Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1396606

Re: [PATCH 0/6] Intel Secure Guard Extensions

Show all headers | View raw

On Mon, 9 May 2016, Jarkko Sakkinen wrote:
> On Fri, May 06, 2016 at 01:54:14PM +0200, Thomas Gleixner wrote:
> > On Fri, 6 May 2016, Jarkko Sakkinen wrote:
> > 
> > > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> > > > It would be helpful and instructive for anyone involved in this debate
> > > > to review the following URL which details Intel's SGX licening
> > > > program:
> > > > 
> > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing
> > > 
> > > I think it would be good  to note that the licensing process is available
> > > only for Windows. For Linux you can only use debug enclaves at the
> > > moment. The default LE has "allow-all" policy for debug enclaves.
> > 
> > Which makes the feature pretty useless.
> >  
> > > > I think the only way forward to make all of this palatable is to
> > > > embrace something similar to what has been done with Secure Boot.  The
> > > > Root Enclave Key will need to be something which can be reconfigured
> > > > by the Platform Owner through BIOS/EFI.  That model would take Intel
> > > > off the hook from a security perspective and establish the notion of
> > > > platform trust to be a bilateral relationship between a service
> > > > provider and client.
> > > 
> > > This concern has been raised many times now. Sadly this did not make
> > > into Skyle but in future we will have one shot MSRs (can be set only
> > > once per boot cycle) for defining your own root of trust.
> > 
> > We'll wait for that to happen.
> 
> I fully understand if you (and others) want to keep this standpoint but
> what if we could get it to staging after I've revised it with suggested

This should not go to staging at all. Either this is going to be a real useful
driver or we just keep it out of tree.

> changes and internal changes in my TODO? Then it would not pollute the
> mainline kernel but still would be easily available for experimentation.

How are we supposed to experiment with that if there is no launch enclave for
Linux available?

Thanks,

	tglx

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-04-29 22:20 +0200
  Re: [PATCH 0/6] Intel Secure Guard Extensions "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-05-02 17:40 +0200
    Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-03 11:30 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-03 17:40 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-04 11:10 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-04 13:10 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 13:40 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions Thomas Gleixner <tglx@linutronix.de> - 2016-05-06 14:00 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 07:40 +0200
            Re: [PATCH 0/6] Intel Secure Guard Extensions Thomas Gleixner <tglx@linutronix.de> - 2016-05-09 08:30 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 11:30 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-12 11:00 +0200
            Re: [PATCH 0/6] Intel Secure Guard Extensions Greg KH <gregkh@linuxfoundation.org> - 2016-05-09 09:10 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 11:20 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-08 12:00 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Andy Lutomirski <luto@amacapital.net> - 2016-05-09 03:40 +0200
    Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 01:00 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-06 09:20 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 13:30 +0200

csiph-web