Question about ocall and syscall

park__minkyung — Wed, 07 Aug 2019 05:05:29 GMT

Hello,

I have a basic question about syscall and ocall.

As I know, system call is prohibited inside the enclave since the operating system is untrusted.

But the developers still can define (insecure) ocall interface, then anyhow system call can be used (indirectly).

My question is, what is the difference, in terms of security, between (1) calling the system call directly inside the enclave and (2) calling ocall function that indirectly calls system call??

The both seems equally insecure to me. What am I missing?

Thank you.

topic Question about ocall and syscall in Intel Confidential Computing

Question about ocall and syscall