• Dave Hansen's avatar
    selftests/sgx: Improve error detection and messages · 4284f7ac
    Dave Hansen authored
    The SGX device file (/dev/sgx_enclave) is unusual in that it requires
    execute permissions.  It has to be both "chmod +x" *and* be on a
    filesystem without 'noexec'.
    
    In the future, udev and systemd should get updates to set up systems
    automatically.  But, for now, nobody's systems do this automatically,
    and everybody gets error messages like this when running ./test_sgx:
    
    	0x0000000000000000 0x0000000000002000 0x03
    	0x0000000000002000 0x0000000000001000 0x05
    	0x0000000000003000 0x0000000000003000 0x03
    	mmap() failed, errno=1.
    
    That isn't very user friendly, even for forgetful kernel developers.
    
    Further, the test case is rather haphazard about its use of fprintf()
    versus perror().
    
    Improve the error messages.  Use perror() where possible.  Lastly,
    do some sanity checks on opening and mmap()ing the device file so
    that we can get a decent error message out to the user.
    
    Now, if your user doesn't have permission, you'll get the following:
    
    	$ ls -l /dev/sgx_enclave
    	crw------- 1 root root 10, 126 Mar 18 11:29 /dev/sgx_enclave
    	$ ./test_sgx
    	Unable to open /dev/sgx_enclave: Permission denied
    
    If you then 'chown dave:dave /dev/sgx_enclave' (or whatever), but
    you leave execute permissions off, you'll get:
    
    	$ ls -l /dev/sgx_enclave
    	crw------- 1 dave dave 10, 126 Mar 18 11:29 /dev/sgx_enclave
    	$ ./test_sgx
    	no execute permissions on device file
    
    If you fix that with "chmod ug+x /dev/sgx" but you leave /dev as
    noexec, you'll get this:
    
    	$ mount | grep "/dev .*noexec"
    	udev on /dev type devtmpfs (rw,nosuid,noexec,...)
    	$ ./test_sgx
    	ERROR: mmap for exec: Operation not permitted
    	mmap() succeeded for PROT_READ, but failed for PROT_EXEC
    	check that user has execute permissions on /dev/sgx_enclave and
    	that /dev does not have noexec set: 'mount | grep "/dev .*noexec"'
    
    That can be fixed with:
    
    	mount -o remount,noexec /devESC
    
    Hopefully, the combination of better error messages and the search
    engines indexing this message will help people fix their systems
    until we do this properly.
    
     [ bp: Improve error messages more. ]
    Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
    Link: https://lore.kernel.org/r/20210318194301.11D9A984@viggo.jf.intel.com
    4284f7ac
load.c 6.58 KB