Skip to content

Releases: gramineproject/gramine

v1.8

21 Oct 16:52
@woju woju
v1.8
This tag was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
8fc123d
This commit was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.8 Latest
Latest

Important changes

This change log covers the changes since the last release.

Breaking changes

  • The gramine-manifest tool's built-in check against the manifest schema is now enabled in hard-error mode by default and might fail on previously-working but non-conformant manifests. Use --no-check to suppress.
  • Attestation-related environment variables (RA_TLS_*, e.g., RA_TLS_MRSIGNER) passed to RA-TLS must now be explicitly set. Note that the special value any can be specified to skip verifying a particular measurement if not used.
  • The previously-deprecated manifest option sgx.require_[...] = true|false was removed -- use sgx.cpu_features.[...] = "[unspecified|disabled|required]" instead.

Security fixes

New features

  • loader.entrypoint is now optional and only needed if one wanted to replace Gramine's LibOS with their own implementation.
  • gramine-direct should now be able to run under Windows Subsystem for Linux, although this isn't an officially supported feature.
  • New system calls implemented:
    • close_range.
    • {,l,f}getxattr and {,l,f}listxattr.
  • New manifest options added:
    • sys.debug__mock_syscalls = [ ... ], which allows mocking selected syscalls.
    • sys.fds.limit, which sets the Linux's RLIMIT_NOFILE resource limit, i.e., maximum number of open file descriptors.
  • /dev/fd/ directory is now properly emulated.
  • Added shared_cpu_list file to sysfs cache info.
  • Sending SIGUSR1 signal to Gramine built in debug configuration now resets the perf profiling and SGX statistics. This allows to gather more precise stats on long-running applications.
  • Modified RA-TLS to adhere to Interoperable RA-TLS standard.

Performance improvements

  • Added support for lazy memory allocation when using EDMM and mmap with MAP_NORESERVE. This significantly improves EDMM performance of e.g. Java workloads.

Bugfixes, stability and refactoring

  • Fixed communication with AESM daemon, which sometimes caused it to return error 42 when using DCAP attestation.
  • Added stat() and hstat() callbacks to FIFOs, the lack of these caused some apps to misbehave.
  • Fixed ENOENT error in fchown syscall on unlinked file.
  • Correctly emulate in/out instructions (as SIGSEGV, not SIGILL as it was before).
  • Fixed up locking around read/write on encrypted pipes, which got accidentally broken in v1.7 release.
  • File-backed mappings are now emulated via PAL read/write APIs. This fixed multiple deviations from the semantics of those mappings as implemented in Linux.
  • Added missing locks around dentry->inode accesses.
  • Fixed a long-standing issue about not waiting for the async thread to exit.

Miscellaneous

  • is-sgx-available was extended to show EDECCSSA and AEX-Notify information.
  • Additional logging for raw syscall instructions.
  • Multiple documentation updates.
  • Multiple refactorings and minor bugfixes.
  • The key used for signing APT repos is being rotated. Existing repos did not change the signing key, but newer repos (starting with noble, Ubuntu 24.04 LTS) are being released with one of two new keys (there are two keys for backup reasons):
pub   ed25519 2024-09-03 [SC]
      1CBF71E00FF0A5577A4EA6984B8D8EC2F8BE4647
uid           Gramine Project signing key (2024a)

pub   ed25519 2024-07-04 [SC]
      71807D6094DDF649D9591A53B951298EB73C9392
uid           Gramine Project signing key (2024b)

We've also generated two keys for RPM packages, but those are not yet it use, they're waiting for new release of any supported RPM distribution:

pub   rsa4096 2024-09-03 [SC]
      AB6A3E8D7000D03ADAD447270DECAAD7765E4B3F
uid           Gramine Project signing key, RPM (2024a)

pub   rsa4096 2024-07-04 [SC]
      302BDEFEA069FA50BFE449BEA5C4FF471AC36540
uid           Gramine Project signing key, RPM (2024b)

Known issues

  • Multithreaded applications which issue a lot of OCALLs concurrently might experience reliability issues: #1261 (comment)
  • There's a bug in GDB introduced somewhere between versions 12 and 13 (and still present in 15.x): When using set detach-on-fork off and set schedule-multiple on non-main threads in the parent process get stuck in "tracing stop" state after vfork + execve. This causes GDB to be unusable for debugging gramine-direct on Debian 12 and Ubuntu 24.04.

