pseudo filesystem for current manifest?

[nmwael]

Would it make sense to make a "pseudo filesystem" for the current manifest and signature? For the signature could I just derive that from by comparing the signature of the Quote with the public key of the RSA 3072 key used to sign the manifest?

[dimakuv]

Would it make sense to make a "pseudo filesystem" for the current manifest and signature?

You mean you would like to see the manifest file (that was used to load the Gramine application) under some special pseudo-file like /dev/gramine/manifest?

And similarly, you would like to see some special pseudo-file where the signature could be extracted/derived from?

For the signature could I just derive that from by comparing the signature of the Quote with the public key of the RSA 3072 key used to sign the manifest?

Do you mean the SGX Quote? No, you can't. The SGX Quote contains the signature of the Quoting Enclave, not of the enclave-signing process.

What you want to have is a SIGSTRUCT file (.sig) -- this file contains the fields like modulus, exponent and signature. So you could extract the signature from this file.

So, I think your request is to add two new files to Gramine:

• /dev/gramine/manifest
• /dev/attestation/sigstruct

(The names can be of course different, it's open for debate.)

[nmwael]

This is exactly it.. Of course for now I can use the raw sgx manifest and and .sig for now (I guess). OR is it not possible to include sha's for them?

[dimakuv]

Of course for now I can use the raw sgx manifest and and .sig for now (I guess).

Not sure what you mean. Use where? Use how?

OR is it not possible to include sha's for them?

If you mean including these files (.manifest.sgx and .sig) in the sgx.trusted_files of the manifest, yes, unfortunately it's not possible -- because this would be a circular dependency (adding hashes of these files modifies the manifest which modifies these files which modifies the hashes of these files which modifies the manifest ad infinitum).

[nmwael]

Use them inside the enclave.. But as you wrote its not possible to establish those with trust. For now then I can create an extra certificate before the Graminizing process and include that instead.

What's the process for doing the feature request, should I just open one here in github?

[dimakuv]

I created a Feature Request: #1343