上篇是通过修改文件的安全信息来实现。那么首先一个坑就是，如果文件本身没有写权限，麻烦就大了。虽然可以通过修改DCAL权限得到写权限，根据“代码多就是bug多”的原则，很容易夜长梦多，节外生枝。所以要在创建文件时直接指定权限。
总的过程：先喘一口气，然后根据sid和对应的权限创建Explicit Access，根据Explicit Access创建ACL，用ACL创建security descriptor，用security descriptor创建security attributes ，现在可以用security attributes 进行createfile了。有没有感受到Windo[……]
在我接触Windows之前，对Windows的文件权限是不屑一顾。要用的时候才发现，Windows文件权限的组合远多于POSIX的rwx。这个坑花了三四天的时间。一句话总结：Windows虽然有更多的组合，但是不能实现全部的rwx组合。
首先是权限本身的转换，这里有个自认为完美的实现，只用一个掩码变量实现x, w, r等3种权限和OTH， GRP，USR等3个用户组的遍历，根据掩码得到的结果保存Windows下对应的权限。
创建3个sid时要特别注意其SID_IDENTIFIER_AUTHORITY 和RID。SID_IDENTIFIER_AUTHORITY分别是SECURITY_[……]
https://gcc.gnu.org/onlinedocs/gcc-7.5.0/gnat_ugn/Compilation-options.html
实际上gcc和clang均可支持。当使用-ffunction-sections -fdata-sections这两个参数编译，并且在链接时使用-Wl,–gc-sections参数，就可以将无用的代码进行删除。
编译时-ffunction-sections 和 -fdata-sections 将每个函数或符号创建为一个sections，每个sections名与function或data名保持一致；链接时-Wl,–gc-sections[……]
查询文件属于哪个包：
|
1 2 3 |
alvin@chen:~/openenclave/build$ dpkg -S /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 libsgx-enclave-common: /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 alvin@chen:~/openenclave/build$ |
|
1 2 3 |
[alvin@wechen3-rhel8-4 ~]$ rpm -qf /usr/lib/debug/usr/lib64/libsgx_dcap_ql.so.1.6.100.2-1.6.100.2-1.el8.x86_64.debug libsgx-dcap-ql-debuginfo-1.6.100.2-1.el8.x86_64 [alvin@wechen3-rhel8-4 ~]$ |
查询包的基本信息：
|
1 2 3 4 5 6 7 8 |
alvin@chen:~/openenclave/build$ dpkg -l libsgx-enclave-common Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-======================-================-================-================================================== ii libsgx-enclave-common 2.8.100.3-bionic amd64 Intel(R) Software Guard Extensions Enclave Common alvin@chen:~/openenclave/build$ |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
[alvin@wechen3-rhel8-4 ~]$ rpm -qi libsgx-dcap-ql-debuginfo-1.6.100.2-1.el8.x86_64.rpm Name : libsgx-dcap-ql-debuginfo Version : 1.6.100.2 Release : 1.el8 Architecture: x86_64 Install Date: (not installed) Group : Development/Debug Size : 495664 License : BSD License Signature : (none) Source RPM : libsgx-dcap-ql-1.6.100.2-1.el8.src.rpm Build Date : Fri 03 Apr 2020 07:48:37 AM UTC Build Host : rhel80-builder-vmware-dcap-01 Relocations : (not relocatable) URL : https://github.com/intel/SGXDataCenterAttestationPrimitives Summary : Debug information for package libsgx-dcap-ql Description : This package provides debug information for package libsgx-dcap-ql. Debug information is useful when developing applications that use this package or when debugging this package. |
查询包的全部文件：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
alvin@chen:~/openenclave/build$ dpkg -L libsgx-enclave-common /. /etc /etc/udev /etc/udev/rules.d /etc/udev/rules.d/91-sgx-enclave.rules /lib /usr /usr/lib /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1.0.108.3 /usr/share /usr/share/doc /usr/share/doc/libsgx-enclave-common /usr/share/doc/libsgx-enclave-common/changelog.Debian.gz /usr/share/doc/libsgx-enclave-common/copyright /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /etc/aesmd.conf alvin@chen:~/openenclave/build$ |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
