intel / intel/confidential-computing.tee.dcap
Questionable symlink for PCKIDRetrievalTool
- Dominant language
- C
- Stars
- 326
- Forks
- 198
- PR merge metrics
- No merged PRs in 30d
Description
Installation of PCKIDRetrievalTool RPM package creates a symlink:
ln -s /opt/intel/sgx-pck-id-retrieval-tool/PCKIDRetrievalTool /usr/local/bin/PCKIDRetrievalTool
However PCKIDRetrievalTool needs to be run with "sudo" (not really documented either) , otherwise one gets permission errors, such as:
Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.9.100.3ERROR: writeUEFIVar: failed to re-open uefi variable /sys/firmware/efi/efivars/SgxRegistrationStatus-f236c5dc-a491-4bbe-bcdd-88885770df45, error: Permission denied
ERROR: setRegistrationStatus: failed to write uefi variable.
Warning: error happens when set registration status, the error code is: 4
Warning: could NOT set the Registration Status to completed status.
the data has been sent to cache server successfuly and retrieval_result1.csv has been generated successfully!
But when running with "sudo", it is common for PATH **not** to contain /usr/local/bin, which makes the symlink useless.
The following symlink would make more sense:
ln -s /opt/intel/sgx-pck-id-retrieval-tool/PCKIDRetrievalTool /usr/bin/PCKIDRetrievalTool
Contributor guide
Assessment
This issue has not been assessed yet.