Remove loader.entrypoint from manifest template

[kailun-qin]

Description of the changes

This is a commit corresponding to commit 87c752f "[PAL] Drop deprecated syntax of loader.entrypoint" in core Gramine repository.

Fixes #224.

How to test this PR?

Manual testing.

---

This change is 

[mkow]

Reviewed 3 of 3 files at r1, all commit messages.
Reviewable status: all files reviewed, all discussions resolved, not enough approvals from maintainers (1 more required)

[anjalirai-intel]

@kailun-qin

I additionally tested the PR in Gramine-Direct mode, and found that the fix works only for Gramine-SGX but causes issues in Gramine-Direct. I've attached both manifest files for your reference. You'll notice that entrypoint.manifest.sgx includes loader.entrypoint, whereas entrypoint.manifest does not. Could you please investigate this further?

manifest.zip

Logs:

$ docker run --device=/dev/sgx_enclave --env GRAMINE_MODE=direct -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket --security-opt seccomp=unconfined   gsc-ubuntu22.04-bash -c "echo hello"
error: PAL failed No 'loader.entrypoint.uri' is specified in the manifest



$ docker run --device=/dev/sgx_enclave -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket   gsc-ubuntu22.04-bash -c "echo hello"
Gramine is starting. Parsing TOML manifest file, this may take some time...
-----------------------------------------------------------------------------------------------------------------------
Gramine detected the following insecure configurations:

  - loader.insecure__use_cmdline_argv = true   (forwarding command-line args from untrusted host to the app)

Gramine will continue application execution, but this configuration must not be used in production!
-----------------------------------------------------------------------------------------------------------------------

hello

[kailun-qin]

Reviewed 3 of 3 files at r1, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion, not enough approvals from maintainers (1 more required)

---

a discussion (no related file):
Thanks @anjalirai-intel, good catch!

I think the issue lies in the manifest preprocessing (which auto-fills loader.entrypoint.uri, see here) implemented in core Gramine is not invoked when generating entrypoint.manifest in gsc (which is used by gramine-direct). Note that this is implicitly called during gsc sign-image/gramine-sgx-sign (see here), so it works fine in gramine-sgx mode.

I think the simplest solution would be to keep loader.entrypoint.uri (w/ the updated name) in the manifest templates. Alternatively, we could implement/call similar logic in gsc.

[DukeDavis12]

@kailun-qin Please review PR #223 ; includes loader.entrypoint.uri changes.

[anjalirai-intel]

@kailun-qin Please review PR #223 ; includes loader.entrypoint.uri changes.

@DukeDavis12 PR #223 is also not fixing the issue in gramine-direct. I am getting below error when running with Gramine-Direct

Error:

error: Invalid trusted file in manifest at index 0 (not a TOML table)
error: libos_init() failed in init_trusted_allowed_files: Invalid argument (EINVAL)

[anjalirai-intel]

@kailun-qin Any updates on the PR?

[kailun-qin]

@anjalirai-intel: I think @DukeDavis12 would want to introduce a fix which is somewhat tangled w/ #223?

Reviewable status: all files reviewed, 1 unresolved discussion

[aneessahib]

@kailun-qin please go ahead merge this fix. @DukeDavis12 will rebase after.

[adarshan-intel]

Can we merge this?
PR #228 depends on this

[mkow]

Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @anjalirai-intel)

---

a discussion (no related file):

Previously, kailun-qin (Kailun Qin) wrote…

Thanks @anjalirai-intel, good catch!

I think the issue lies in the manifest preprocessing (which auto-fills loader.entrypoint.uri, see here) implemented in core Gramine is not invoked when generating entrypoint.manifest in gsc (which is used by gramine-direct). Note that this is implicitly called during gsc sign-image/gramine-sgx-sign (see here), so it works fine in gramine-sgx mode.

I think the simplest solution would be to keep loader.entrypoint.uri (w/ the updated name) in the manifest templates. Alternatively, we could implement/call similar logic in gsc.

So, this is still broken? What's the status of this issue?