Question about ocall and syscall

Intel® Software Guard Extensions (Intel® SGX)

Discussion board focused on hardware-based isolation and memory encryption to provide extended code protection in solutions.

Question about ocall and syscall

261 Views

Hello,

I have a basic question about syscall and ocall.

As I know, system call is prohibited inside the enclave since the operating system is untrusted.

But the developers still can define (insecure) ocall interface, then anyhow system call can be used (indirectly).

My question is, what is the difference, in terms of security, between (1) calling the system call directly inside the enclave and (2) calling ocall function that indirectly calls system call??

The both seems equally insecure to me. What am I missing?

Thank you.

Link Copied

0 Replies

Community support is provided during standard business hours (Monday to Friday 7AM - 5PM PST). Other contact methods are available here.

Intel does not verify all solutions, including but not limited to any file transfers that may appear in this community. Accordingly, Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade.

For more complete information about compiler optimizations, see our Optimization Notice.