[alvin@wechen3-rhel8-4 ~]$ rpm -ql libsgx-dcap-ql-debuginfo-1.6.100.2-1.el8.x86_64.rpm /usr/lib/debug /usr/lib/debug/.build-id /usr/lib/debug/.build-id/79 /usr/lib/debug/.build-id/79/72ce61a3eed2e5d752eb8d6781ad35f629a3e6 /usr/lib/debug/.build-id/79/72ce61a3eed2e5d752eb8d6781ad35f629a3e6.debug /usr/lib/debug/.build-id/fa /usr/lib/debug/.build-id/fa/6b42b1715104236961345f4c143bd68841f9db /usr/lib/debug/.build-id/fa/6b42b1715104236961345f4c143bd68841f9db.debug /usr/lib/debug/usr /usr/lib/debug/usr/lib64 /usr/lib/debug/usr/lib64/libsgx_dcap_ql.so.1.6.100.2-1.6.100.2-1.el8.x86_64.debug /usr/lib/debug/usr/lib64/libsgx_dcap_quoteverify.so.1.6.100.2-1.6.100.2-1.el8.x86_64.debug |
[……]
网上有很多例子是基于ninja的bug。排除ninja的问题后还有错误：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
C:\open-enclave.0.8.1\openenclave\share\openenclave\samples\switchless\build>ninja ...... VERBOSE-- Looking for sgx_enclave_common library - found VERBOSE-- Looking for sgx_dcap_ql library - found -- Configuring done -- Generating done -- Build files have been written to: C:/open-enclave.0.8.1/openenclave/share/openenclave/samples/switchless/build VERBOSE-- Looking for sgx_enclave_common library - found VERBOSE-- Looking for sgx_dcap_ql library - found -- Configuring done -- Generating done -- Build files have been written to: C:/open-enclave.0.8.1/openenclave/share/openenclave/samples/switchless/build ninja: error: manifest 'build.ninja' still dirty after 100 tries C:\open-enclave.0.8.1\openenclave\share\openenclave\samples\switchless\build> |
带上explain参数能显示具体的错误：
|
1 2 3 4 5 6 7 8 9 10 11 |
C:\open-enclave.0.8.1\openenclave\share\openenclave\samples\switchless\build>ninja -d explain ninja explain: output build.ninja older than most recent input ../CMakeLists.txt (603082958 vs 603092436) VERBOSE-- Looking for sgx_enclave_common library - found VERBOSE-- Looking for sgx_dcap_ql library - found -- Configuring done -- Generating done -- Build files have been written to: C:/open-enclave.0.8.1/openenclave/share/openenclave/samples/switchless/build ninja explain: output build.ninja older than most recent input ../CMakeLists.txt (603082963 vs 603092436) ...... C:\open-enclave.0.8.1\openenclave\share\openenclave\samples\switchless\build> |
查看一下文件时间，Modify time还在未来：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
alvin@weichenv081 MINGW64 /c/open-enclave.0.8.1/openenclave/share/openenclave/samples/attested_tls $ stat CMakeLists.txt File: CMakeLists.txt Size: 1386 Blocks: 4 IO Block: 65536 regular file Device: 14abd27bh/346804859d Inode: 1125899907054474 Links: 1 Access: (0644/-rw-r--r--) Uid: (197108/ alvin) Gid: (197121/ UNKNOWN) Access: 2020-02-10 15:38:43.752300400 -0800 Modify: 2020-02-10 18:47:16.000000000 -0800 Change: 2020-02-10 15:38:43.752300400 -0800 Birth: 2020-02-10 15:38:43.752300400 -0800 alvin@weichenv081 MINGW64 /c/open-enclave.0.8.1/openenclave/share/openenclave/samples/attested_tls $ date Mon, Feb 10, 2020 3:39:08 PM alvin@weichenv081 MINGW64 /c/open-enclave.0.8.1/openenclave/share/openenclave/samples/attested_tls $ |
修改文件时间到过去或者把系统时间设在将来，错误消失了。
关于Jenkins上用cpack打包时怎么会把文件时间设在未来，待续。[……]
代码如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
const char* enclave_path = argv[1]; const char* tmp_dir = argv[2]; r = oe_create_test_hostfs_enclave( enclave_path, type, flags, NULL, 0, &enclave); OE_TEST(r == OE_OK); #if defined(_WIN32) tmp_dir = oe_win_path_to_posix(tmp_dir); #endif r = test_hostfs(enclave, tmp_dir); OE_TEST(r == OE_OK); r = oe_terminate_enclave(enclave); OE_TEST(r == OE_OK); printf("=== passed all tests (test_hostfs)\n"); #if defined(_WIN32) free(tmp_dir); #endif |
