You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@teaclave.apache.org by di...@apache.org on 2020/03/23 00:17:04 UTC
[incubator-teaclave-sgx-sdk] branch v1.1.1-testing updated: Fix
dockerfile and sgx_backtrace_sys for LVI mitigation
This is an automated email from the ASF dual-hosted git repository.
dingyu pushed a commit to branch v1.1.1-testing
in repository https://gitbox.apache.org/repos/asf/incubator-teaclave-sgx-sdk.git
The following commit(s) were added to refs/heads/v1.1.1-testing by this push:
new f875faa Fix dockerfile and sgx_backtrace_sys for LVI mitigation
f875faa is described below
commit f875faa0f2cbf00d1e07103d9deb461c25372fba
Author: Yu Ding <di...@gmail.com>
AuthorDate: Sun Mar 22 17:16:52 2020 -0700
Fix dockerfile and sgx_backtrace_sys for LVI mitigation
---
dockerfile/01_gcc_8.sh | 9 ---------
dockerfile/Dockerfile.1604.nightly | 2 +-
dockerfile/Dockerfile.1804.nightly | 6 ++++--
sgx_backtrace_sys/build.rs | 23 +++++++++++++++--------
4 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/dockerfile/01_gcc_8.sh b/dockerfile/01_gcc_8.sh
index be21a75..512add6 100644
--- a/dockerfile/01_gcc_8.sh
+++ b/dockerfile/01_gcc_8.sh
@@ -9,13 +9,4 @@ cd build && \
make -j $(nproc) && \
make install && \
cd /root && \
-git clone git://sourceware.org/git/binutils-gdb.git && \
-cd binutils-gdb && \
-git checkout fe26d3a34a223a86fddb59ed70a621a13940a088 && \
-mkdir build && \
-cd build && \
-../configure --prefix=/usr --enable-gold --enable-ld=default --enable-plugins --enable-shared --disable-werror --enable-64-bit-bfd --with-system-zlib && \
-make -j "$(nproc)" && \
-LD_LIBRARY_PATH=/usr/lib make install && \
-cd /root && \
rm -rf gcc-8.4.0
diff --git a/dockerfile/Dockerfile.1604.nightly b/dockerfile/Dockerfile.1604.nightly
index 80494ef..596b0c0 100644
--- a/dockerfile/Dockerfile.1604.nightly
+++ b/dockerfile/Dockerfile.1604.nightly
@@ -1,6 +1,6 @@
FROM ubuntu:16.04
-RUN apt-get update && apt-get install -y ca-certificates curl wget gnupg git build-essential libtool dpkg-dev flex bison texinfo libiptcdata0-dev && \
+RUN apt-get update && apt-get install -y autoconf automake bison build-essential ca-certificates cmake curl dpkg-dev expect flex gdb git git-core gnupg kmod libboost-system-dev libboost-thread-dev libcurl4-openssl-dev libiptcdata0-dev libjsoncpp-dev liblog4cpp5-dev libprotobuf-c0-dev libprotobuf-dev libssl-dev libtool libxml2-dev ocaml pkg-config protobuf-compiler python sudo texinfo uuid-dev vim wget zlib1g-dev && \
rm -rf /var/lib/apt/lists/*
ADD 01_gcc_8.sh /root
diff --git a/dockerfile/Dockerfile.1804.nightly b/dockerfile/Dockerfile.1804.nightly
index 59df51c..264f6d8 100644
--- a/dockerfile/Dockerfile.1804.nightly
+++ b/dockerfile/Dockerfile.1804.nightly
@@ -1,6 +1,8 @@
-FROM ubuntu:16.04
+FROM ubuntu:18.04
-RUN apt-get update && apt-get install -y autoconf automake bison build-essential cmake curl dpkg-dev expect flex gcc-8 gdb git git-core gnupg kmod libboost-system-dev libboost-thread-dev libcurl4-openssl-dev libiptcdata0-dev libjsoncpp-dev liblog4cpp5-dev libprotobuf-c0-dev libprotobuf-dev libssl-dev libtool libxml2-dev ocaml ocamlbuild pkg-config protobuf-compiler python sudo systemd-sysv texinfo uuid-dev vim wget && \
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt update && apt install -y autoconf automake bison build-essential cmake curl dpkg-dev expect flex gcc-8 gdb git git-core gnupg kmod libboost-system-dev libboost-thread-dev libcurl4-openssl-dev libiptcdata0-dev libjsoncpp-dev liblog4cpp5-dev libprotobuf-c0-dev libprotobuf-dev libssl-dev libtool libxml2-dev ocaml ocamlbuild pkg-config protobuf-compiler python sudo systemd-sysv texinfo uuid-dev vim wget && \
rm -rf /var/lib/apt/lists/*
#18.04 does have gcc-8
diff --git a/sgx_backtrace_sys/build.rs b/sgx_backtrace_sys/build.rs
index ccaf8f3..6a2dd32 100644
--- a/sgx_backtrace_sys/build.rs
+++ b/sgx_backtrace_sys/build.rs
@@ -55,23 +55,30 @@ fn build_libbacktrace(_target: &str) -> Result<(), ()> {
.file("./libbacktrace/sort.c")
.file("./libbacktrace/state.c");
- let mitigation_cflags = "-mindirect-branch-register -mfunction-return=thunk-extern";
+ let mitigation_cflags1 = "-mindirect-branch-register";
+ let mitigation_cflags2 = "-mfunction-return=thunk-extern";
let mitigation_asflags = "-fno-plt";
- let mitigation_loadflags = "-Wa,-mlfence-after-load=yes -Wa,-mlfence-before-ret=not";
- let mitigation_cfflags = "-Wa,-mlfence-before-indirect-branch=register -Wa,-mlfence-before-ret=not";
+ let mitigation_loadflags1 = "-Wa,-mlfence-after-load=yes";
+ let mitigation_loadflags2 = "-Wa,-mlfence-before-ret=not";
+ let mitigation_cfflags1 = "-Wa,-mlfence-before-indirect-branch=register";
+ let mitigation_cfflags2 = "-Wa,-mlfence-before-ret=not";
let mitigation = env::var("MITIGATION_CVE_2020_0551").unwrap_or_default();
match mitigation.as_ref() {
"LOAD" => {
build
- .flag(mitigation_cflags)
+ .flag(mitigation_cflags1)
+ .flag(mitigation_cflags2)
.flag(mitigation_asflags)
- .flag(mitigation_loadflags);
+ .flag(mitigation_loadflags1)
+ .flag(mitigation_loadflags2);
},
"CF" => {
build
- .flag(mitigation_cflags)
+ .flag(mitigation_cflags1)
+ .flag(mitigation_cflags2)
.flag(mitigation_asflags)
- .flag(mitigation_cfflags);
+ .flag(mitigation_cfflags1)
+ .flag(mitigation_cfflags2);
},
_ => {},
}
@@ -102,4 +109,4 @@ fn build_libbacktrace(_target: &str) -> Result<(), ()> {
build.compile("backtrace");
Ok(())
-}
\ No newline at end of file
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@teaclave.apache.org
For additional commands, e-mail: commits-help@teaclave.apache.org