Aws target booting in live nitro enclaves

This commit is contained in:
Lance Vick 2022-09-26 16:07:37 -07:00
parent db8f90ad47
commit 200f4d94f6
Signed by: lrvick
GPG Key ID: 8E47A1EC35A1551D
4 changed files with 2070 additions and 1830 deletions

View File

@ -10,6 +10,7 @@ USER := $(shell id -g):$(shell id -g)
CPUS := $(shell nproc)
ARCH := x86_64
TARGET_NAME := bzImage
, := ,
include $(PWD)/config/global.env
@ -291,7 +292,7 @@ $(OUT_DIR)/$(TARGET)/bzImage: \
sha256sum /out/$(TARGET)/bzImage; \
")
$(OUT_DIR)/$(TARGET)/eif_build:
$(OUT_DIR)/aws/eif_build:
ifeq ($(TARGET), aws)
$(call toolchain,$(USER)," \
cd /cache/aws-nitro-enclaves-image-format \
@ -300,8 +301,8 @@ ifeq ($(TARGET), aws)
")
endif
$(OUT_DIR)/$(TARGET)/nitro.eif: \
$(OUT_DIR)/$(TARGET)/eif_build \
$(OUT_DIR)/aws/nitro.eif: \
$(OUT_DIR)/aws/eif_build \
$(OUT_DIR)/$(TARGET)/bzImage \
$(OUT_DIR)/rootfs.cpio
ifeq ($(TARGET), aws)
@ -309,9 +310,9 @@ ifeq ($(TARGET), aws)
/out/eif_build \
--kernel /out/$(TARGET)/bzImage \
--kernel_config /config/$(TARGET)/linux.config \
--cmdline "init=/init" \
--cmdline 'reboot=k initrd=0x2000000$(,)3228672 root=/dev/ram0 panic=1 pci=off nomodules console=ttyS0 i8042.noaux i8042.nomux i8042.nopnp i8042.dumbkbd' \
--ramdisk /out/rootfs.cpio \
--output /out/$(TARGET)/nitro.eif \
--output /out/aws/nitro.eif; \
")
endif

7
TODO
View File

@ -1,7 +1,6 @@
* Optionally link rootfs into kernel based on target
* Fully carve out dedicated nitro target
* Only build nitro with TARGET=nitro
* verify nitro demo actually boots in live enclaves
* have "sign" make target that creates/signs hash manifest of all targets
* compile against musl
* fix kernel cache misses that result in re-pull/rebuild on every build
* harden aws kernel to Kernel Self Protection Project guidelines
* get nitro init binary to return attestation cert from amazon
* re-write c init in rust

