Google Git
Sign in
chromium/external/github.com/project-oak/oak/refs/heads/upstream/native-sdk
commit
200398e04504d7d40f729bf8afcade6a7a3a773c
[log]
author
Livia Seibert <livseibert@gmail.com>
Fri Feb 09 20:18:42 2024
committer
Livia Seibert <livseibert@gmail.com>
Fri Feb 09 20:18:42 2024
tree
8cd49ea11f72636544c12c1921aad8508f44ae57
parent
30bf35943e90e815c649148be632c15172dacba1 [diff]
parent
02ea385d1fef7eab91b1f86c320b3743b30b87e5 [diff]
Make uint8 const and add comments
tree: 8cd49ea11f72636544c12c1921aad8508f44ae57
  1. .cargo/
  2. .config/
  3. .github/
  4. bazel/
  5. buildconfigs/
  6. cc/
  7. chrome_extension/
  8. docs/
  9. enclave_apps/
  10. fuzz/
  11. java/
  12. kokoro/
  13. linux_boot_params/
  14. micro_rpc/
  15. micro_rpc_build/
  16. micro_rpc_tests/
  17. micro_rpc_workspace_test/
  18. oak_attestation/
  19. oak_attestation_verification/
  20. oak_channel/
  21. oak_client/
  22. oak_containers/
  23. oak_containers_hello_world_container/
  24. oak_containers_hello_world_trusted_app/
  25. oak_containers_hello_world_untrusted_app/
  26. oak_containers_kernel/
  27. oak_containers_launcher/
  28. oak_containers_orchestrator/
  29. oak_containers_sdk/
  30. oak_containers_stage1/
  31. oak_containers_syslogd/
  32. oak_containers_system_image/
  33. oak_core/
  34. oak_crypto/
  35. oak_dice/
  36. oak_docker_linux_init/
  37. oak_echo_linux_init/
  38. oak_enclave_runtime_support/
  39. oak_functions/
  40. oak_functions_abi/
  41. oak_functions_client/
  42. oak_functions_containers_app/
  43. oak_functions_containers_container/
  44. oak_functions_containers_launcher/
  45. oak_functions_enclave_service/
  46. oak_functions_launcher/
  47. oak_functions_sdk/
  48. oak_functions_service/
  49. oak_functions_test_module/
  50. oak_functions_test_utils/
  51. oak_grpc_unary_attestation/
  52. oak_grpc_utils/
  53. oak_hello_world_linux_init/
  54. oak_launcher_utils/
  55. oak_minirootfs_linux_init/
  56. oak_ml_transparency/
  57. oak_proto_rust/
  58. oak_restricted_kernel/
  59. oak_restricted_kernel_bin/
  60. oak_restricted_kernel_dice/
  61. oak_restricted_kernel_interface/
  62. oak_restricted_kernel_launcher/
  63. oak_restricted_kernel_orchestrator/
  64. oak_restricted_kernel_sdk/
  65. oak_restricted_kernel_sdk_proc_macro/
  66. oak_restricted_kernel_wrapper/
  67. oak_sev_guest/
  68. oak_sev_snp_attestation_report/
  69. oak_simple_io/
  70. oak_tdx_guest/
  71. oak_virtio/
  72. proto/
  73. rfcs/
  74. scripts/
  75. sev_serial/
  76. snp_measurement/
  77. stage0/
  78. stage0_bin/
  79. stage0_dice/
  80. testing/
  81. third_party/
  82. xtask/
  83. .bazelrc
  84. .clang-format
  85. .clang-tidy
  86. .codecov.yml
  87. .devcontainer.json
  88. .dockerignore
  89. .envrc
  90. .gitignore
  91. .hadolint.yaml
  92. .markdownlint.yaml
  93. .prettierrc.yaml
  94. .rustfmt.toml
  95. .tsan_suppress
  96. .xtask_bash_completion
  97. AUTHORS
  98. BUILD
  99. Cargo.lock
  100. Cargo.toml
  101. cloudbuild.yaml
  102. deny.toml
  103. Dockerfile
  104. empty
  105. flake.lock
  106. flake.nix
  107. FORCE_CI
  108. justfile
  109. LICENSE
  110. README.md
  111. WORKSPACE
README.md

Build Status Docs

The goal of Project Oak is to provide infrastructure to transfer, store and process sensitive user data in a secure and transparent way.

To do so, Oak relies on running a Trusted Application in a Trusted Execution Environment (TEE). An example of a Trusted Application is Oak Functions. The Trusted Application can provide the client cryptographically attested evidence of the executable state of the TEE through Remote Attestation. Together with Transparent Release this binds the open-source source code to the remotely attested binary running inside the TEE. In order to feasibly review all the source code running inside the TEE, and minimize our trusted computing base, Oak provides the following infrastructure: stage 0, Oak Restricted Kernel and controlled communications interfaces, i.e., the Oak Comms Channel and microRPC.

Parties involved

  • Trusted Application Authors: The authors writing the Trusted Application running on Oak Infrastructure.
  • Oak Infrastructure Authors: The authors of the code in this repository; mostly this corresponds to the Project Oak team, but also any contributors, and, by extension, the authors of third party dependencies used in Oak.
  • Platform Provider: The entity in charge of maintaining and running the combined hardware and software stack surrounding the TEE, for instance a cloud provider; this includes their software, hardware, and employees.
  • TEE Manufacturer: The entity in charge of manufacturing the TEE, including hardware, software, and cryptographic keys.

Threat Model

  • untrusted:
    • most hardware (memory, disk, motherboard, network card, external devices)
    • Platform Provider
    • Host Operating System (kernel, drivers, libraries, applications)
    • Hypervisor / VMM
  • trusted-but-transparent
    • Oak Infrastructure Authors
    • Trusted Application Authors
  • trusted:
    • TEE Manufacturer

Side channels are out of scope for Project Oak at present. While we acknowledge that TEEs cannot defend against all possible attacks (and therefore we do need resistance to side channels) we leave their resolution to the respective TEE Manufacturers and other researchers.

Getting involved

We welcome contributors! To join our community, we recommend joining the mailing list and the slack.

Oak development covers practical steps for getting a development Oak system up and running.