Permission Denied Error with Encrypted Files #1888
-
|
In Gramine, I'm trying to pass data via file under the folder specified as Encrypted Files. In the manifest, the entire encrypted_files folder is designated as Encrypted Files as follows: The executable binary (written in C++), which is the Gramine entry point, writes to C++: std::ofstream ofs("/encrypted_files/python-file.dat");
ofs << secret;.
if(ofs.fail())
{
std::cerr << "Error writing to file" << std::endl;
}python: with open(path) as f:.
nums = f.read()However, both the C++ write side and the Python read side produce errors: on the C++ side, The file generation itself succeeds, so I don't think the path is set incorrectly, but is there any known solution? |
Beta Was this translation helpful? Give feedback.
Answered by
kailun-qin
May 21, 2024
Replies: 4 comments 1 reply
-
|
Could you provide more logs around the failure point? See https://gramine.readthedocs.io/en/latest/manifest-syntax.html#log-level. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
May I know the Gramine version that you were working on? (there was a similar issue: 032e35e, but fixed long ago) |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Thank you for your comments. Gramine itself was Clone relatively recently, so the commit ID was 0ee48ee, which is not that old. The logs around the failed part are shown below. Please point out if we should have logged in more detail.
|
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Thanks for the information and logs!
Looks like no encryption key is specified in your manifest? For a secure version, you'll need to either use a SGX sealing key or to provision one via SGX attestation. Pls see https://gramine.readthedocs.io/en/latest/manifest-syntax.html#encrypted-files and https://gramine.readthedocs.io/en/latest/attestation.html for details. |
Beta Was this translation helpful? Give feedback.
Answer selected by
hello31337
-
|
I mistakenly thought that setting key_name to "default" would automatically generate a key for each encrypted file. My apologies. I tried specifying the sealing key for the MRSIGNER policy, and was able to pass the key via encrypted file without any problems. Thank you for your kind advice. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Thanks for the information and logs!
Looks like no encryption key is specified in your manifest? For a secure version, you'll need to either use a SGX sealing key or to provision one via SGX attestation. Pls see https://gramine.readthedocs.io/en/latest/manifest-syntax.html#encrypted-files and https://gramine.readthedocs.io/en/latest/attestation.html for details.