File diff suppressed because it is too large Load Diff

View File

@ -1,9 +1,189 @@
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <getopt.h>
#include <signal.h>
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/reboot.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <linux/vm_sockets.h>
#include <poll.h>
int main(int argc, char **argv) {
(void) argc;
(void) argv;
puts("Appliance Linux Sample Init");
sleep(0xFFFFFFFF);
_Noreturn void die(const char *msg);
#define die_on(CONDITION, ...) \
do { \
if (CONDITION) { \
die(__VA_ARGS__); \
} \
} while (0)
#define finit_module(fd, param_values, flags) (int)syscall(__NR_finit_module, fd, param_values, flags)
#define DEFAULT_PATH_ENV "PATH=/sbin:/usr/sbin:/bin:/usr/bin"
#define NSM_PATH "nsm.ko"
#define TIMEOUT 20000
#define VSOCK_PORT 9000
#define VSOCK_CID 3
#define HEART_BEAT 0xB7
const char *const default_envp[] = {
DEFAULT_PATH_ENV,
NULL,
};
const char *const default_argv[] = { "sh", NULL };
struct Mount {
const char *source, *target, *type;
unsigned long flags;
const void *data;
};
struct Mkdir {
const char *path;
mode_t mode;
};
struct Mknod {
const char *path;
mode_t mode;
int major, minor;
};
struct Symlink {
const char *linkpath, *target;
};
enum OpType {
OpMount,
OpMkdir,
OpMknod,
OpSymlink,
};
struct InitOp {
enum OpType op;
union {
struct Mount mount;
struct Mkdir mkdir;
struct Mknod mknod;
struct Symlink symlink;
};
};
const struct InitOp ops[] = {
{ OpMount, .mount = { "proc", "/proc", "proc", MS_NODEV | MS_NOSUID | MS_NOEXEC } },
{ OpSymlink, .symlink = { "/dev/fd", "/proc/self/fd" } },
{ OpSymlink, .symlink = { "/dev/stdin", "/proc/self/fd/0" } },
{ OpSymlink, .symlink = { "/dev/stdout", "/proc/self/fd/1" } },
{ OpSymlink, .symlink = { "/dev/stderr", "/proc/self/fd/2" } },
{ OpMkdir, .mkdir = { "/dev/shm", 0755 } },
{ OpMkdir, .mkdir = { "/dev/pts", 0755 } },
{ OpMount, .mount = { "devpts", "/dev/pts", "devpts", MS_NOSUID | MS_NOEXEC } },
{ OpMount, .mount = { "sysfs", "/sys", "sysfs", MS_NODEV | MS_NOSUID | MS_NOEXEC } },
};
void warn(const char *msg) {
int error = errno;
perror(msg);
errno = error;
}
void warn2(const char *msg1, const char *msg2) {
int error = errno;
fputs(msg1, stderr);
fputs(": ", stderr);
errno = error;
warn(msg2);
}
_Noreturn void dien() {
exit(errno);
}
_Noreturn void die(const char *msg) {
warn(msg);
dien();
}
_Noreturn void die2(const char *msg1, const char *msg2) {
warn2(msg1, msg2);
dien();
}
void init_dev() {
if (mount("dev", "/dev", "devtmpfs", MS_NOSUID | MS_NOEXEC, NULL) < 0) {
warn2("mount", "/dev");
if (errno != EBUSY) {
dien();
}
}
}
void init_console() {
const char *console_path = "/dev/console";
die_on(freopen(console_path, "r", stdin) == NULL,
"freopen failed for stdin");
die_on(freopen(console_path, "w", stdout) == NULL,
"freopen failed for stdout");
die_on(freopen(console_path, "w", stderr) == NULL,
"freopen failed for stderr");
}
void enclave_ready() {
int socket_fd;
struct sockaddr_vm sa = {
.svm_family = AF_VSOCK,
.svm_cid = VSOCK_CID,
.svm_port = VSOCK_PORT,
.svm_reserved1 = 0,
};
uint8_t buf[1];
buf[0] = HEART_BEAT;
errno = -EINVAL;
socket_fd = socket(AF_VSOCK, SOCK_STREAM, 0);
die_on(socket_fd < 0, "socket");
die_on(connect(socket_fd, (struct sockaddr*) &sa, sizeof(sa)), "connect");
die_on(write(socket_fd, buf, 1) != 1, "write heartbeat");
die_on(read(socket_fd, buf, 1) != 1, "read heartbeat");
die_on(buf[0] != HEART_BEAT, "received wrong heartbeat");
die_on(close(socket_fd), "close");
}
void init_nsm_driver() {
int fd;
int rc;
fd = open(NSM_PATH, O_RDONLY | O_CLOEXEC);
if (fd < 0 && errno == ENOENT) {
return;
}
die_on(fd < 0, "failed to open nsm fd");
rc = finit_module(fd, "", 0);
die_on(rc < 0, "failed to insert nsm driver");
die_on(close(fd), "close nsm fd");
rc = unlink(NSM_PATH);
if (rc < 0)
warn("Could not unlink " NSM_PATH);
}
int main() {
init_dev();
init_console();
//init_nsm_driver();
enclave_ready();
puts("\nHello World!\n");
reboot(RB_AUTOBOOT);
}