Installation instructions

If you are updating from v1.7:

  • apt-get update && apt-get upgrade for Debian/Ubuntu
  • dnf update for AlmaLinux and compatible

If you are not updating, then to install Gramine v1.8, follow the distribution-specific commands in the respective section below. The same instructions can be found in our documentation.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Debian 12:

sudo curl -fsSLo /etc/apt/keyrings/gramine-keyring-$(lsb_release -sc).gpg https://packages.gramineproject.io/gramine-keyring-$(lsb_release -sc).gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/gramine-keyring-$(lsb_release -sc).gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /etc/apt/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Debian 11:

# if you don't already have backports repo enabled:
echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" \
| sudo tee /etc/apt/sources.list.d/backports.list

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring-$(lsb_release -sc).gpg https://packages.gramineproject.io/gramine-keyring-$(lsb_release -sc).gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring-$(lsb_release -sc).gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Ubuntu 24.04 LTS, 22.04 LTS:

sudo curl -fsSLo /etc/apt/keyrings/gramine-keyring-$(lsb_release -sc).gpg https://packages.gramineproject.io/gramine-keyring-$(lsb_release -sc).gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/gramine-keyring-$(lsb_release -sc).gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

AlmaLinux and other compatible distros, versions 9 and 8:

  1. Install EPEL repository as described here: https://docs.fedoraproject.org/en-US/epel/
  2. Install Gramine:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine

Alpine Linux

Packages and repositories for Alpine Linux are not published, but you can compile the packages using APKBUILD in packages/alpine subdirectory.

Assets 7
Loading

v1.7

24 Apr 15:29
@woju woju
v1.7
This tag was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
10e9353
This commit was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.7

Important changes

This change log covers the changes since the last release.

New features

  • Added secure implementation of eventfd.
    • All examples are updated to use this secure implementation by default, i.e. sys.insecure__allow_eventfd is not needed anymore.
    • The sys.insecure__allow_eventfd manifest option is still available, for rare cases where (insecure) multi-process support is required.
    • Certain workloads may experience slight performance degradation due to the new secure eventfd implementation, in comparison to the previous insecure eventfd implementation; the Gramine team is investigating whether this performance degradation can be alleviated.
  • Added unconditional removal of encrypted files.
    • Previously, it was impossible to remove an encrypted file which became corrupted or inaccessible (e.g. because the encryption key was changed).
    • This feature is useful in cases of e.g. sudden power outage which leaves the file in inconsistent state.
  • Added support for arbitrary truncation of encrypted files.
    • Previously, it was possible to truncate an encrypted file only to size 0.
  • Added gramine-manifest-check tool that checks manifest for conformance with schema, and a built-in check in gramine-manifest tool.
    • This will become breaking: the check is currently enabled in warning-only mode, but starting from v1.8, the check will be enabled in hard-error mode by default and might fail on previously-working manifests. Use --no-check to suppress.

Miscellaneous

Installation instructions

If you are updating from v1.6.x:

  • apt-get update && apt-get upgrade for Debian/Ubuntu
  • dnf update for AlmaLinux and compatible

If you are not updating, then to install Gramine v1.7, follow the distribution-specific commands in the respective section below. The same instructions can be found in our documentation.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Debian 12:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Debian 11:

# if you don't already have backports repo enabled:
echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" \
| sudo tee /etc/apt/sources.list.d/backports.list

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Ubuntu 22.04 LTS, 20.04 LTS:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

AlmaLinux and other compatible distros, versions 9 and 8:

  1. Install EPEL repository as described here: https://docs.fedoraproject.org/en-US/epel/
  2. Install Gramine:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine

Alpine Linux

Packages and repositories for Alpine Linux are not published, but you can compile the packages using APKBUILD in packages/alpine subdirectory.

Assets 7
Loading

v1.6.2

12 Mar 11:09
@woju woju
v1.6.2
This tag was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
a971e30
This commit was signed with the committer’s verified signature.
woju Wojtek Porczyk
GPG key ID: 044D9664E7A77E16
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.6.2

This is a minor update to the release v1.6:

  • Security fixes (relevant for SGX):
    • Trusted files feature had the following security vulnerability: after fork, the metadata of currently-opened-in-parent-process trusted file (SHA256 hashes for each chunk of the file) was not available in the child SGX enclave. This effectively degenerated all currently-opened trusted files into allowed files, and thus the child enclave lost integrity guarantees in these trusted files. See #1796 for details.
  • Breaking changes:
    • Due to update of Sphinx, manpages cannot be built on *EL8 and are missing from .el8 RPM packages.

