>\n AddType application/x-httpd-php .php\n</IfModule>\n' >> install/conf/httpd.conf
  78. RUN sed -i 's/DirectoryIndex.*/DirectoryIndex index.php index.html/g' install/conf/httpd.conf
  79. WORKDIR /root
  80. COPY deploy_enclaves.sh ./
  81. RUN chmod 755 ./deploy_enclaves.sh
  82. COPY find_docker_ip.sh ./
  83. RUN chmod 755 ./find_docker_ip.sh