This document provides a brief overview of how to start exploring the Open Enclave SDK once you have it installed.
By default, the Open Enclave SDK is installed to /opt/openenclave. It contains the following subfolders:
| Path | Description |
|---|---|
| bin | Developer tools such as oe-gdb for debugging and oesign for signing your enclaves. |
| include/openenclave | Open Enclave runtime headers for use in your enclave (enclave.h) and its host (host.h). |
| include/openenclave/3rdparty | Headers for libc, libcxx and mbedlts libraries for use inside the enclave. See the API Reference section for supported functions. |
| lib/openenclave/enclave | Libraries for linking into the enclave, including the libc, libcxx and mbedtls libraries for Open Enclave. |
| lib/openenclave/host | Library for linking into the host process of the enclave. |
| lib/openenclave/debugger | Libraries used by the gdb plug-in for debugging enclaves. |
| share/openenclave/samples | Sample code showing how to use the Open Enclave SDK. |
| share/pkgconfig | Pkg-config files for header and library includes when building Open Enclave apps. |
For ease of development, we recommend adding:
- Open Enclave SDK
pkgconfigfolder toPKG_CONFIG_PATH - Open Enclave SDK
binfolder toPATH
You can do this by sourcing the openenclaverc file that is distributed with the SDK:
source /opt/openenclave/share/openenclave/openenclavercA simple way to determine if your machine is correctly configured to build and run Open Enclave apps is to execute the samples:
cp -r /opt/openenclave/share/openenclave/samples ~
cd ~/samples
make worldA description of all the included samples and what each one illustrates can be found in share/openenclave/samples/README.md.
Additional documentation is also available for:
One of the security principles of writing enclave applications is to minimize the Trusted Computing Base (TCB) of the enclave code. A consequence of this is that while the host application has full access to the range of libraries and API available to all normal mode applications, the enclave is restricted to a much more constrained set as described below:
The Doxygen documentation of the API exposed by Open Enclave SDK to both enclave and host.
The subset of libc functionality provided by oelibc for use inside an enclave.
The subset of libcxx functionality provided by oelibcxx for use inside an enclave.
The subset of mbedtls functionality for use inside an enclave.