The installation instructions are the same as for the release v1.6.

Assets 7
Loading

v1.6.1

20 Feb 15:02
@dimakuv dimakuv
v1.6.1
5939d7b
Compare
Choose a tag to compare
v1.6.1

This is a minor update to the release v1.6:

The installation instructions are the same as for the release v1.6.

Assets 7
Loading

v1.6

14 Dec 21:57
@dimakuv dimakuv
v1.6
a7a72c4
Compare
Choose a tag to compare
v1.6

Important changes

This change log covers the changes since the last release.

Breaking changes

  • sgx.use_exinfo manifest option is now required if the application uses memory-fault (SIGSEGV, SIGBUS) exception handlers.

    • Done for security reasons -- to not propagate a wrong address 0 to the application's exception handler (as it was previously).
    • WARNING: some applications may not work on old Intel CPUs, as they do not support the SGX EXINFO hardware feature.
    • You can find discussions here.

  • Devices mounted via fs.mounts (e.g., with uri="dev:/dev/zero") must be explicitly allowed via sgx.allowed_files (e.g., with an item "dev:/dev/zero".

    • Example: fs.mounts = [ {... uri = "dev:/dev/zero"} ] must be accompanied by sgx.allowed_files = [ "dev:/dev/zero" ].
    • Done for security reasons -- devices in Gramine are pass-through; Gramine doesn't add any protections to the app-to-device communication.
    • You can find discussions here.

Security fixes

New features

Performance improvements

  • Added optimization of a statically allocated buffer in the sendfile() system call (only for the first thread).
  • Introduced sgx.cpu_features.[...] = "[unspecified|disabled|required]" instead of sgx.require_[...] = true|false.
    • sgx.cpu_features.[...] = "disabled" may improve SGX enclave performance because the corresponding CPU feature will not be saved and restored during enclave entry/exit.
    • See here for details.
  • Added Invariant TSC query fallback for hypervisors (in particular, improves performance of QEMU).
  • Fixed a performance bug on on I/O intensive benchmarks (observed 5% improvement in performance).

Bugfixes, stability and refactoring

Miscellaneous

Installation instructions

If you are updating from v1.5:

  • apt-get update && apt-get upgrade for Debian/Ubuntu
  • dnf update for AlmaLinux and compatible

If you are not updating, then to install Gramine v1.6, follow the distribution-specific commands in the respective section below. The same instructions can be found in our documentation.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Debian 12:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Debian 11:

# if you don't already have backports repo enabled:
echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" \
| sudo tee /etc/apt/sources.list.d/backports.list

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Ubuntu 22.04 LTS, 20.04 LTS:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

We have discontinued packages for Ubuntu 18.04 LTS, which is already EOL.

AlmaLinux and other compatible distros, versions 9 and 8:

  1. Install EPEL repository as described here: https://docs.fedoraproject.org/en-US/epel/
  2. Install Gramine:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine

Alpine Linux

Packages and repositories for Alpine Linux are not published, but you can compile the packages using APKBUILD in packages/alpine subdirectory.

Assets 7
Loading

v1.5

07 Jul 14:39
@dimakuv dimakuv
v1.5
0b55269
Compare
Choose a tag to compare
v1.5

Important changes

This change log covers the changes since the last release.

