Can't connect to Unix socket from inside enclave about graphene HOT 6 CLOSED

The issue seems to be that the socket is not accessible from within the enclave, even though I included sgx.allowed_files.socket = file:socket in the manifest. If I create the socket in the enclave before connecting to it, it works without problems.

from graphene.

Hi, sorry for the late response.

The design of Graphene library OS makes it impossible to connect an application with UNIX socket created on the host. A Graphene instance acts like a guest OS, so no OS states are shared between Graphene and the host OS except external resources like files and sockets. If you need to connect the guest with the host, I suggest you use a loopback socket (bound on localhost).

Hope this helps!

from graphene.

The design of Graphene library OS makes it impossible to connect an application with UNIX socket created on the host. A Graphene instance acts like a guest OS, so no OS states are shared between Graphene and the host OS except external resources like files and sockets.

I don't see how Unix domain sockets are different in this aspect from files and sockets. I think you could share them with the host OS the same way like other files and sockets.
I'm currently using a "normal" socket as a workaround, so this doesn't have high priority for me, but maybe I will look into this at some point and prepare a patch.

from graphene.

Graphene is supposed to share OS states as little as possible with the host OS. Sharing one more abstraction means adding more routes for the untrusted OS to attack the applications in enclaves. For Linux applications, UNIX sockets are more treated as the in-kernel abstraction than an external resource like files or sockets. You can think of a guest OS as a container, which usually doesn't allow or recommend you to share UNIX sockets with the host OS.

from graphene.

I don't want to pull a lot of code into Graphene proper to special-case Unix sockets. But I think it would be acceptable on a Linux host to make a Unix socket look like an outward-facing pipe from Graphene's perspective. I would prefer to keep any changes in the manifest and PAL code (with some reasonable error handling for non-Unix systems).

from graphene.

@adombeck - would be happy to review a more concrete proposal (before you spend too much time coding something), or a pull request (obviously).

from graphene.