According to the spec [1], the scriptlet %post of a new package executes
before %preun of the old package.
This will cause the startup.sh of the new package to be executed first,
and then the cleanup.sh of the old package to be executed when
sgx-aesm-service is upgraded, and the user aesmd will be deleted,
which leading aesmd booting error.
Replace %post with %posttrans to make sure the prerequisites for service
aesmd are met.
[1]. https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/
Signed-off-by: yuguorui <yuguorui@pku.edu.cn>
Along with the latest processor microcode and re-signed all the Intel(R) SGX
Architecture Enclaves (AEs) to address CVE-2022-21123, CVE-2022-21125 and
CVE-2022-21166.
Upgraded to Protobuf 3.20.
Upgraded to SgxSSL/OpenSSL 1.1.1o.
Added Intel TDX Attestation support.
Added Rust support for ECDSA quote verification.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 1.1.1m.
Provided RA-TLS (Remote Attestation based Transport Layer Security) APIs and
Samples.
Supported PKRU (Protection Key rights Register) in Enclave.
Added APIs of SHA384 and VerifyReport2 to support TDX.
Enhanced QPL (Quote Provider Library) to support caching Intel PCK
(Provisioning Certificate Key) certificate chain in local memory, or
retrieving Intel PCK cert chain from local HTTP/S address.
Upgraded Intel ECDSA Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1m.
Introduced Intel ID enclave for QE identity generation.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Updated README
Also revert aesm docker to run as root inside
This was to ensure access to /dev/sgx_provision
Signed-off-by: Haitao Huang <4699115+haitaohuang@users.noreply.github.com>
This commit ensures that no matter what the order of package installation is,
aesmd can have access to the sgx_provision device file.
Signed-off-by: yuguorui <yuguorui@pku.edu.cn>
Supported loading enclave at address 0.
Upgraded Intel(R) Quote Verification Enclave to integrate SgxSSL/OpenSSL version 1.1.1k.
Updated the DCAP driver V1.33 with stability fixes, released as V1.33.2. This is to support
legacy solutions not ready to transition to the latest DCAP driver V1.41 or kernel 5.11+.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Groups/permissions in container do not always match with host env.
Run aesm with root to ensure access to /dev/sgx_provision
Signed-off-by: Haitao Huang <4699115+haitaohuang@users.noreply.github.com>
Added more logs in PSW components for identifying issues.
Upgraded OpenSSL and SgxSSL to latest version 1.1.1i in DCAP components.
Added data base migration support in PCCS.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added Ubuntu 20.04 and CentOS 8.2 support.
Added Intel(R) Provisioning Certification Service V3 API support for ECDSA attestation.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Provided a reproducible SDK.
Supported new OS: RHEL 8.1, CentOS 8.1 and Fedora 31.
Supported user to specify platform id in PCK Cert ID Retrieval Tool’s command line option.
Added ability to execute Platform Cert ID Retrieval Tool on multi-package platforms without
loading enclaves. PCCS now supports this functionality. The platform still needs to support
SGX.
Updated Platform Cert ID Retrieval Tool and Multi-package registration tool to align with BIOS
platform manifest changes.
Added .deb and .rpm installers for Platform Cert ID Retrieval Tool and Multi-package
Registration Agent.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Simulation libraries are provided through the SDK installation into
the sdk_libs directory and the environment file adds that directory to
LD_LIBRARY_PATH. Starting in version 2.8 new simulation libraries were
introduced but not added to this path.
This commit adds libsgx_quote_ex_sim.so, libsgx_epid_sim.so, and
libsgx_launch_sim.so to the expected directory.
Without this change applications following the conventions of the sample
Makefiles may build but fail to execute.
Signed-off-by: Dan Middleton <dan.middleton@intel.com>
Changes:
Added a command option “-resign” for Signing Tool.
Split the header file of Un-trusted Architecture Services.
Supported Red Hat* Enterprise Linux* Server 8.0 (for x86_64). And we do not support
Red Hat* Enterprise Linux* Server 7.6 (for x86_64) from this release
Added support for new version Intel(R) Provisioning Certification Server interfaces.