Breaking changes

  • Renamed gramine-sgx-quote-dump tool to gramine-sgx-quote-view.
  • RA_TLS_ALLOW_OUTDATED_TCB_INSECURE environment variable is split into three:
    • RA_TLS_ALLOW_OUTDATED_TCB_INSECURE (same as before) -- whether to allow "outdated TCB" status
    • RA_TLS_ALLOW_HW_CONFIG_NEEDED -- whether to allow "HW configuration needed" status
    • RA_TLS_ALLOW_SW_HARDENING_NEEDED -- whether to allow "SW hardening needed" status
  • The following previously-deprecated syntax was removed:
    • loader.debug_type -- use loader.log_level and loader.log_file instead
    • fs.mount.[identifier].type, fs.mount.[identifier].path, fs.mount.[identifier].uri -- use fs.mounts = [ ... ] instead
    • sgx.thread_num = [NUM] -- use sgx.max_threads instead
    • sgx.remote_attestation = [true|false] -- use sgx.remote_attestation = "[none|epid|dcap]" instead
    • sgx.protected_files, sgx.protected_mrenclave_files, sgx.protected_mrsigner_files -- use fs.mounts = [ type="encrypted", ... ] instead
    • sgx.insecure__protected_files_key -- use fs.insecure__keys.[KEY_NAME] instead
    • loader.pal_internal_mem_size: not required anymore
    • fs.experimental__enable_sysfs_topology: not required anymore
    • sgx.nonpie_binary: not required anymore
  • While configuring the build, only one libc (either glibc or musl) can be chosen at a time. Musl was removed from DEB and RPM packages. If you need musl on glibc systems, for 1.5 release you need to compile Gramine yourself.

Security fixes

New features

Performance improvements

  • Added readers-writer lock implementation and use it during search in file descriptors table.

Bugfixes, stability and refactoring

  • Fixed wrong format of SIGSTRUCT.DATE in the SIGSTRUCT (.sig) file. See #1287 for details.
  • Fixed POSIX locking on encrypted files in child processes.
  • Gramine now treats (e)poll error ((E)POLLERR) and hang-up ((E)POLLHUP/(E)POLLRDHUP) events separately.

Miscellaneous

  • Gramine sets sgx.enclave_size to 1TB on EDMM by default; there is no need now to specify the enclave size explicitly if EDMM is enabled.
  • Gramine uses dynamic allocation for process cmdline field, instead of 4KB pre-allocated field (required for e.g. Apache Kafka).
  • Added aux vectors AT_UID, AT_EUID, AT_GID, AT_EGID, AT_SECURE for glibc/musl to consume on app startup.
  • Gramine exposes SGX sealing keys under /dev/attestation/keys/.
  • Gramine now doesn't allow the removal of pseudo-files (/dev, /proc, /sys).
  • Updated mbedTLS dependency to version 3.4.0.
  • Updated musl dependency to version 1.2.4.
  • Updated glibc dependency to version 2.37.
  • Gramine can be built under Alpine.
  • Gramine ReadTheDocs documentation is rearranged.
  • Added the "Gramine features" technical document.

We welcome Kailun Qin as the new maintainer of Gramine!

Installation instructions

Starting from release v1.0, Gramine is available as .deb and .rpm packages.

If you are updating from v1.4:

  • apt-get update && apt-get upgrade for Debian/Ubuntu
  • dnf update for AlmaLinux

If you are not updating, then to install Gramine v1.5, follow the distribution-specific commands in the respective section below. The same instructions can be found in our documentation.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Debian 12:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Debian 11:

# if you don't already have backports repo enabled:
echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" \
| sudo tee /etc/apt/sources.list.d/backports.list

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

Ubuntu 22.04 LTS, 20.04 LTS:

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine

We have discontinued packages for Ubuntu 18.04 LTS, which is already EOL.

AlmaLinux and other compatible distros, versions 9 and 8:

  1. Install EPEL repository as described here: https://docs.fedoraproject.org/en-US/epel/
  2. Install Gramine:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine

NOTE: Because of recent changes to RHEL sources availability, at the time of this release it is too early for us to ascertain future compatibility between RHEL proper and downstream rebuilders like AlmaLinux, Rocky Linux and other. We have always built .el packages on AlmaLinux, and this did not change, but for 1.5 release cycle we feel we cannot claim compatibility with RHEL. We do not use many features of the distribution, and those packages might in fact be compatible, but we just do not know. Instead we resolve ...

Read more
Assets 7
Loading

v1.4

13 Feb 18:23
@woju woju
v1.4
aefd5d0
Compare
Choose a tag to compare
v1.4

Important changes

This change log covers the changes since the last release.

Breaking changes

  • Gramine packages gramine-dcap and gramine-oot were retired (these packages contained Gramine built against the out-of-tree DCAP SGX driver and the out-of-tree legacy non-FLC SGX driver).

    • Only gramine package is left (contains Gramine built against the in-kernel SGX driver).
    • The gramine package can be used on systems with the out-of-tree DCAP SGX driver.
    • If you must use Gramine on a system with the legacy non-FLC SGX driver, you must build Gramine manually.

