intel / intel/confidential-computing.tee.dcap

Questionable symlink for PCKIDRetrievalTool

Open
#151 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
326
Forks
198
PR merge metrics
No merged PRs in 30d

Description

Installation of PCKIDRetrievalTool RPM package creates a symlink:

ln -s /opt/intel/sgx-pck-id-retrieval-tool/PCKIDRetrievalTool /usr/local/bin/PCKIDRetrievalTool

However PCKIDRetrievalTool needs to be run with "sudo" (not really documented either) , otherwise one gets permission errors, such as:

Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.9.100.3

ERROR: writeUEFIVar: failed to re-open uefi variable /sys/firmware/efi/efivars/SgxRegistrationStatus-f236c5dc-a491-4bbe-bcdd-88885770df45, error: Permission denied
ERROR: setRegistrationStatus: failed to write uefi variable.
Warning: error happens when set registration status, the error code is: 4
Warning: could NOT set the Registration Status to completed status.
the data has been sent to cache server successfuly and retrieval_result1.csv has been generated successfully!

But when running with "sudo", it is common for PATH **not** to contain /usr/local/bin, which makes the symlink useless.
The following symlink would make more sense:

ln -s /opt/intel/sgx-pck-id-retrieval-tool/PCKIDRetrievalTool /usr/bin/PCKIDRetrievalTool

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.