Open paulcallen opened 3 years ago
An initial check-in is complete with the set/get ID syscalls, and the enabling of most of the relevant to those APIs. a few require fork which we dont have yet. Future work is to plumb IDs through to the lower layers of filesystems to do access checks, same for sockets, and implement access checks within other syscalls that are required.
Please update the status. @paulcallen
no (or very few) changes since initial check-in
Types if IDs: Read, effective, saved, fs, associated groups as well as supplemental groups Config to set starting IDs permission checks ID mapping between enclave and host for SGX There are also capabilities that govern what can and cannot be done too that are specific to these syscalls.
Need many more propagations for file access permissions across all filesystems Need propagations and access checks for sockets