  • Manifest option sgx.thread_num is renamed to sgx.max_threads. sgx.thread_num is deprecated and will be removed in the future.

Security fixes

  • Gramine now enforces AES-NI, XSAVE and RDRAND CPUID features, and refuses to start without them:
    • XSAVE is used internally by Gramine,
    • AES-NI and RDRAND are required, otherwise some crypto libraries (e.g. mbedtls) silently switch to side-channel-prone software implementations of crypto algorithms.

New features

  • Support for EDMM (Enclave Dynamic Memory Management), enabled via a new manifest option sgx.edmm_enable.

  • Added /proc/[pid]/stat and /proc/[pid]/statm pseudo-files.

  • PAL component doesn't need a separate memory pool anymore. Thus, loader.pal_internal_mem_size is not needed anymore and deprecated.

  • Support for socket flags: SO_REUSEPORT, TCP_USER_TIMEOUT, TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT.

Performance improvements

  • Reduced lock contention in poll.

Bugfixes, stability and refactoring

  • Completely rewritten poll and select syscalls implementations.
  • SGX tokens (aka EINITTOKENs) are not generated on newer (FLC-based) SGX CPUs anymore.
    • For the context, see #363.
  • All SGX tools and libraries are built statically (including RA-TLS and Secret Prov libraries).
  • Reworked setuid and setgid syscalls, as well as chown(), fchown() and fchownat() syscalls (for UID/GID owner on files).

Miscellaneous

  • Updated the official Gramine Docker image; the sources for this Docker image can be found here.
  • Updated mbedTLS dependency to version 3.3.0.
  • Updated Glibc dependency to version 2.36.
  • Switched signing algorithm for RA-TLS certs from RSA-3072 to ECDSA-384.
  • Gramine now ignores MSG_MORE flag for TCP sockets in send* syscalls (which is semantically correct).
  • Documentation describes how to build Gramine without network access.
  • Added Scikit-learn example.
  • Added python.get_sys_path() to manifest template API; this is useful for manifests of Python-based workloads.
  • All CI examples are hardened (e.g., no sgx.allowed_files anymore).

Installation instructions

Starting from release v1.0, Gramine is available as .deb and .rpm packages.

If you are updating from v1.3.x:

  • If you have Debian 11 or Ubuntu 22.04, before upgrading, you need to edit repository definition and change stable to bullseye or jammy, respectively.
  • apt-get update --allow-releaseinfo-change && apt-get upgrade for Debian/Ubuntu
  • dnf update for RHEL/AlmaLinux

NOTE: because we have changed repository metadata, it's required to add --allow-releaseinfo-change to apt-get update a single time. Otherwise you might get an error about metadata changes.

If you are not updating, then to install Gramine v1.4, follow the below commands:

  • for Debian 11:
# if you don't already have backports repo enabled:
echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" \
| sudo tee /etc/apt/sources.list.d/backports.list

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine
  • experimentally, for Debian bookworm (Debian Testing at the time of this release)
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine
  • for Ubuntu 22.04 LTS, 20.04 LTS and 18.04 LTS:
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/gramine.list

sudo curl -fsSLo /usr/share/keyrings/intel-sgx-deb.asc https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx-deb.asc] https://download.01.org/intel-sgx/sgx_repo/ubuntu $(lsb_release -sc) main" \
| sudo tee /etc/apt/sources.list.d/intel-sgx.list

sudo apt-get update
sudo apt-get install gramine
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine

The same instructions can be found in our documentation's Quick Start.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Assets 8
Loading

v1.3.1

29 Sep 21:57
@dimakuv dimakuv
v1.3.1
e18bc05
Compare
Choose a tag to compare
v1.3.1

This is a minor update to the release v1.3:

  • Corrected installation instructions for "Quick Start" and "Cloud Deployment" documentation pages.
  • Added missing dependencies for Gramine packages.

The installation instructions are the same as for the release v1.3.

Assets 13
Loading

v1.3

27 Sep 11:23
@dimakuv dimakuv
v1.3
a6887a5
Compare
Choose a tag to compare
v1.3

Important changes

This change log covers the changes since the last release.

