Skip to content

Releases: gramineproject/gramine

v1.1

03 Feb 23:18
@dimakuv dimakuv
v1.1
3623e63
Compare
Choose a tag to compare
v1.1

Important changes

This change log covers the changes since the last release.

New features

  • Support for musl C standard library (v1.2.2).
  • Support of the sysinfo() system call.
  • Support of the mlock() family of system calls.
  • Support of the /proc/meminfo and /proc/stat pseudo-files.
  • Support of Intel Advanced Matrix Extensions (AMX).

Security improvements

  • Better CPU and NUMA topology sanitization (hidden under the fs.experimental__enable_sysfs_topology manifest option until we finish securing this interface).
  • Three new manifest options to specify different masks for SGX sealing key derivation:
    • sgx.seal_key.flags_mask for KEYREQUEST.ATTRIBUTESMASK.FLAGS,
    • sgx.seal_key.xfrm_mask for KEYREQUEST.ATTRIBUTESMASK.XFRM,
    • sgx.seal_key.misc_mask for KEYREQUEST.MISCMASK.

Performance improvements

  • For gramine-direct: internal locks no longer issue a futex syscall in the uncontested case.
  • For gramine-sgx: faster SGX enclave initialization time due to the removal of the static 64MB memory pool.
  • For both: faster emulation of sendfile() system call.

GSC improvements

  • Support for Ubuntu 21.04 and CentOS 8.
  • GSC skips generating trusted files if sgx.file_check_policy = "allow_all_but_log" is specified in user manifest (only for testing; not for production).
  • GSC uses a proper TOML parser instead of ad-hoc string-based parsing.

New sample integrations

  • Simple HelloWorld example (for quick testing).

Bugfixes, stability and refactoring

  • Rewritten the epoll mechanism.
  • Rewritten ELF parsing and RTLD code in PAL.
  • Rewritten LibOS events mechanism (new version uses normal PAL pipes).
  • More features of AddressSanitizer are enabled (stack/globals sanitization is enabled, better integration with SGX).

Miscellaneous

  • Gramine now skips inaccessible files in manifest trusted files expansion.
  • Gramine now allows non-existing (but never accessed) files in the sgx.trusted_files list.
  • Gramine tests are built using Meson and run using Pytest.
  • gramine-direct runs under a special seccomp policy to support inline syscalls.
  • loader.preload manifest option was renamed to loader.entrypoint. The old name is deprecated, but still supported.

Installation instructions

Starting from release v1.0, Gramine is available as .deb and .rpm packages.

If you are updating from v1.0, one of the following commands is enough to update to v1.1:

  • apt update && apt upgrade for Debian/Ubuntu
  • dnf update for RHEL/Fedora/CentOS

If you are not updating, then to install Gramine v1.1, follow the below commands:

  • for Debian/Ubuntu
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ stable main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver
  • for RHEL/Fedora/CentOS:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine     # for 5.11+ upstream, in-kernel driver

The same instructions can be found in our documentation's Quick Start.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Assets 6
Loading

v1.0

08 Oct 18:12
@mkow mkow
v1.0
175b186
Compare
Choose a tag to compare
v1.0

Important changes

This text covers the changes since the last public release candidate. This version is intended to be ready for production use.

New name and new home

  • As you probably have already noticed, Graphene was renamed to Gramine. The name "Graphene" was deemed too common, could be impossible to trademark, and collided with several other software projects. Thus, a new name "Gramine" was chosen.
  • We migrated our repositories to https://github.com/gramineproject.
  • We also joined Confidential Computing Consortium (part of Linux Foundation).
  • GSC and some of the examples were moved to separate repositories: gramineproject/gsc and gramineproject/examples.
  • We reset the version numbering with the rename.

New features

  • Improved filesystem support - we introduced inodes, which allowed more accurate emulation of filesystem.
  • Insecure options summary - now when you start Gramine, if we detect a known insecure configuration, we print a warning listing the problems.
  • Support for selective passthrough of environment variables (via loader.env.[ENVIRON] = {passthrough=true}).
  • Python API for our tooling (manifest generation, signing, etc.).
  • Support for SGX sealing in protected files - now you can encrypt to MRSIGNER or MRENCLAVE instead of provisioning an external key.
  • loader.uid and loader.gid manifest options to change the default user/group id emulated inside Gramine.

Security improvements

  • All IDs are now virtualized inside Gramine.
  • Reviewed OCALLs and added some missing sanitizations.
  • We implemented custom UndefinedBehaviorSanitizer and AddressSanitizer integrations and run them in our CI.
  • Fixed a few security bugs around attestation and key exchange.
  • Fixed multiple memory corruption bugs.

New sample integrations

  • OpenJDK
  • SQLite

Stability and refactoring

  • A lot of fixed in various syscalls corner cases.
  • Rewritten most of filesystem code.

Miscellaneous

  • Better support for RHEL, CentOS and Fedora.
  • Added Clang support.
  • Updated Glibc patches to 2.34.
  • Now the whole Gramine (except tests) is built using Meson.

Breaking changes

  • We made our manifest syntax more TOML-ish - now allowed, trusted and protected files are listed as arrays. The old syntax is deprecated, but still supported.
  • The default enclave mode is now release. If you want a debug enclave, add sgx.debug = true to your manifest.
  • Build instructions have changed because of migration to Meson. The documentation was updated to reflect this.
  • Topology information in sysfs was deemed not ready for production yet (due to security concerns) and was hidden behind a feature flag in manifests - fs.experimental__enable_sysfs_topology = [true|false]. We plan to polish the implementation and make it production-quality in upcoming weeks.
  • sgx.protected_files_key manifest option was renamed to sgx.insecure__protected_files_key.

Installation instructions

Starting from this release Gramine is available as .deb and .rpm packages. To install them, follow the below commands:

  • for Debian/Ubuntu
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ stable main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver
  • for RHEL/Fedora/CentOS:
# first time you need to confirm the key fingerprint, which is F3FFBE5FC0477DB46E4851E737B04F03659B87AF.
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine     # for 5.11+ upstream, in-kernel driver

The same instructions can be found in our documentation's Quick Start.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Assets 5
Loading