Skip to content

Latest commit

 

History

History
149 lines (124 loc) · 5.08 KB

README.md

File metadata and controls

149 lines (124 loc) · 5.08 KB
Raw

Edgeless RT

Edgeless RT is an SDK for Trusted Execution Environments (TEE) built on top of Open Enclave. It aims to provide support for modern programming languages and to facilitate the porting of existing applications. Currently, hardware-wise, Edgeless RT focuses on Intel SGX. Support for other TEEs will follow as it becomes available in Open Enclave.

Key features of Edgeless RT are:

  • Support for Go
  • Extended C/C++ support
    • More libc and POSIX functions
    • More C++17 STL
    • pthread and std::thread
    • libstdc++ for better compatibility with existing code
  • Experimental support for Rust
  • Soon: seamless integration with Edgeless Mesh to create distributed confidential applications
  • Soon: support for Python

Quick Start

If you are on Ubuntu 18.04 and do not want to build the SDK yourself, you can install the binary release:

wget -qO- https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add
sudo add-apt-repository 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bionic main'
wget https://github.com/edgelesssys/edgelessrt/releases/download/v0.1.1/edgelessrt_0.1.1_amd64.deb
sudo apt install ./edgelessrt_0.1.1_amd64.deb

Then proceed with Use.

Build

Edgeless RT primarily targets Ubuntu 18.04. Other Linuxes may work as well. Windows is not yet supported.

  1. Determine the SGX support of your system

    cc -ooesgx tools/oesgx/oesgx.c && ./oesgx

    You will get one of the following three types of output:

    oesgx output SGX support level
    CPU supports SGX_FLC:Flexible Launch Control
    CPU supports Software Guard Extensions:SGX1    		 SGX1+FLC
    CPU supports Software Guard Extensions:SGX1 SGX1
    CPU does not support SGX Simulation

  2. Set up the environment

    Ansible is required to install the project requirements. Install it by running:

    sudo scripts/ansible/install-ansible.sh

    Run one of the following commands depending on the SGX support level:

    • SGX1+FLC in an Azure Confidential Compute (ACC) VM:

      ansible-playbook scripts/ansible/oe-contributors-acc-setup.yml

    • SGX1+FLC:

      ansible-playbook scripts/ansible/oe-contributors-setup.yml

    • SGX1:

      ansible-playbook scripts/ansible/oe-contributors-setup-sgx1.yml

    • Simulation:

      ansible-playbook scripts/ansible/oe-contributors-setup-sim.yml

    NOTE: The Ansible playbook commands require sudo rights. You may need to specify --ask-become-pass and enter your sudo password.

  3. Build the SDK

    mkdir build
cd build
cmake -GNinja ..
ninja

    To set a custom installation path (default: /opt/edgelessrt), add, e.g., -DCMAKE_INSTALL_PREFIX=~/edgelessrt-install.

Test

After building, run the following command in the build directory to confirm everything works as expected:

ctest

In simulation mode run this command instead:

OE_SIMULATION=1 ctest

Install

From the build directory run:

ninja install

Or if you do not have write permissions for the installation path:

sudo ninja install

Use

To use the SDK you need to source the openenclaverc file to setup environment variables:

. /opt/edgelessrt/share/openenclave/openenclaverc

Now you are ready to build applications with Edgeless RT! To start, check out the samples in the samples_edgeless folder.

Also see the C API documentation and/or the Go API documentation.

Debug

debugging with vscode

You can use Open Enclave's oegdb to debug enclave code built with Edgeless RT. oegdb is automatically installed with Edgeless RT. It also supports Go enclaves.

oegdb works great with Visual Studio Code (vscode). For example, use the following configuration to debug the in-enclave Go code from our HashiCorp Vault sample in vscode:

{
  "version": "0.2.0",
  "configurations": [
    {
      "name": "(oegdb) Launch",
      "miDebuggerPath": "/opt/edgelessrt/bin/oegdb",
      "type": "cppdbg",
      "request": "launch",
      "program": "/opt/edgelessrt/bin/erthost",
      "args": ["enclave.signed","server","-dev"],
      "stopAtEntry": false,
      "cwd": "${workspaceFolder}/samples_edgeless/vault/build/",
      "environment": [],
      "externalConsole": false,
      "MIMode": "gdb",
      "setupCommands": [
          {
              "description": "Enable pretty-printing for gdb",
              "text": "-enable-pretty-printing",
              "ignoreFailures": true
          },
          {
              "text": "handle SIGILL nostop"
          }
      ]
    }
  ]
}