错误如下：
|
1 2 3 4 5 6 7 8 9 |
[build] Starting build [proc] Executing command: "C:\Program Files (x86)\Microsoft Visual Studio\2019\BuildTools\Common7\IDE\CommonExtensions\Microsoft\CMake\CMake\bin\cmake.exe" --build c:/Users/alvin/openenclave/build --config Debug --target all -- -j 6 [build] [1/2 50% :: 0.063] Building C object tests\syscall\hostfs\host\CMakeFiles\hostfs_host.dir\host.c.obj [build] FAILED: tests/syscall/hostfs/host/CMakeFiles/hostfs_host.dir/host.c.obj [build] C:\PROGRA~2\MICROS~1\2017\BUILDT~1\VC\Tools\MSVC\1416~1.270\bin\Hostx64\x64\cl.exe /nologo -DOE_API_VERSION=2 -DOE_LINK_SGX_DCAP_QL -Itests\syscall\hostfs\host -I..\include -I"C:\oe_prereqs\EnclaveCommonAPI\Header Files" -I"C:\oe_prereqs\DCAP_Components\build\Header Files" /DWIN32 /D_WINDOWS /wd4566 /wd4200 /MDd /Zi /Ob0 /Od /RTC1 /WX /W2 /showIncludes /Fotests\syscall\hostfs\host\CMakeFiles\hostfs_host.dir\host.c.obj /Fdtests\syscall\hostfs\host\CMakeFiles\hostfs_host.dir\ /FS -c ..\tests\syscall\hostfs\host\host.c [build] ..\tests\syscall\hostfs\host\host.c(41): error C2220: warning treated as error - no 'object' file generated [build] ..\tests\syscall\hostfs\host\host.c(41): warning C4090: 'function': different 'const' qualifiers [build] ninja: build stopped: subcommand failed. [build] Build finished with exit code 1 |
有人已经贴了解决方案了，https://stackoverflow.com/questions/2819535/unable-to-free-const-pointers-in-c
就是free的参数不能是const类型的，可以来个类型转换：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
const char* enclave_path = argv[1]; const char* tmp_dir = argv[2]; r = oe_create_test_hostfs_enclave( enclave_path, type, flags, NULL, 0, &enclave); OE_TEST(r == OE_OK); #if defined(_WIN32) tmp_dir = oe_win_path_to_posix(tmp_dir); #endif r = test_hostfs(enclave, tmp_dir); OE_TEST(r == OE_OK); r = oe_terminate_enclave(enclave); OE_TEST(r == OE_OK); printf("=== passed all tests (test_hostfs)\n"); #if defined(_WIN32) free((char*)tmp_dir); #endif |
[……]
用vs2017编译时一直报错：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
[build] ..\host\windows\syscall.c(548): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(552): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(563): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(567): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(588): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(591): error C2017: illegal escape sequence [build] ..\host\windows\syscall.c(595): error C2017: illegal escape sequence [build] [21/1662 1% :: 1.162] Building C object enclave\core\CMakeFiles\oecore.dir\sgx\thread.c.obj [build] [21/1662 1% :: 1.177] Building C object enclave\core\CMakeFiles\oecore.dir\sgx\getkey.S.obj [build] [21/1662 1% :: 1.287] Building C object enclave\core\CMakeFiles\oecore.dir\sgx\tracee.c.obj [build] [21/1662 1% :: 1.321] Building C object enclave\core\CMakeFiles\oecore.dir\sgx\td_basic.c.obj [build] [21/1662 1% :: 1.344] Creating directories for 'libcxx_includes' [build] ninja: build stopped: subcommand failed. [build] Build finished with exit code 1 |
原来是因为宏定义时转义符后面多了个空格：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
