Intel(R) Software Guard Extensions (Intel(R) SGX) is an Intel technology for application developers seeking to protect select code and data from disclosure or modification.
The Linux* Intel(R) SGX software stack is comprised of the Intel(R) SGX driver, the Intel(R) SGX SDK, and the Intel(R) SGX Platform Software (PSW). The Intel(R) SGX SDK and Intel(R) SGX PSW are hosted in the confidential-computing.sgx project.
The Linux* kernel contains the necessary driver since the mainline kernel release 5.11. Accordingly, a driver installation is no longer necessary in Linux OSes with a newer kernel. The resulting device node is located at /dev/{sgx_enclave, sgx_provision}. Note that the platform needs to support Flexible Launch Control and it must be configured.
The intel-device-plugins-for-kubernetes project enables users to run container applications running Intel(R) SGX enclaves in Kubernetes clusters. It also gives instructions how to set up ECDSA based attestation in a cluster.
The intel-sgx-ssl project provides a full-strength general purpose cryptography library for Intel(R) SGX enclave applications. It is based on the underlying OpenSSL* Open Source project. Intel(R) SGX provides a build combination to build out a SGXSSL based SDK as below. Users could also utilize this cryptography library in SGX enclave applications seperately.
See License.txt for details.
See CONTRIBUTING.md for details.
$ cd docker/build && ./build_compose_run.sh
$ cd linux/installer/docker && ./build_compose_run.sh
Ensure that you have one of the following required operating systems:
Use the following command(s) to install the required tools to build the Intel(R) SGX SDK:
$ sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python3 libssl-dev git cmake perl
$ sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
$ sudo apt-get install build-essential ocaml ocamlbuild automake autoconf libtool wget python-is-python3 libssl-dev git cmake perl
$ sudo yum groupinstall 'Development Tools'
$ sudo yum install ocaml ocaml-ocamlbuild wget python3 openssl-devel git cmake perl
$ sudo dnf group install 'Development Tools'
$ sudo dnf install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel wget rpm-build git cmake perl python3
$ sudo dnf group install 'Development Tools'
$ sudo dnf --enablerepo=powertools install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel wget rpm-build git cmake perl python3
$ sudo alternatives --set python /usr/bin/python3
$ sudo dnf group install 'Development Tools'
$ sudo dnf install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel wget rpm-build git cmake perl python3
$ sudo zypper install --type pattern devel_basis
$ sudo zypper install ocaml ocaml-ocamlbuild automake autoconf libtool wget python3 libopenssl-devel rpm-build git cmake perl
$ sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
Note: To build Intel(R) SGX SDK, gcc version is required to be 7.3 or above and glibc version is required to be 2.27 or above.
Use the following command to install additional required tools and latest Intel(R) SGX SDK Installer to build the Intel(R) SGX PSW:
$ sudo apt-get install libssl-dev libcurl4-openssl-dev protobuf-compiler libprotobuf-dev debhelper cmake reprepro unzip pkgconf libboost-dev libboost-system-dev libboost-thread-dev lsb-release libsystemd0
$ sudo apt-get install libssl-dev libcurl4-openssl-dev protobuf-compiler libprotobuf-dev debhelper cmake reprepro unzip pkgconf libboost-dev libboost-system-dev libboost-thread-dev lsb-release libsystemd0
$ sudo yum install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel systemd-libs
$ sudo dnf install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel systemd-libs
$ sudo dnf --enablerepo=PowerTools install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel systemd-libs
$ sudo dnf --enablerepo=powertools install openssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo yum-utils pkgconf boost-devel protobuf-lite-devel systemd-libs
$ sudo zypper install libopenssl-devel libcurl-devel protobuf-devel cmake rpm-build createrepo_c libsystemd0 libboost_system1_66_0-devel libboost_thread1_66_0-devel
Download the source code and prepare the submodules and prebuilt binaries:
$ git clone https://github.com/intel/confidential-computing.sgx.git sgx-source
$ cd sgx-source && make preparation
The above make preparation would:
download_prebuilt.sh to download the prebuilt binaries. You may need to set an https proxy for the wget tool used by the script (such as export https_proxy=http://test-proxy:test-port).[!NOTE]
When pulling a new release, run
make distcleanif patched submodules changed. This will deinit all submodules and prevent patch conflicts like:error: Your local changes to the following files would be overwritten by checkout.$ make distclean
$ sudo cp external/toolset/{current_distr}/* /usr/local/bin
$ which ar as ld objcopy objdump ranlib
[!NOTE] After pulling a new release, run
make distcleanandmake preparationagain to update changed submodules.
