From a8da3ddcfa42e81e3b37b33bddd37fb452658a2c Mon Sep 17 00:00:00 2001 From: Valentyn Faychuk Date: Sun, 6 Oct 2024 14:19:01 +0300 Subject: [PATCH] package the challenge within enclave --- rewrite/README.md | 28 ++++++++++ rewrite/scripts/Dockerfile | 4 -- rewrite/scripts/Occlum.json | 80 ++++++++++++++++++++++++++++ rewrite/scripts/challenge.Dockerfile | 5 ++ rewrite/scripts/challenge.sh | 13 +++++ rewrite/scripts/package.sh | 32 +++++++++++ rewrite/scripts/signing_key.pem | 40 ++++++++++++++ rewrite/scripts/start.sh | 12 ----- rewrite/scripts/testnet.sh | 15 +++--- rewrite/src/main.rs | 2 +- 10 files changed, 205 insertions(+), 26 deletions(-) create mode 100644 rewrite/README.md delete mode 100644 rewrite/scripts/Dockerfile create mode 100644 rewrite/scripts/Occlum.json create mode 100644 rewrite/scripts/challenge.Dockerfile create mode 100755 rewrite/scripts/challenge.sh create mode 100644 rewrite/scripts/package.sh create mode 100644 rewrite/scripts/signing_key.pem delete mode 100755 rewrite/scripts/start.sh diff --git a/rewrite/README.md b/rewrite/README.md new file mode 100644 index 0000000..bc6d457 --- /dev/null +++ b/rewrite/README.md @@ -0,0 +1,28 @@ +# Welcome to the HACKER CHALLENGE + +## Building and packaging the challenge + +The host can be without SGX support. +To build and package the challenge you will need the docker environment. +Do the following steps to build the challenge: + +```bash +# Notice that there is no SGX device mounted +docker run --rm -it -v /path/to/rewrite:/root/rewrite occlum/occlum:latest-ubuntu20.04 +# Inside the docker container do env preparation to build the image +rustup install stable-x86_64-unknown-linux-gnu +rustup default stable +rustup target add x86_64-unknown-linux-musl + +cd /root/rewrite && ./scripts/package.sh +# Feel free to exit the container once the challenge was packaged +exit +``` + +## Testing the challenge + +To test the challenge you will need the SGX support. + +## Contributing to the challenge + +Don't forget to run `cargo clippy` and `cargo fmt` before submitting a PR. \ No newline at end of file diff --git a/rewrite/scripts/Dockerfile b/rewrite/scripts/Dockerfile deleted file mode 100644 index 6e80e44..0000000 --- a/rewrite/scripts/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM alpine:edge -COPY start.sh /start.sh -COPY hacker-challenge /hacker-challenge -ENTRYPOINT ["/start.sh"] diff --git a/rewrite/scripts/Occlum.json b/rewrite/scripts/Occlum.json new file mode 100644 index 0000000..9572bb3 --- /dev/null +++ b/rewrite/scripts/Occlum.json @@ -0,0 +1,80 @@ +{ + "resource_limits": { + "kernel_space_heap_size": "32MB", + "kernel_space_stack_size": "1MB", + "user_space_size": "300MB", + "max_num_of_threads": 32 + }, + "process": { + "default_stack_size": "4MB", + "default_heap_size": "32MB", + "default_mmap_size": "100MB" + }, + "entry_points": [ + "/bin" + ], + "env": { + "default": [ + "OCCLUM=yes" + ], + "untrusted": [ + "EXAMPLE" + ] + }, + "metadata": { + "product_id": 0, + "version_number": 0, + "debuggable": false, + "enable_kss": false, + "family_id": { + "high": "0x0", + "low": "0x0" + }, + "ext_prod_id": { + "high": "0x0", + "low": "0x0" + } + }, + "feature": { + "amx": 0, + "pkru": 0, + "enable_edmm": false, + "enable_posix_shm": false + }, + "mount": [ + { + "target": "/", + "type": "unionfs", + "options": { + "layers": [ + { + "target": "/", + "type": "sefs", + "source": "./build/mount/__ROOT", + "options": { + "MAC": "" + } + }, + { + "target": "/", + "type": "sefs", + "source": "./run/mount/__ROOT" + } + ] + } + }, + { + "target": "/host", + "type": "hostfs", + "source": "." + }, + { + "target": "/proc", + "type": "procfs" + }, + { + "target": "/dev", + "type": "devfs" + } + ] +} diff --git a/rewrite/scripts/challenge.Dockerfile b/rewrite/scripts/challenge.Dockerfile new file mode 100644 index 0000000..5dcb3d4 --- /dev/null +++ b/rewrite/scripts/challenge.Dockerfile @@ -0,0 +1,5 @@ +FROM occlum/occlum:latest-ubuntu20.04 +COPY challenge.sh /challenge.sh +COPY challenge.tar.gz /challenge.tar.gz +WORKDIR / +ENTRYPOINT ["/challenge.sh"] diff --git a/rewrite/scripts/challenge.sh b/rewrite/scripts/challenge.sh new file mode 100755 index 0000000..1d00ed4 --- /dev/null +++ b/rewrite/scripts/challenge.sh @@ -0,0 +1,13 @@ +#!/bin/sh + +# This script is the entrypoint of the challenge container + +tar -xzf challenge.tar.gz && cd challenge + +if [ -z "${INIT_NODES}" ]; then + echo "The INIT_NODES environment variable is not set." +else + echo $INIT_NODES | tr ' ' '\n' > detee_challenge_nodes +fi + +occlum run /bin/hacker-challenge diff --git a/rewrite/scripts/package.sh b/rewrite/scripts/package.sh new file mode 100644 index 0000000..8a4b3b8 --- /dev/null +++ b/rewrite/scripts/package.sh @@ -0,0 +1,32 @@ +#!/bin/bash +set -e + +script_dir=$(dirname "$0") +cd "${script_dir}/.." + +occlum-cargo build --release +strip target/x86_64-unknown-linux-musl/release/hacker-challenge + +cat > challenge.yaml < /detee_challenge_nodes -fi - -/hacker-challenge diff --git a/rewrite/scripts/testnet.sh b/rewrite/scripts/testnet.sh index 1627dbc..e7236f8 100755 --- a/rewrite/scripts/testnet.sh +++ b/rewrite/scripts/testnet.sh @@ -1,15 +1,12 @@ #!/bin/bash -script_dir=$(dirname "$0") -cd "${script_dir}/.." set -e -cargo build --release --target x86_64-unknown-linux-musl -rm -rf build -mkdir -p build -cp ./target/x86_64-unknown-linux-musl/release/hacker-challenge build/ -cp scripts/start.sh build/ -cp scripts/Dockerfile build/ -cd build +# WARNING: Build and package the hacker-challenge first, see README.md + +script_dir=$(dirname "$0") +cd "${script_dir}/.." + +cp scripts/challenge.* build/ && cd build docker build -t hacker-challenge:latest . docker ps -a | grep 'hacker-challenge' | awk '{ print $NF }' | xargs docker rm -f || true diff --git a/rewrite/src/main.rs b/rewrite/src/main.rs index 86b077b..c6ce536 100644 --- a/rewrite/src/main.rs +++ b/rewrite/src/main.rs @@ -19,7 +19,7 @@ use tokio::{ time::{sleep, Duration}, }; -const INIT_NODES: &str = "detee_challenge_nodes"; +const INIT_NODES: &str = "/host/detee_challenge_nodes"; const DISK_PERSISTENCE: &str = "TRY_TO_HACK_THIS"; pub async fn localhost_cron(ds: Arc, tx: Sender) {