Breaking changes

  • Public API of Secret Provisioning was modified. User applications relying on this API must be updated as follows:
    • secret_provision_start() allocates a context that should be supplied to all other Secret Prov APIs and must be closed afterwards.
    • secret_provision_get() requires a context as the first argument, and extracts a copy of the secret that is associated with this context.
    • secret_provision_destroy() is removed. Use secret_provision_close() instead: it will both close the session and destroy the secret.
    • SECRET_PROVISION_SET_KEY environment variable is introduced, instead of deprecated SECRET_PROVISION_SET_PF_KEY.
  • The Secret Provisioning service must send the encryption key in 16-byte raw binary form (previously, the encryption key was sent in 32-char NULL-terminated hex form, and hex decoding can leak information about the encryption key). Users must update the Secret Provisioning service and/or the Secret Provisioning client if needed.
  • Public API of RA-TLS shared library was modified: ra_tls_verify_callback() and ra_tls_create_key_and_crt() mbedTLS-specific functions were removed. Users must use TLS-library-agnostic versions now: ra_tls_verify_callback_der() and ra_tls_create_key_and_crt_der().
  • loader.argv0_override manifest option was removed. Gramine ignores this option from now on. See our documentation on how to specify command-line arguments in the manifest.
  • Due to the introduced mitigation of vulnerability CVE-2022-21233, the Exitless feature is considered insecure from now on, and the corresponding manifest option was renamed from sgx.rpc_thread_num to sgx.insecure__rpc_thread_num.

New features

  • New manifest option sys.enable_extra_runtime_domain_names_conf to enable extra runtime configuration for domain names and DNS:
  • New manifest option loader.argv to specify command-line arguments in the manifest directly.
  • New manifest option sgx.remote_attestation = "[none|epid|dcap]", instead of now-deprecated sgx.remote_attestation = true.
    • Also, a new file /dev/attestation/attestation_type is introduced, to help apps determine which attestation scheme is used.
    • Relevant CI examples were rewritten to use the new syntax.
  • Support for executable scripts (shebangs) during execve() system call and as libos.entrypoint.
  • Support for getcpu() and fadvise64() system calls.
  • Added O_PATH support to open() system call.
  • Support of the /sys/devices/system/node/nodeX/meminfo files.
  • Support all currently known CPU feature flags in /proc/cpuinfo.

Security improvements

  • Mitigated vulnerability CVE-2022-21233 aka INTEL-SA-00657.
  • Fixed a vulnerability of insecurely allocating untrusted memory for futex objects.
  • Fixed a vulnerability of the Secret Provisioning service sending the encryption key in 32-char hex form (could leak information about the encryption key through memory access patterns during hex decoding).
  • Fixed a vulnerability of NULL pointer dereference when there are no epoll items during epoll_wait() system call.
  • Per-thread CPU affinity mask is initialized once and cached in Gramine; previously, the mask was queried from the untrusted host.
  • Introduced constant-time memcmp() and use it for MAC check in sgx_verify_report() (to avoid side-channel leaks via timing attacks).

GSC improvements

  • Support for Docker images that have a non-root user.
  • Support for specifying an image registry via Registry option in config.yaml.

Bugfixes, stability and refactoring

  • Completely rewritten the sockets (networking) subsystem.
  • Fixed several resource and memory leaks.

Miscellaneous

  • Released an official Gramine Docker image; the sources for this Docker image can be found here.
  • Updated mbedTLS dependency to version 3.2.1.
  • Updated Glibc dependency to version 2.35.
  • gramine-sgx-pf-crypt tool can be run in a Gramine SGX enclave now; this is helpful when the enclavized application wants to use this tool (or its underlying library libsgx_util.so) to perform encryption/decryption of files explicitly.
  • Added peak memory usage (VmPeak) field to /proc/<pid>/status file.
  • Internal refactoring of Gramine source code:
    • Lowercased directory names.
    • Directory LibOS/shim/ is flattened to simply libos/.
    • Replaced legacy prefixes Dk, db, shim to Pal, enclave/host, libos ones.
    • Moved SGX tools and libraries to tools/sgx/.

Installation instructions

Starting from release v1.0, Gramine is available as .deb and .rpm packages.