$ make sdk
You can find the three flavors of tools and libraries generated in the build directory.
USE_OPT_LIBS=0 --- build SDK using SGXSSL and open sourced String/MathUSE_OPT_LIBS=1 --- build SDK using optimized IPP crypto and open sourced String/MathUSE_OPT_LIBS=2 --- build SDK with no mitigation using SGXSSL and optimized String/MathUSE_OPT_LIBS=3 --- build SDK with no mitigation using IPP crypto and optimized String/Math The default build uses USE_OPT_LIBS=1, if you directly type $ make sdk as above. You can switch to the other build combinations instead by entering the following command: $ make sdk USE_OPT_LIBS=0
or
$ make sdk_no_mitigation USE_OPT_LIBS=2
or
$ make sdk_no_mitigation USE_OPT_LIBS=3
Note: Building the Intel(R) SGX PSW with open sourced SGXSSL/string/math libraries is not supported. Note: Building mitigation SDK with USE_OPT_LIBS=2 or USE_OPT_LIBS=3 is not allowed.
$ make sdk DEBUG=1
make sdk command, enter the following command: $ make clean
$ make sdk_install_pkg
You can find the generated Intel(R) SGX SDK installer sgx_linux_x64_sdk_${version}.bin located under linux/installer/bin/, where ${version} refers to the version number.
Note: The above command builds the Intel(R) SGX SDK with default configuration firstly and then generates the target SDK Installer. To build the Intel(R) SGX SDK Installer with debug information kept in the tools and libraries, enter the following command:
$ make sdk_install_pkg DEBUG=1
$ make psw
You can find the tools and libraries generated in the build/linux directory. Note: You can also go to the psw folder and use the make command to build the Intel(R) SGX PSW component only.
$ make psw DEBUG=1
make psw command, enter the following command: $ make clean
The build above uses prebuilt Intel(R) Architecture Enclaves(LE/PCE) - the files psw/ae/data/prebuilt/libsgx_*.signed.so, which have been signed by Intel in advance.
make command from the corresponding folder: $ cd psw/ae/le
$ make
To build the Intel(R) SGX PSW installer, enter the following command:
$ make deb_psw_pkg
You can find the generated Intel(R) SGX PSW installers located under linux/installer/deb/libsgx-urts, linux/installer/deb/libsgx-enclave-common, linux/installer/deb/libsgx-uae-service, linux/installer/deb/libsgx-quote-ex and linux/installer/deb/sgx-aesm-service respectively.
Note: Besides the Intel(R) SGX PSW installer, the above command generates another debug symbol package named package-name-dbgsym_${version}-${revision}_amd64.ddeb for debug purpose. Note: Starting with the 2.10 release, besides the Intel(R) SGX PSW installer, the above command generates SGXDataCenterAttestationPrimitives installers as well. Note: On Debian 10, the default PATH environment may not include /sbin. In this case, before trigger the build, please add /sbin to PATH environment by export PATH=$PATH:/sbin. Note: The above command builds the Intel(R) SGX PSW with default configuration firstly and then generates the target PSW Installer. To build the Intel(R) SGX PSW Installer without optimization and with full debug information kept in the tools and libraries, enter the following command:
$ make deb_psw_pkg DEBUG=1
$ make rpm_psw_pkg
You can find the generated Intel(R) SGX PSW installers located under linux/installer/rpm/libsgx-urts, linux/installer/rpm/libsgx-enclave-common, linux/installer/rpm/libsgx-uae-service, linux/installer/rpm/libsgx-quote-ex and linux/installer/rpm/sgx-aesm-service respectively.
