On 11/12/20 12:58 PM, Dr. Greg wrote:
> @@ -270,11 +270,10 @@ static int sgx_vma_mprotect(struct vm_area_struct *vma,
> struct vm_area_struct **pprev, unsigned long start,
> unsigned long end, unsigned long newflags)
> {
> - int ret;
> + struct sgx_encl *encl = vma->vm_private_data;
>
> - ret = sgx_encl_may_map(vma->vm_private_data, start, end, newflags);
> - if (ret)
> - return ret;
> + if ( test_bit(SGX_ENCL_INITIALIZED, &encl->flags) )
> + return -EACCES;
>
> return mprotect_fixup(vma, pprev, start, end, newflags);
> }
This rules out mprotect() on running enclaves. Does that break any
expectations from enclave authors, or take away capabilities that folks
need?
