python.manifest.template

# Python3 manifest example

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "{{ entrypoint }}"

loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "{{ python.stdlib }}/lib:/lib:{{ arch_libdir }}:/usr/lib:/usr/{{ arch_libdir }}"
loader.env.LD_PRELOAD = "libsecret_prov_attest.so"
loader.env.SECRET_PROVISION_CONSTRUCTOR = "1"
loader.env.SECRET_PROVISION_SET_PF_KEY = "1"
loader.env.SECRET_PROVISION_CA_CHAIN_PATH = "server/certs/cert.pem"
loader.env.SECRET_PROVISION_SERVERS = "localhost:4433"

loader.insecure__use_cmdline_argv = true

sys.enable_sigterm_injection = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  { path = "/usr", uri = "file:/usr" },
  { path = "{{ python.stdlib }}", uri = "file:{{ python.stdlib }}" },
  { path = "{{ python.distlib }}", uri = "file:{{ python.distlib }}" },
  { path = "/etc", uri = "file:/etc" },
  { type = "tmpfs", path = "/tmp" },
]

sgx.remote_attestation = true

sgx.debug = true
sgx.nonpie_binary = true
sgx.enclave_size = "512M"
sys.stack.size = "2M"
sgx.thread_num = 32

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ entrypoint }}",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:/usr/{{ arch_libdir }}/",
  "file:{{ python.stdlib }}/",
  "file:{{ python.distlib }}/",
  "file:scripts/",
  "file:/etc/mime.types",
  "file:server/certs/cert.pem",
  "file:scripts/crypted.py",
]

sgx.protected_files=["file:scripts/crypted.py",]

sgx.allowed_files = [
  "file:/etc/nsswitch.conf",
  "file:/etc/ethers",
  "file:/etc/hosts",
  "file:/etc/group",
  "file:/etc/passwd",
  "file:/etc/gai.conf",
  "file:/etc/host.conf",
  "file:/etc/resolv.conf",
]