alvin@chen ~/openenclave/host/windows$ cat -A syscall.c | head -n 27 // Copyright (c) Open Enclave SDK contributors.$ // Licensed under the MIT License.$ $ /*$ **==============================================================================$ **$ ** windows/syscall.c:$ **$ ** This file implements SYSCALL OCALLs for Windows. Most of these are stubs$ ** which are still under development.$ **$ **==============================================================================$ */$ #define _WINSOCK_DEPRECATED_NO_WARNINGS$ $ #define CHECK(exe) \ $ do \$ { \$ int retval = (exe); \$ if (retval != 0) \$ { \$ fprintf(stderr, "Runtime error: %x \nAt %s:%d", \$ GetLastError(), __FILE__, __LINE__); \$ return NULL; \$ } \$ } while (0)$ |
这么隐蔽的问题，显然是隐患。
在.vimrc中添加高亮：
|
1 2 3 4 5 |
alvin@chen ~/openenclave/host/windows $ tail -n 2 ~/.vimrc highlight WhitespaceEOL ctermbg=red guibg=red match WhitespaceEOL /\s\+$/ alvin@chen ~/openenclave/host/windows$ |
显示效果如下：
[……]
列模式下插入：Ctrl + i
列模式下替换：选中列后按c
保存到只读文件：:w !sudo tee %
删除行尾空格：用替换实现，%s/\s\+$//g
同样的思路，删除空行或者只含有空格的行：%s/^\s\*$//g
匹配printf但不匹配定制的printf(此处为_printf):
/\(_\)\@<!printf
vim的正则表达与标准regex不一样，如需查看帮助:
:h /[
:h /zero-width
:h /\@
匹配类型转换，添加空格：int a = (int)b; -> int a = (in[……]
以为ipdb能够和gdb一样用tui方式运行，结果还是有点遗憾。
补救办法是可以将默认的3行改大。
|
1 2 3 |
alvin@chen:~/python$ python -c 'import ipdb; print(ipdb)' <module 'ipdb' from '/usr/local/lib/python3.6/dist-packages/ipdb/__init__.py'> alvin@chen:~/python$ |
此时可以找到相应的__main__.py为/usr/local/lib/python3.6/dist-packages/ipdb/__main__.py。
修改__main__.py中的context为合适的数值，如下所示：
|
1 2 3 4 |
alvin@chen:~$ cat /usr/local/lib/python3.6/dist-packages/ipdb/__main__.py | grep -n -P "context=\d" 45:def _init_pdb(context=20, commands=[]): 62:def set_trace(frame=None, context=20): alvin@chen:~$ |
修改后效果如下：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 |
alvin@chen:~/python$ ipdb3 1119.py > /home/alvin/python/1119.py(2)<module>() 1 #!/usr/bin/python3 ----> 2 class Solution: 3 def removeVowels(self, S: str) -> str: 4 temp = "" 5 for ch in S: 6 if ch not in [ 'a','e','i','o','u']: 7 temp = temp+ch 8 return temp 9 10 input = "abcdefghijklmnopqrstuvwxyz"; 11 x = Solution(); 12 print("The result of " + input + " is " + x.removeVowels(input)); ipdb> |
ps:以上测试[……]
工作区：当前路径下ls或cat能够看到的目录及文件。
暂存区：工作区的历史快照的合集，每次add操作是此合集的一部分。对同一个文件多次add并不是冲突，因为这是同一个作者的修改，以时间为序，最终状态为结果。
如果是多个作者对同一个文件的相同位置（直观说是行数）进行修改，那么就产生了无法直接解决的冲突：时间先后顺序并不能反映出大家最终的目标。
添加upstream：
|
1 2 3 4 5 6 7 8 9 10 |
alvin@chen2:~/openenclave$ git remote -v origin https://github.com/nonpolarity/openenclave.git (fetch) origin https://github.com/nonpolarity/openenclave.git (push) alvin@chen2:~/openenclave$ git remote add upstream https://github.com/openenclave/openenclave.git alvin@chen2:~/openenclave$ git remote -v origin https://github.com/nonpolarity/openenclave.git (fetch) origin https://github.com/nonpolarity/openenclave.git (push) upstream https://github.com/openenclave/openenclave.git (fetch) upstream https://github.com/openenclave/openenclave.git (push) alvin@chen2:~/openenclave$ |
删除upstream的push：
|
1 2 3 4 5 6 7 |
alvin@chen2:~/openenclave$ git remote set-url --push upstream disable alvin@chen2:~/openenclave$ git remote -v origin https://github.com/nonpolarity/openenclave.git (fetch) origin https://github.com/nonpolarity/openenclave.git (push) upstream https://github.com/openenclave/openenclave.git (fetch) upstream disable (push) alvin@chen2:~/openenclave$ |
设置用本地时间显示：
[crayon-[……]