Added new libraries libsgx_epid.so, libsgx_launch.so, libsgx_platform.so and libsgx_quote_ex.so
Fixed bugs.
Signed-off-by: Zhang Lili Z <lili.z.zhang@intel.com>
Added support for Reproducible Enclave Build using Docker file.
Added support for Intel AVX-512 instructions and Intel SHA Extensions New Instructions (SHA-NI) in trusted libraries.
Support both EPID and ECDSA based quote for quoting related interfaces in sgx_uae_service library.
Updated key exchange library to support both EPID and ECDSA based remote attestation.
Support new interface to check platform information blob from remote attestation response message.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added new APIs in sgx_uae_service.h and sgx_ukey_exchange.h to support ECDSA quote based remote attestation.
The set of legacy APIs supports EPID only and the set of new APIs supports ECDSA quotes.
Enhanced Edger8r with structure deep-copy feature.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added support for the Key Separation and Sharing (KSS) feature.
Provided a set of new encryption and decryption functions such as sgx_hmac256_*.
Provided a new untrusted API: sgx_get_target_info.
Provided a new untrusted API: sgx_create_enclave_from_buffer_ex.
Updated the cryptography library and Architecture Enclaves to use Intel(R) Integrated
Performance Primitives Cryptography 2019 Update 1.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Support for Ubuntu 18.04 LTS 64-bit Desktop and Server version
Provided a new set of SGX common loader APIs in sgx_enclave_common.h
Provided the sample code for Switchless Call
Provided a new API in tcrypto: sgx_ecc256_calculate_pub_from_priv
sgx_create_enclave API will ignore the parameter of launch token and will not update it after function successfully returns
Change Intel SGX PSW installer for Ubuntu by
- Using .deb installer.
- Using name libsgx-enclave-common_{version string}-1_amd64.deb.
- Installing Intel SGX Enclave Common loader library.
Bug fixes
Signed-off-by: Li, Xun <xun.li@intel.com>
* Adds libsgx_capable, which is currently only available in the Windows
version of the Intel SGX SDK. The Linux implementation of this library
adds the following functions:
sgx_status_t sgx_is_capable (int *sgx_capable);
sgx_status_t sgx_cap_get_status (sgx_device_status_t *sgx_device_status);
sgx_status_t sgx_cap_enable_device (sgx_device_status_t *sgx_device_status);
And adds the following error code (also from the Windows version of the
Intel SGX SDK):
SGX_ERROR_NO_PRIVILEGE
Generates both a static and dynamic build of libsgx_capable. This is
incorporated into the SDK package, not the PSW package, since software
installers need to check for Intel SGX capability on systems where the PSW
may not already be installed. This means that installers will either have
to statically link, or distribute the .so with their installation package.
----------------------
Developer Certificate of Origin
Version 1.1
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
660 York Street, Suite 102,
San Francisco, CA 94110 USA
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
Developer's Certificate of Origin 1.1
By making a contribution to this project, I certify that:
(a) The contribution was created in whole or in part by me and I
have the right to submit it under the open source license
indicated in the file; or
(b) The contribution is based upon previous work that, to the best
of my knowledge, is covered under an appropriate open source
license and I have the right under that license to submit that
work with modifications, whether created in whole or in part
by me, under the same open source license (unless I am
permitted to submit under a different license), as indicated
in the file; or
(c) The contribution was provided directly to me by some other
person who certified (a), (b) or (c) and I have not modified
it.
(d) I understand and agree that this project and the contribution
are public and that a record of the contribution (including all
personal information I submit with it, including my sign-off) is
maintained indefinitely and may be redistributed consistent with
this project or the open source license(s) involved.
Signed-off-by: John P Mechalas <john.p.mechalas@intel.com>
Exposing sockets to Docker containers is typically done via bind
mounts, which does not work for abstract sockets since they don't
exist in the file system.
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Zhang Lili