system("Command") inside the enclave

SAM_R_2 — Thu, 08 Sep 2016 06:21:19 GMT

Hi,

We should not use system("Command") inside the enclave.

Can we use wget,CuraEngine or " powershell -command "& { (New-Object Net.WebClient).DownloadFile('http://myUrl', 'C:\path\to\test.json')}" " like commands directly inside the enclave.

Usually we keep eclaveWrapper files in enclave_definition folder. Can we run the above commands in eclaveWrapper files which is different than the enclave_application folder. if we follow this process can we make sure about the safety of the files.

Thanks & Regards,

As a general statement, IO is

Francisco_C_Intel — Thu, 08 Sep 2016 16:38:58 GMT

As a general statement, IO is not supported inside an enclave - you have to make OCALLs.

If your enclave makes an OCALL to the untrusted part of your application, and in the untrusted part of your application you decide to make any of the IO calls you mentioned, then this "will work" from a "is this possible" perspective.

As you mentioned, it would be up to you to verify that whatever data you obtained (via wget, powershell, etc) is data that you trust and want to pass back to the enclave. Furthermore, an attacker may view or modify the data sometime between the time you received it and the time you sent it to the enclave. You would have to protect against that as well.

topic system("Command") inside the enclave in Intel® Software Guard Extensions (Intel® SGX)

system("Command") inside the enclave

As a general statement, IO is