If you are updating from v1.2:

  • If you have Ubuntu 18.04 or 20.04, before upgrading, you need to edit repository definition and change stable to bionic (for Ubuntu 18.04) or focal (for Ubuntu 20.04). The line should be like in the fresh install snippet below. (If you have newer Ubuntu or Debian, this step should be skipped.)
  • apt update && apt upgrade for Debian/Ubuntu
  • dnf update for RHEL/CentOS/AlmaLinux

If you are not updating, then to install Gramine v1.3, follow the below commands:

  • for Ubuntu 18.04:
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ bionic main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver
  • for Ubuntu 20.04:
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ focal main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver
  • for other Ubuntu/Debian:
sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ stable main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver
  • for RHEL/CentOS/AlmaLinux:
# first time you need to confirm the key fingerprint, which should be F3FFBE5FC0477DB46E4851E737B04F03659B87AF
sudo curl -fsSLo /etc/yum.repos.d/gramine.repo https://packages.gramineproject.io/rpm/gramine.repo
sudo dnf install gramine     # for 5.11+ upstream, in-kernel driver

The same instructions can be found in our documentation's Quick Start.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Assets 13
Loading

v1.2

27 May 13:31
@mkow mkow
v1.2
fd2e302
Compare
Choose a tag to compare
v1.2

Important changes

This change log covers the changes since the last release.

Breaking changes

  • Installation instructions changed starting from this version, see below.
  • fs.mount was renamed to fs.mounts and now uses a proper TOML array syntax. The old syntax is still supported, but deprecated.
  • Relative mount paths in manifests are now deprecated.
  • Protected files were renamed to a more intuitive name: encrypted files.
  • Encrypted files are now implemented on the mountpoints layer and support having different keys per each mount. See the documentation for the new syntax.
  • Encrypted files' keys should now be modified through special files at /dev/attestation/keys/<key_name>. Unlike the deprecated /dev/attestation/protected_files_key, the new files use raw binary, not hex strings.
  • Attestation-related environment variables (RA_TLS_MRSIGNER etc.) passed to RA-TLS must be explicitly ignored if not used.

New features

  • All filesystems use inodes now, which fixes issues with renaming and unlinking semantics.
  • Created gramine-sgx-gen-private-key tool to simplify SGX signing key generation.
  • Added proper renaming support to encrypted files.
  • Added simple fallocate syscall implementation.
  • Executable scripts (with a shebang) are now supported.
  • Running on systems with some CPU threads/cores shut down is now supported.

Security fixes

  • CPU and NUMA topology is now properly sanitized and thus enabled by default.

New sample integrations

  • Added an asynchronous web server example in Rust.

Bugfixes, stability and refactoring

  • Added a workaround for a Linux bug which broke gramine-direct on systems with 5-level page tables.
  • Fixed a crash in gramine-sgx-pf-crypt when compiled with Clang in release mode.
  • werror is not enabled by default anymore when building Gramine (but it is still enabled in CI).
  • Multiple other small bugfixes.

Miscellaneous

  • Created "Onboarding" page in the documentation with suggested learning material for aspiring Gramine developers.
  • Updated tools to use IAS API v4.
  • Added integration with VTune profiler.

Installation instructions

Starting from release v1.0, Gramine is available as .deb and .rpm packages. Note you cannot cleanly update to a new release, because of dependency on external repository introduced in this release.

Before installing or updating Gramine, add Intel's SGX repository:

curl -fsSL https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list

(focal is good for Ubuntu 20.04 and Debian 11; for Ubuntu 18.04, change focal to bionic).

Then add Gramine's official repo and install the package.

sudo curl -fsSLo /usr/share/keyrings/gramine-keyring.gpg https://packages.gramineproject.io/gramine-keyring.gpg
echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/gramine-keyring.gpg] https://packages.gramineproject.io/ stable main' | sudo tee /etc/apt/sources.list.d/gramine.list
sudo apt-get update

sudo apt-get install gramine      # for 5.11+ upstream, in-kernel driver
sudo apt-get install gramine-oot  # for out-of-tree SDK driver
sudo apt-get install gramine-dcap # for out-of-tree DCAP driver

If you are updating from v1.1, you need to add Intel's SGX repo (see above), then update like usual:

  • apt-get update && apt-get upgrade for Debian/Ubuntu
  • dnf update for RHEL/Fedora/CentOS

The same instructions can be found in our documentation's Quick Start.

If you prefer to build the sources yourself, please follow the building instructions from our documentation.

Assets 10
Loading