Skip to content

Commit a77a173

Browse files
lacabralacabra
authored
Merge pull request #44 from enigmampc/enclavedoc
DOC: added doc on how to setup enclave environment
2 parents ae22ca2 + 0336b85 commit a77a173

File tree

2 files changed

+200
-2
lines changed

2 files changed

+200
-2
lines changed

‎enclave/INSTALL.md‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
# Hardware
2+
3+
1. Go to your BIOS menu
4+
2. Enable SGX (Software controlled is not enough)
5+
3. Disable Secure Boot
6+
7+
# Software
8+
9+
First, make sure you have Rust installed: https://www.rust-lang.org/tools/install
10+
11+
- Once Rust is installed, install the `nightly` toolchain:
12+
13+
```bash
14+
rustup toolchain install nightly
15+
```
16+
17+
- And install `cbindgen`:
18+
19+
```bash
20+
cargo install bindgen
21+
```
22+
23+
Then you can use this script (or run the commands one-by-one), which was tested on Ubuntu 18.04 with SGX driver/sdk version 2.6:
24+
25+
```bash
26+
UBUNTUVERSION=$(lsb_release -r -s | cut -d '.' -f 1)
27+
28+
if (($UBUNTUVERSION < 16)); then
29+
echo "Your version of Ubuntu is not supported. Must have Ubuntu 16.04 and up. Aborting installation script..."
30+
exit 1
31+
elif (($UBUNTUVERSION < 18)); then
32+
DISTRO='xenial'
33+
else
34+
DISTRO='bionic'
35+
fi
36+
37+
echo "\n\n#######################################"
38+
echo "##### Installing missing packages #####"
39+
echo "#######################################\n\n"
40+
41+
# Install needed packages for script
42+
sudo apt install -y lynx parallel gdebi
43+
44+
# Create a working directory to download and install the SDK inside
45+
mkdir -p "$HOME/.sgxsdk"
46+
47+
(
48+
# In a new sub-shell cd into our working directory so to no pollute the
49+
# original shell's working directory
50+
cd "$HOME/.sgxsdk"
51+
52+
echo "\n\n################################################"
53+
echo "##### Downloading Intel SGX driver and SDK #####"
54+
echo "################################################\n\n"
55+
56+
# Download the SGX Driver and SDK:
57+
wget https://download.01.org/intel-sgx/linux-2.6/ubuntu18.04-server/sgx_linux_x64_driver_2.5.0_2605efa.bin
58+
wget https://download.01.org/intel-sgx/linux-2.6/ubuntu18.04-server/sgx_linux_x64_sdk_2.6.100.51363.bin
59+
wget https://download.01.org/intel-sgx/linux-2.6/ubuntu18.04-server/libsgx-enclave-common_2.6.100.51363-bionic1_amd64.deb
60+
wget https://download.01.org/intel-sgx/linux-2.6/ubuntu18.04-server/libsgx-enclave-common-dev_2.6.100.51363-bionic1_amd64.deb
61+
62+
# Make the driver and SDK installers executable
63+
chmod +x ./sgx_linux_*.bin
64+
65+
echo "\n\n###############################################"
66+
echo "##### Installing Intel SGX driver and SDK #####"
67+
echo "###############################################\n\n"
68+
69+
# Install the driver
70+
sudo ./sgx_linux_x64_driver_*.bin
71+
72+
# Remount /dev as exec, also at system startup
73+
sudo tee /etc/systemd/system/remount-dev-exec.service >/dev/null <<EOF
74+
[Unit]
75+
Description=Remount /dev as exec to allow AESM service to boot and load enclaves into SGX
76+
77+
[Service]
78+
Type=oneshot
79+
ExecStart=/bin/mount -o remount,exec /dev
80+
RemainAfterExit=true
81+
82+
[Install]
83+
WantedBy=multi-user.target
84+
EOF
85+
sudo systemctl enable remount-dev-exec
86+
sudo systemctl start remount-dev-exec
87+
88+
# Install the SDK inside ./sgxsdk/ which is inside $HOME/.sgxsdk
89+
echo yes | ./sgx_linux_x64_sdk_*.bin
90+
91+
# Setup the environment variables for every new shell
92+
echo "source '$HOME/.sgxsdk/sgxsdk/environment'" |
93+
tee -a "$HOME/.bashrc" "$HOME/.zshrc" > /dev/null
94+
)
95+
96+
echo "\n\n##############################################"
97+
echo "##### Installing additional dependencies #####"
98+
echo "##############################################\n\n"
99+
100+
# Add Intels's SGX PPA
101+
echo "deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu $DISTRO main" |
102+
sudo tee /etc/apt/sources.list.d/intel-sgx.list
103+
wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key |
104+
sudo apt-key add -
105+
sudo apt update
106+
107+
# Install all the additional necessary dependencies (besides the driver and the SDK)
108+
