Use security enclaves

[ivanpauno]

Feature request

Feature description

Tracking issue for changes started in https://github.com/ros2/sros2/pull/177. Design document: https://github.com/ros2/design/pull/274

Implementation considerations

• [x] Update policy schema with contexts (https://github.com/ros2/sros2/pull/177)
• [x] Update policy transforms for DDS (https://github.com/ros2/sros2/pull/177)
• [x] Update keystore layout with pubic, private, contexts sub folders (https://github.com/ros2/sros2/pull/177)
• [x] Update existing tests and downstream packages (https://github.com/ros2/sros2/pull/177)

---

• [x] security-context -> enclave
  • [x] https://github.com/ros2/rcl/pull/612
  • [x] https://github.com/ros2/rmw/pull/211
  • [x] https://github.com/ros2/rmw_connext/pull/407
  • [x] https://github.com/ros2/rmw_cyclonedds/pull/146
  • [x] https://github.com/ros2/rmw_dds_common/pull/13
  • [x] https://github.com/ros2/rmw_implementation/pull/91
  • [x] https://github.com/ros2/rmw_fastrtps/pull/365
  • [x] https://github.com/ros2/sros2/pull/198
  • [x] https://github.com/ros2/system_tests/pull/414

---

• [x] Update policy auto generation (https://github.com/ros2/sros2/pull/203).
• [ ] Make use of context name validation, instead of using namespace validation for it. Requires https://github.com/ros2/rclpy/issues/528.
• [x] Update documentation (#201)
• [ ] Support for metadata and type attribute
  • e.g. associating profiles to domains, validity times, singing CA
  • may need more thought, could look back at keymint for config patterns
• [x] Fix security directory lookup for '/' security contexts https://github.com/ros2/rcl/pull/609
• [x] Add security context introspection https://github.com/ros2/rclpy/pull/538

[ruffsl]

I've add the draft PR started by @mikaelarguedas , as well as https://github.com/ros2/rcl/pull/609 and https://github.com/ros2/rclpy/pull/538 . Given some are in flight, we'll want to make sure to refactor enclave changes depending on which merge.

[mikaelarguedas]

@ivanpauno Is it still on your radar to update and reenable policy generation ? Update policy auto generation. Disabled in #177. Would require ros2/rclpy#529 to be re-enabled.

[ivanpauno]

@ivanpauno Is it still on your radar to update and reenable policy generation ? Update policy auto generation. Disabled in #177. Would require ros2/rclpy#529 to be re-enabled.

No sorry, I won't have the time to do it in a near future. The needed function in rclpy was added https://github.com/ros2/rclpy/pull/538.