Note: The above command builds the Intel(R) SGX PSW with default configuration firstly and then generates the target PSW Installer. To build the Intel(R) SGX PSW Installer with debug information kept in the tools and libraries, enter the following command:
$ make rpm_psw_pkg DEBUG=1
To build local Debian package repository, enter the following command:
$ make deb_local_repo
You can find the local package repository located under linux/installer/deb/sgx_debian_local_repo.
Note: The above command builds the local package repository. If you want to use it, you need to add it to the system repository configuration. The local package repository is not signed, you need to trust it for the purpose of development.
To add the local Debian package repository to the system repository configuration, append the following line to /etc/apt/sources.list. You need to replace PATH_TO_LOCAL_REPO with the proper path on your system:
deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO focal main
deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO jammy main
deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO noble main
deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO buster main
deb [trusted=yes arch=amd64] file:/PATH_TO_LOCAL_REPO bookworm main
After that, you need to update the apt:
$ sudo apt update
To build local RPM package repository, enter the following command:
$ make rpm_local_repo
You can find the local package repository located under linux/installer/rpm/sgx_rpm_local_repo.
Note: The above command builds the local package repository. If you want to use it, you need to add it to the system repository configuration. Since the local package repository is not signed with GPG, you should ignore the gpgcheck when installing the packages.
To add the local RPM package repository to the system repository configuration, you can use the following command. You need to replace PATH_TO_LOCAL_REPO with the proper path on your system:
$ sudo dnf config-manager --add-repo file://PATH_TO_LOCAL_REPO
$ sudo zypper addrepo PATH_TO_LOCAL_REPO LOCAL_REPO_ALIAS
To ignore the gpgcheck when you install the package, enter the following command:
$ sudo yum --nogpgcheck install <package>
$ sudo zypper --no-gpg-checks install <package>
$ sudo apt-get install build-essential python3
$ sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
$ sudo apt-get install build-essential python-is-python3
$ sudo yum groupinstall 'Development Tools'
$ sudo yum install python3
$ sudo yum groupinstall 'Development Tools'
$ sudo yum install python3
$ sudo alternatives --set python /usr/bin/python3
$ sudo zypper install --type pattern devel_basis
$ sudo zypper install python3
$ sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
To install the Intel(R) SGX SDK, invoke the installer, as follows:
$ cd linux/installer/bin
$ ./sgx_linux_x64_sdk_${version}.bin
The above command requires you to specify the installation path. You can use the following command to use the non-interactive installation mode:
$ cd linux/installer/bin
$ ./sgx_linux_x64_sdk_${version}.bin --prefix {SDK_INSTALL_PATH_PREFIX}
NOTE: You need to set up the needed environment variables before compiling your code. To do so, run:
$ source ${sgx-sdk-install-path}/environment
$ cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation
$ make SGX_MODE=SIM
$ cd bin
$ ./app
Use similar commands for other sample codes.
If you use an Intel SGX hardware enabled machine, you can run the code samples in Hardware mode. Ensure that your machine is running a Linux* kernel with SGX driver support[^in-kernel-driver-info-note] and that Intel(R) SGX PSW is installed on the system. See the later topic, Install Intel(R) SGX PSW, for information on how to install the PSW package.
[^in-kernel-driver-info-note]: The Linux* kernel contains the necessary driver since the mainline kernel release 5.11.
$ cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation
$ make
$ cd bin
$ ./app
Use similar commands for other code samples. Note: On Ubuntu 22.04 or any distro with systemd v248 or later, /dev/sgx_enclave is only accessible by users in the group "sgx". The enclave app should be run with a uid in the sgx group.
# check systemd version:
$ systemctl --version
# add sgx group to user if it's 248 or above:
$ sudo usermod -a -G sgx <user name>
$ sudo apt-get install libssl-dev libcurl4-openssl-dev libprotobuf-dev
$ sudo yum install openssl-devel libcurl-devel protobuf-devel
$ sudo dnf install libcurl-devel protobuf-devel
$ sudo dnf --enablerepo=PowerTools install libcurl-devel protobuf-devel
$ sudo dnf --enablerepo=powertools install libcurl-devel protobuf-devel
$ sudo zypper install libopenssl-devel libcurl-devel protobuf-devel
The SGX PSW provides enclave creation service and algorithm agnostic attestation. Starting with the 2.8 release, the SGX PSW is split into smaller packages and the user can choose which features and services to install. There are 2 methods to install the required packages: Using individual packages or using the local repo generated by the build system. Using the local repo is recommended since the system will resolve the dependencies automatically. Currently, we support .deb and .rpm based repos.
