ae: blank out ld-linux.so interpretor path from AEs #435
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The enclaves are getting built as ELF executables, and thus the linker
will embed the current ld-linux.so path for the host OS environment
in the binary:
$ readelf -a libsgx_tdqe.signed.so | grep interpreter
[Requesting program interpreter: /nix/store/xmprbk52mlcdsljz66m8yf7cf0xf36n1-glibc-2.38-44/lib/ld-linux-x86-64.so.2]
The SGX enclaves are never loaded using ld-linux.so, as SGX has custom
code for loading enclaves in the required manner.
This embedded ld-linux.so path thus serves no functional purpose, while
also making it harder to do a reproducible build of the enclaves outside
of the NixOS environment.
This patch blanks out the NixOX interpretor path, by setting it to the
empty string.
Related: intel/linux-sgx#1040
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
fchinchilla
reviewed
Oct 9, 2024
| @@ -135,7 +136,8 @@ ENCLAVE_LDFLAGS := -Wl,-z,relro,-z,now,-z,noexecstack -fPIC \ | |||
| -Wl,-pie,-eenclave_entry -Wl,--export-dynamic -Wl,-Map,qve.map \ | |||
| -Wl,--defsym,__ImageBase=0 \ | |||
| -Wl,--build-id \ | |||
| -Wl,--version-script=Enclave/linux/qve.lds | |||
| -Wl,--version-script=Enclave/linux/qve.lds \ | |||
| -Wl,--dynamic-linker, | |||
There was a problem hiding this comment.
Just curious, is this equivalent, or different in any way from
-Wl,--no-dynamic-linker
?
There was a problem hiding this comment.
They are different
- "-Wl,--dynamic-linker," results in an ELF '.interp' section being present, with zero-length string.
- "-Wl,--no-dynamic-linker" results in the ELF '.interp' section being entirely absent, and in addition removes the ELF program header
It is possible this difference might not matter, but I don't know enough to be confident suggesting that - similar to how "-Wl,--shared" might another option. It would need an SGX expert to analyse this and make a decision.
fchinchilla
approved these changes
Oct 11, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The enclaves are getting built as ELF executables, and thus the linker will embed the current ld-linux.so path for the host OS environment in the binary:
$ readelf -a libsgx_tdqe.signed.so | grep interpreter
[Requesting program interpreter: /nix/store/xmprbk52mlcdsljz66m8yf7cf0xf36n1-glibc-2.38-44/lib/ld-linux-x86-64.so.2]
The SGX enclaves are never loaded using ld-linux.so, as SGX has custom code for loading enclaves in the required manner.
This embedded ld-linux.so path thus serves no functional purpose, while also making it harder to do a reproducible build of the enclaves outside of the NixOS environment.
This patch blanks out the NixOX interpretor path, by setting it to the empty string.
Related: intel/linux-sgx#1040
This is the DCAP counterpart to this SGX PR: intel/linux-sgx#1061