how to make v1.3.1 support reading virtual files for local attestation when sgx.remote_attestation = "none"

[sammyne]

It's ok for v1.2 to do local attestation without setting sgx.remote_attestation. However, after upgrade to v1.3.1, reading virtual file /dev/attestation/my_target_info would report file not found error. Really appreciate if someone can help me out of this problem.

[dimakuv]

Hm, this is a good point.

In v1.3.1, we introduced this explicit manifest option sgx.remote_attestation = "none" | "epid" | "dcap".

And we introduced the logic of enabling pseudo-files like my_target_info, report, user_report_data only if sgx.remote_attestation != "none". See this:

gramine/libos/src/fs/dev/attestation.c

Lines 399 to 403 in 5bba58a

	if (!strcmp(g_pal_public_state->attestation_type, "none")) {
	log_debug("host is Linux-SGX but remote attestation type is 'none', adding only "
	"/dev/attestation/attestation_type file and skipping others (report, etc.)");
	return 0;
	}

But now I think that we were over-restrictive. If the underlying backend is Intel SGX, then local attestation is always accessible and doesn't care about/rely on EPID or DCAP infrastructure.

So you're right, I think these files should be accessible even if sgx.remote_attestation = "none". Let me create a PR to fix this. Unfortunately, even if other maintainers agree to fix this problem, you'll have to wait for Gramine v1.4.

[dimakuv]

It's not a crucial bug for sure.

You can currently circumvent this by just having a dummy sgx.remote_attestation = "dcap" in your manifest file.

[sammyne]

It's not a crucial bug for sure.

You can currently circumvent this by just having a dummy sgx.remote_attestation = "dcap" in your manifest file.

That would require me to setup PCCS stuff = =

[dimakuv]

@sammyne I don't think so, why?

[dimakuv]

#1057 -- I created a PR.

[boryspoplawski]

@sammyne I think @dimakuv is right and you could set sgx.remote_attestation = whatever without setting all that PCCS stuff.
Also if this fix (once merged) is so important you you, you can build Gramine manually