# for building a rust enclave
109+
wget -O /tmp/libprotobuf10_3.0.0-9_amd64.deb http://ftp.br.debian.org/debian/pool/main/p/protobuf/libprotobuf10_3.0.0-9_amd64.deb
110+
(sleep 3 ; echo y) | sudo gdebi /tmp/libprotobuf10_3.0.0-9_amd64.deb
111+
112+
dpkg -i libsgx-enclave-common_2.6.100.51363-bionic1_amd64.deb
113+
dpkg -i libsgx-enclave-common-dev_2.6.100.51363-bionic1_amd64.deb
114+
115+
sudo apt install -y libsgx-urts libsgx-uae-service libsgx-launch libsgx-ae-le autoconf libtool
116+
```
117+
118+
Note that sometimes after a system reboot you'll need to reinstall the driver (usually after a kernel upgrade):
119+
120+
```bash
121+
sudo $HOME/.sgxsdk/sgx_linux_x64_driver_*.bin
122+
```
123+
124+
# Testing your SGX setup
125+
126+
1. For node runners, by using `sgx-detect`:
127+
128+
```bash
129+
sudo apt install -y libssl-dev protobuf-compiler
130+
cargo +nightly install fortanix-sgx-tools sgxs-tools
131+
132+
sgx-detect
133+
```
134+
135+
Should print at the end:
136+
137+
```
138+
✔ Able to launch enclaves
139+
✔ Debug mode
140+
✔ Production mode (Intel whitelisted)
141+
142+
You're all set to start running SGX programs!
143+
```
144+
145+
2. Clone the Rust SGX SDK repo:
146+
147+
```bash
148+
# clone the rust-sgx-sdk baidu sdk
149+
RUN git clone --depth 1 -b v1.0.9 https://github.com/apache/incubator-teaclave-sgx-sdk sgx
150+
151+
```
152+
153+
*Note: This setup assumes that you run the above command in your $HOME folder, and thus you have the above repo cloned at $HOME/sgx. If you clone it anywhere else, update Line 26 of the [Makefile](enclave/safetrace/Makefile) accordingly:*
154+
155+
```bash
156+
SGX_SDK_RUST ?= $(HOME)/sgx
157+
```
158+
159+
# Uninstall
160+
161+
To uninstall the Intel(R) SGX Driver, run:
162+
163+
```bash
164+
sudo /opt/intel/sgxdriver/uninstall.sh
165+
```
166+
167+
The above command produces no output when it succeeds. If you want to verify that the driver has been uninstalled, you can run the following, which should print `SGX Driver NOT installed`:
168+
169+
```bash
170+
ls /dev/isgx &>/dev/null && echo "SGX Driver installed" || echo "SGX Driver NOT installed"
171+
```
172+
173+
To uninstall the SGX SDK, run:
174+
175+
```bash
176+
sudo "$HOME"/.sgxsdk/sgxsdk/uninstall.sh
177+
rm -rf "$HOME/.sgxsdk"
178+
```
179+
180+
To uninstall the rest of the dependencies, run:
181+
182+
```bash
183+
sudo apt purge -y libsgx-enclave-common libsgx-enclave-common-dev libsgx-urts sgx-aesm-service libsgx-uae-service libsgx-launch libsgx-aesm-launch-plugin libsgx-ae-le
184+
```
185+
186+
# References
187+
188+
This file was forked from the **enigmampc/EnigmaBlockchain** repo: [/docs/dev/setup-sgx.md](https://github.com/enigmampc/EnigmaBlockchain/blob/master/docs/dev/setup-sgx.md). The two notable differences are as follows:
189+
190+
1. This repo depends on apache/incubator-teaclave-sgx-sdk version `1.0.9`, whereas enigmampc/EnigmaBlockchain depends on version `1.1.1`.
191+
2. In turn incubator-teaclave-sgx-sdk depends on SGX driver and SDK version `2.6`, whereas enigmampc/EnigmaBlockchain depends on version `2.9`.
192+
193+
## Additional References##
194+
195+
1. https://github.com/apache/incubator-teaclave-sgx-sdk/wiki/Environment-Setup
196+
2. https://github.com/openenclave/openenclave/blob/master/docs/GettingStartedDocs/install_oe_sdk-Ubuntu_18.04.md
197+
3. https://github.com/apache/incubator-teaclave-sgx-sdk/blob/783f04c002e243d1022c5af8a982f9c2a7138f32/dockerfile/Dockerfile.1804.nightly
198+
4. https://edp.fortanix.com/docs/installation/guide/

‎enclave/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,13 @@ This folder contains the code that runs inside the enclave using Intel Secure Gu
2424
git clone git@github.com:enigmampc/covid-self-reporting.git
2525
```
2626

27-
2. Install the SGX driver and SDK, as per these [instructions](https://github.com/enigmampc/EnigmaBlockchain/blob/master/docs/dev/setup-sgx.md).
27+
2. Install the SGX driver and SDK, as per the [INSTALL](INSTALL.md) instructions.
2828

2929

3030
3. Move into the `enclave/safetrace` subfolder:
3131

3232
```bash
33-
cd enclave/safetrac
33+
cd enclave/safetrace
3434
```
3535

3636
4. Compile the code:

0 commit comments

Comments
 (0)