Re: [PATCH 0/6] Intel Secure Guard Extensions

From	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 0/6] Intel Secure Guard Extensions
Date	2016-05-09 11:20 +0200
Message-ID	<rwPw6-2op-19@gated-at.bofh.it> (permalink)
References	(4 earlier) <ruEOu-5yj-15@gated-at.bofh.it> <rvMgX-466-27@gated-at.bofh.it> <rvMAi-4gY-17@gated-at.bofh.it> <rwM5b-6dE-5@gated-at.bofh.it> <rwNuh-87C-3@gated-at.bofh.it>
Organization	Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo

Show all headers | View raw

On Mon, May 09, 2016 at 09:04:09AM +0200, Greg KH wrote:
> On Mon, May 09, 2016 at 08:38:25AM +0300, Jarkko Sakkinen wrote:
> > On Fri, May 06, 2016 at 01:54:14PM +0200, Thomas Gleixner wrote:
> > > On Fri, 6 May 2016, Jarkko Sakkinen wrote:
> > > 
> > > > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> > > > > It would be helpful and instructive for anyone involved in this debate
> > > > > to review the following URL which details Intel's SGX licening
> > > > > program:
> > > > > 
> > > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing
> > > > 
> > > > I think it would be good  to note that the licensing process is available
> > > > only for Windows. For Linux you can only use debug enclaves at the
> > > > moment. The default LE has "allow-all" policy for debug enclaves.
> > > 
> > > Which makes the feature pretty useless.
> > >  
> > > > > I think the only way forward to make all of this palatable is to
> > > > > embrace something similar to what has been done with Secure Boot.  The
> > > > > Root Enclave Key will need to be something which can be reconfigured
> > > > > by the Platform Owner through BIOS/EFI.  That model would take Intel
> > > > > off the hook from a security perspective and establish the notion of
> > > > > platform trust to be a bilateral relationship between a service
> > > > > provider and client.
> > > > 
> > > > This concern has been raised many times now. Sadly this did not make
> > > > into Skyle but in future we will have one shot MSRs (can be set only
> > > > once per boot cycle) for defining your own root of trust.
> > > 
> > > We'll wait for that to happen.
> > 
> > I fully understand if you (and others) want to keep this standpoint but
> > what if we could get it to staging after I've revised it with suggested
> > changes and internal changes in my TODO? Then it would not pollute the
> > mainline kernel but still would be easily available for experimentation.
> 
> No, staging is not a "dumping ground", it's for code that is not ready
> to be merged, and has some work left to do on it and it shows forward
> progress on that goal.  I don't put things in there that the maintainers
> of the subsystems it affects do not want merged.  See the many previous
> examples of code that has been rejected for staging as examples of this.
> 
> sorry,

NP, point taken.

> greg k-h

/Jarkko

Thread

Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-04-29 22:20 +0200
  Re: [PATCH 0/6] Intel Secure Guard Extensions "Austin S. Hemmelgarn" <ahferroin7@gmail.com> - 2016-05-02 17:40 +0200
    Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-03 11:30 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-03 17:40 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-04 11:10 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-04 13:10 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 13:40 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions Thomas Gleixner <tglx@linutronix.de> - 2016-05-06 14:00 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 07:40 +0200
            Re: [PATCH 0/6] Intel Secure Guard Extensions Thomas Gleixner <tglx@linutronix.de> - 2016-05-09 08:30 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 11:30 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-12 11:00 +0200
            Re: [PATCH 0/6] Intel Secure Guard Extensions Greg KH <gregkh@linuxfoundation.org> - 2016-05-09 09:10 +0200
              Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-09 11:20 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions "Dr. Greg Wettstein" <greg@enjellic.com> - 2016-05-08 12:00 +0200
          Re: [PATCH 0/6] Intel Secure Guard Extensions Andy Lutomirski <luto@amacapital.net> - 2016-05-09 03:40 +0200
    Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 01:00 +0200
      Re: [PATCH 0/6] Intel Secure Guard Extensions Pavel Machek <pavel@ucw.cz> - 2016-05-06 09:20 +0200
        Re: [PATCH 0/6] Intel Secure Guard Extensions Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2016-05-06 13:30 +0200

csiph-web