nixpkgs/nixos/modules/services/security
Vincent Haupert b88ddadf8b nixos/intel-sgx: add option for Intel SGX DCAP compatibility
The Intel SGX DCAP driver makes the SGX application enclave device and
the SGX provisioning enclave available below the path `/dev/sgx/`. Since
Linux 5.11, a derivation of the DCAP driver is part of the kernel and
available through the X86_SGX config option; NixOS enables this option
by default.

In contrast to the out-of-tree DCAP driver, the in-tree SGX driver uses
a flat hierarchy for the SGX devices resulting in the paths
`/dev/sgx_enclave` for the application enclave device and
`/dev/sgx_provison` for the provisioning enclave device.

As of this commit, even the latest version of the Intel SGX PSW
libraries still tries to open the (legacy) DCAP paths only. This means
that SGX software currently cannot find the required SGX devices even if
the system actually supports SGX through the in-tree driver. Intel wants
to change this behavior in an upcoming release of intel/linux-sgx.

Having said that, SGX software assuming the SGX devices below
`/dev/sgx/` will prevail. Therefore, this commit introduces the NixOS
configuration option `hardware.cpu.intel.sgx.enableDcapCompat` which
creates the necessary symlinks to support existing SGX software. The
option defaults to true as it is currently the only way to support SGX
software. Also, enabling the SGX AESM service enables the option.

The permissions of the devices `/dev/sgx_enclave` and
`/dev/sgx_provison` remain the same, i.e., are not affected regardless
of having the new option enabled or not.
2022-01-11 14:02:16 +01:00
..
vaultwarden nixos/documentation: split options doc build 2022-01-02 19:46:13 +01:00
aesmd.nix nixos/intel-sgx: add option for Intel SGX DCAP compatibility 2022-01-11 14:02:16 +01:00
certmgr.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
cfssl.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
clamav.nix nixos/clamav: add settings options to replace extraConfig options 2020-12-11 19:56:08 -05:00
fail2ban.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
fprintd.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
fprot.nix nixos/fprot: add type 2021-01-28 14:12:15 -08:00
haka.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
haveged.nix nixos/modules: remove trailing whitespace 2020-08-07 14:45:39 +01:00
hockeypuck.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
hologram-agent.nix treewide: remove nand0p as maintainer 2021-05-17 01:50:49 +02:00
hologram-server.nix nixos/*: use $out instead of $bin with buildGoPackage 2020-04-28 20:30:29 +10:00
munge.nix nixos/modules: Remove all usages of types.string 2019-08-31 18:19:00 +02:00
nginx-sso.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
oauth2_proxy_nginx.nix nixos/*: add trivial defaultText for options with simple defaults 2021-12-02 22:35:04 +01:00
oauth2_proxy.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
opensnitch.nix Opensnitch: Add module 2021-09-14 18:51:23 +02:00
physlock.nix nixos/physlock: fix broken wrapper 2021-09-19 11:53:41 +02:00
privacyidea.nix nixos/privacyidea: increase buffer-size of uwsgi from 4096 to 8192 2021-12-21 00:51:45 +01:00
shibboleth-sp.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
sks.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
sshguard.nix nixos/sshguard: restart sshguard when services/backend changes 2021-04-23 16:16:37 +02:00
step-ca.nix nixos/tests: add step-ca test 2021-11-13 12:40:47 +01:00
tor.nix treewide: add defaultText for options with simple cfg.* expression defaults 2021-12-09 01:14:16 +01:00
torify.nix nixos/tsocks: Add types to the options 2020-01-05 00:15:26 +01:00
torsocks.nix nixos/*: add trivial defaultText for options with simple defaults 2021-12-02 22:35:04 +01:00
usbguard.nix nixos/doc: clean up defaults and examples 2021-10-04 12:47:20 +02:00
vault.nix treewide: add defaultText for options with simple cfg.* expression defaults 2021-12-09 01:14:16 +01:00
yubikey-agent.nix nixos/yubikey-agent add maintainer jwoudenberg 2021-10-29 23:13:50 +02:00