Re: [PATCH v20 00/28] Intel SGX1 support

[Jarkko Sakkinen]

On Wed, May 15, 2019 at 01:35:31PM +0300, Jarkko Sakkinen wrote:
> This brings me to an open question in Andy's model: lets say that we
> change the source for SIGSTRUCT from memory address to fd. How can the
> policy prevent the use not creating a file containing a SIGSTRUCT and
> passing fd of that to the EINIT ioctl?

Also wondering if a path would be better than plain fd for defining a
reasonable policy i.e. have sigstruct_path as part of the ioctl
parameters and not sigstruct_fd.

/Jarkko