...
ioctl(4, SGX_IOC_ENCLAVE_ADD_PAGES, 0x7ffd38e7bf90) = 0
mmap(0x7f36d9002000, 139264, PROT_READ|PROT_EXEC, MAP_SHARED|MAP_FIXED, 4, 0) = -1 EPERM (Operation not permitted)
close(4)
I've only tested this using CRI-O where containers with SGX enclaves cannot be launched with CRI-O v1.25+. This is the release where CRI-O pulled in #725 from runtime-tools.
#725 added
noexecto default/devmount options but this triggers problems when containers try to create Intel SGX enclaves:The issue where a dev node is
mmap()'dwithPROT_EXEChas been discussed in length on LKML and in systemd github:systemd now allows this to be configured using
ExecPaths=andNoExecPaths=butnoexecis not added by default.I've only tested this using CRI-O where containers with SGX enclaves cannot be launched with CRI-O v1.25+. This is the release where CRI-O pulled in #725 from
runtime-tools./cc @rhatdan @mrunalp @haircommander