Edgeless RT is an SDK for Trusted Execution Environments (TEE) built on top of Open Enclave. It adds support for modern programming languages (in particular Go) and facilitates the porting of existing applications. Currently, hardware-wise, Edgeless RT focuses on Intel SGX. Support for other TEEs will follow as it becomes available in Open Enclave.
Key features of Edgeless RT are:
- Comprehensive support for Go, most existing code runs without changes
- Extended C/C++ support
- More libc and POSIX functions
- More C++17 STL
- pthread and std::thread
- libstdc++ for better compatibility with existing code
- Seamless integration with Marblerun to create distributed confidential applications
- Experimental support for Rust
- Soon: support for Python
If you're on Ubuntu 18.04 or above and don't want to build the SDK yourself, you can install the binary release:
wget -qO- https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add
sudo add-apt-repository "deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu `lsb_release -cs` main"
wget https://github.com/edgelesssys/edgelessrt/releases/download/v0.2.7/edgelessrt_0.2.7_amd64.deb
sudo apt install ./edgelessrt_0.2.7_amd64.deb build-essential libssl-dev
sudo snap install cmake --classic
Then proceed with Use.
Edgeless RT primarily targets Ubuntu 18.04 and above. Other Linuxes may work as well. Windows is not yet supported.
-
Determine the SGX support of your system
cc -ooesgx src/tools/oesgx/oesgx.c && ./oesgx
You will get one of the following three types of output:
oesgx output SGX support level CPU supports SGX_FLC:Flexible Launch Control
CPU supports Software Guard Extensions:SGX1SGX1+FLC CPU supports Software Guard Extensions:SGX1 SGX1 CPU does not support SGX Simulation -
Set up the environment
Ansible is required to install the project requirements. Install it by running:
sudo scripts/ansible/install-ansible.sh
Run one of the following commands depending on the SGX support level:
-
SGX1+FLC in an Azure Confidential Compute (ACC) VM:
ansible-playbook scripts/ansible/oe-contributors-acc-setup.yml
-
SGX1+FLC:
ansible-playbook scripts/ansible/oe-contributors-setup.yml
-
SGX1:
ansible-playbook scripts/ansible/oe-contributors-setup-sgx1.yml
-
Simulation:
ansible-playbook scripts/ansible/oe-contributors-setup-sim.yml
NOTE: The Ansible playbook commands require
sudo
rights. You may need to specify--ask-become-pass
and enter your sudo password. -
-
Build the SDK
mkdir build cd build cmake -GNinja .. ninja
To set a custom installation path (default:
/opt/edgelessrt
), add, e.g.,-DCMAKE_INSTALL_PREFIX=~/edgelessrt-install
.
After building, run the following command in the build directory to confirm everything works as expected:
ctest
In simulation mode run this command instead:
OE_SIMULATION=1 ctest
From the build directory run:
ninja install
Or if you do not have write permissions for the installation path:
sudo ninja install
To use the SDK you need to source the openenclaverc
file to setup environment variables:
. /opt/edgelessrt/share/openenclave/openenclaverc
Now you are ready to build applications with Edgeless RT! To start, check out the samples.
Also see the C API documentation and/or the Go API documentation.
Set the environment variable OE_LOG_LEVEL
to NONE
, FATAL
, ERROR
(default), WARNING
, INFO
, or VERBOSE
to increase or decrease the log level. Set OE_LOG_DETAILED=1
to enrich the log output with timestamps, thread ids, and stacktrace-like error propagations.
You can use Open Enclave's oegdb
to debug enclave code built with Edgeless RT. oegdb
is automatically installed with Edgeless RT. It also supports Go enclaves.
oegdb
works great with Visual Studio Code (vscode). For example, use the following configuration to debug the in-enclave Go code from our HashiCorp Vault sample in vscode:
{
"version": "0.2.0",
"configurations": [
{
"name": "(oegdb) Launch",
"miDebuggerPath": "/opt/edgelessrt/bin/oegdb",
"type": "cppdbg",
"request": "launch",
"program": "/opt/edgelessrt/bin/erthost",
"args": ["enclave.signed","server","-dev"],
"stopAtEntry": false,
"cwd": "${workspaceFolder}/samples/vault/build/",
"environment": [],
"externalConsole": false,
"MIMode": "gdb",
"setupCommands": [
{
"description": "Enable pretty-printing for gdb",
"text": "-enable-pretty-printing",
"ignoreFailures": true
},
{
"text": "handle SIGILL nostop"
}
]
}
]
}
Read CONTRIBUTING.md for information on issue reporting, code guidelines, and our PR process.