[!NOTE]
Starting in release 2.28 of the PSW, all legacy EPID-based functionality has been removed. This includes legacy QE/PVE-based provisioning and attestation as well as platform services (PSE). The legacy (whitelist-based) launch control functionality as well as support facilities for the deprecated [ref1], [ref2] out-of-tree Linux kernel drivers have been removed.
| Ubuntu 22.04, Ubuntu 24.04, Debian 10 and Debian 12 | Red Hat Enterprise Linux 9.4 and 10.0, CentOS Stream 9 and 10, Anolis OS 8.10, and Azure Linux 3.0 | SUSE Linux Enterprise Server 15 | |
|---|---|---|---|
| launch service | apt-get install libsgx-urts | yum install libsgx-urts | zypper install libsgx-urts |
| algorithm agnostic attestation service | apt-get install libsgx-quote-ex libsgx-urts | yum install libsgx-quote-ex libsgx-urts | zypper install libsgx-quote-ex libsgx-urts |
| DCAP ECDSA-based service | apt-get install libsgx-dcap-ql | yum install libsgx-dcap-ql | zypper install libsgx-dcap-ql |
Optionally, you can install *-dbgsym or *-debuginfo packages to get the debug symbols, and install *-dev or *-devel packages to get the header files for development.
Please refer Intel_SGX_Installation_Guide_Linux for detail.
Sometimes we will split old package into smaller ones or move file between different packages. In such cases, you will encounter error messages like: "dpkg: error processing archive ....(--unpack): trying to overwrite ...". You can use 2 methods to address it.
-o Dpkg::Options::="--force-overwrite" option to overwrite existing files and use “dist-upgrade” instead of "upgrade" to install new packages when upgrading. In short, you should use this command:apt-get dist-upgrade -o Dpkg::Options::="--force-overwrite"
Some packages are configured with recommended dependency on other packages that are not required for certain usage. For instance, the background daemon is not required for container usage. It will be installed by default, but you can drop it by using the additional option during the installation.
--no-install-recommends
--setopt=install_weak_deps=False
--no-recommends
To enable ECDSA attestation
Ensure that you have the following required hardware:
Install Quote Provider Library(QPL). You can use your own customized QPL or use default QPL provided by Intel(libsgx-dcap-default-qpl)
Install PCK Caching Service. For how to install and configure PCK Caching Service, please refer to SGXDataCenterAttestationPrimitives
Ensure the PCK Caching Service is setup correctly by local administrator or data center administrator. Also make sure that the configure file of quote provider library (/etc/sgx_default_qcnl.conf) is consistent with the real environment, for example: PCS_URL=https://your_pcs_server:8081/sgx/certification/v1/
The Intel(R) SGX PSW installer installs an aesmd service in your machine, which is running in a special linux account aesmd. To stop the service: $ sudo service aesmd stop To start the service: $ sudo service aesmd start To restart the service: $ sudo service aesmd restart
The aesmd service uses the HTTP protocol to initialize some services. If a proxy is required for the HTTP protocol, you may need to manually set up the proxy for the aesmd service. You should manually edit the file /etc/aesmd.conf (refer to the comments in the file) to set the proxy for the aesmd service. After you configure the proxy, you need to restart the service to enable the proxy.
Intel(R) SGX is providing several prebuilt binaries. All the prebuilt binaries are built from a reproducible environment in SGX docker container. To reproduce the prebuilt binaries, please follow the reproducibility README.md to prepare the SGX docker container and build out the binaries you want to verify. Most of the binaries could be verified utilizing Linux system command diff, except Intel(R) AEs. Please refer to the README.md for how to verify the reproducibililty of the built out AEs.