Are the endpoints of programs running within SGX inaccessible?

[sho4510]

I was able to run geth within sgx, but geth.ipc is not displayed and cannot be used. Is it not available in sgx?
The URL below is displayed in the actual log, but I cannot confirm it.

DEBUG[01-07|15:13:20.451] IPCs registered                          namespaces=admin,debug,web3,eth,txpool,clique,miner,net,engine
(libos_epoll.c:368:do_epoll_add) [P1:T1:geth] debug: epoll: added 69 (0x3fc721018) to epoll handle 0x3fcfe21c8
INFO [01-07|15:13:20.451] IPC endpoint opened                      url=/go-ethereum/geth-network/miner/geth.ipc
DEBUG[01-07|15:13:20.451] Allowed origin(s) for WS RPC interface [http://localhost http://sgx-test] 
INFO [01-07|15:13:20.452] Loaded JWT secret file                   path=/etc/jwt.hex crc32=0xf0cc454b
DEBUG[01-07|15:13:20.452] Allowed origin(s) for WS RPC interface [localhost] 
(libos_epoll.c:368:do_epoll_add) [P1:T1:geth] debug: epoll: added 70 (0x3fc721478) to epoll handle 0x3fcfe21c8
INFO [01-07|15:13:20.452] HTTP server started                      endpoint=[::]:8552 auth=false prefix= cors=* vhosts=localhost
(libos_epoll.c:368:do_epoll_add) [P1:T1:geth] debug: epoll: added 71 (0x3fc7216a8) to epoll handle 0x3fcfe21c8
INFO [01-07|15:13:20.452] WebSocket enabled                        url=ws://127.0.0.1:8546
(libos_epoll.c:368:do_epoll_add) [P1:T1:geth] debug: epoll: added 72 (0x3fc7218d8) to epoll handle 0x3fcfe21c8
INFO [01-07|15:13:20.453] WebSocket enabled                        url=ws://[::]:8553
INFO [01-07|15:13:20.453] HTTP server started                      endpoint=[::]:8553 auth=true  prefix= cors=localhost vhosts=*
DEBUG[01-07|15:13:20.456] TCP listener up                          addr=[::]:30305

INFO [01-07|15:13:20.451] IPC endpoint opened url=/go-ethereum/geth-network/miner/geth.ipc

[dimakuv]

Sorry, we are not familiar with Geth. I don't know what this IPC endpoint is. Looks like IPC endpoints are just TCP/IP listening connections (WebSockets), listening on a particular port? If so, then Gramine fully supports TCP/IP connections. You probably want to enable sys.enable_extra_runtime_domain_names_conf = true in the Gramine manifest file.

[kailun-qin]

Maybe it's more effecient to be triaged under Geth discussions, similar to #1702? cc @lead4good

[sho4510]

Thank you for your reply. The following is manifest.template.

loader.entrypoint = "file:{{ gramine.libos }}"

# Entrypoint binary which Gramine invokes.
libos.entrypoint = "{{ entrypoint }}"

loader.log_level = "debug"

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}:/usr/lib:/usr/{{ arch_libdir }}"

loader.argv_src_file = "file:geth.args"

sys.enable_sigterm_injection = true
sys.enable_extra_runtime_domain_names_conf = true
sys.insecure__allow_eventfd = true
sys.experimental__enable_flock = true

sgx.remote_attestation = "none"

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr", uri = "file:/usr" },
  { path = "/etc", uri = "file:/etc" },
  { type = "tmpfs", path = "/root/.ethereum" },
  { type = "tmpfs", path = "/tmp" },
  { path = "/geth", uri = "file:geth" },
  { path = "/go-ethereum/geth-network/", uri = "file:go-ethereum/geth-network/" },
  { path = "/go-ethereum/geth-network/miner/geth/", uri = "file:go-ethereum/geth-network/miner/geth/" },
  { path = "/go-ethereum/geth-network/miner/", uri = "file:go-ethereum/geth-network/miner/" },
  { path = "/go-ethereum/geth-network/miner/geth/chaindata/", uri = "file:go-ethereum/geth-network/miner/geth/chaindata/" },
  { path = "/go-ethereum/geth-network/miner/geth/chaindata/ancient/", uri = "file:go-ethereum/geth-network/miner/geth/chaindata/ancient/" },
  { path = "/lib/ssl/certs/", uri = "file:/lib/ssl/certs/" },
  { path = "/etc/ssl/certs/", uri = "file:/etc/ssl/certs/" }, 
]

sgx.nonpie_binary = true
sgx.enclave_size = "{{ enclave_size }}"
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.max_threads = 128
sgx.debug = true
sgx.thread_num = 16

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ entrypoint }}",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
  "file:geth",
  "file:geth.args",
  "file:/etc/ssl/certs/ca-certificates.crt",
  "file:/lib/ssl/certs/",
  "file:/etc/ssl/certs/",
]

sgx.allowed_files = [
  "file:/etc/nsswitch.conf",
  "file:/etc/localtime",
  "file:/etc/hosts",
  "file:/etc/passwd",
  "file:/etc/jwt.hex",
  "file:/data",
  "file:data",
  "file:go-ethereum/geth-network/miner/keystore/",
  "file:go-ethereum/geth-network/miner/geth/chaindata/",
  "file:go-ethereum/geth-network/miner/geth/chaindata",
  "file:go-ethereum/geth-network/miner/geth/",
  "file:go-ethereum/geth-network/miner/",
]

Looks like you've already set it to true.

sys.enable_extra_runtime_domain_names_conf = true

[sho4510]

Apparently geth.ipc cannot be executed when running the geth client within sgx. I worked around it by indirectly using JSON-RPC instead. Thank you very much for your advice.