使用Gramine在SGX中运行含gRPC的app.py时遇权限拒绝错误

报错信息 #

Traceback (most recent call last):
  File "app.py", line 2, in <module>
    import grpc
  File "<frozen importlib._bootstrap>", line 991, in _find_and_load
  File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 844, in exec_module
  File "<frozen importlib._bootstrap_external>", line 980, in get_code
  File "<frozen importlib._bootstrap_external>", line 1037, in get_data
PermissionError: [Errno 13] Permission denied: '/usr/local/lib/python3.8/dist-packages/grpc/__init__.py'
Error in sys.excepthook:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/apport_python_hook.py", line 72, in apport_excepthook
    from apport.fileutils import likely_packaged, get_recent_crashes
  File "/usr/lib/python3/dist-packages/apport/__init__.py", line 5, in <module>
    from apport.report import Report
  File "/usr/lib/python3/dist-packages/apport/report.py", line 32, in <module>
    import apport.fileutils
  File "/usr/lib/python3/dist-packages/apport/fileutils.py", line 27, in <module>
    from apport.packaging_impl import impl as packaging
  File "/usr/lib/python3/dist-packages/apport/packaging_impl.py", line 23, in <module>
    import apt
  File "/usr/lib/python3/dist-packages/apt/__init__.py", line 36, in <module>
    apt_pkg.init_system()
apt_pkg.Error: E:Error reading the CPU table

Original exception was:
Traceback (most recent call last):
  File "app.py", line 2, in <module>
    import grpc
  File "<frozen importlib._bootstrap>", line 991, in _find_and_load
  File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 844, in exec_module
  File "<frozen importlib._bootstrap_external>", line 980, in get_code
  File "<frozen importlib._bootstrap_external>", line 1037, in get_data
PermissionError: [Errno 13] Permission denied: '/usr/local/lib/python3.8/dist-packages/grpc/__init__.py'

已排查情况 #

• 目标文件权限：-rw-r--r-- 1 root staff 82351 Dec 15 13:37 __init__.py
• 尝试用sudo运行，报错相同

解决方案 #

1. 配置Gramine Manifest文件 #

Gramine SGX enclave的文件访问权限由manifest文件独立控制，和主机系统权限无关，需手动添加gRPC包目录的访问许可：

• 找到应用对应的manifest文件（通常为python.manifest或带.template后缀的模板文件）
• 在fs.mount数组中添加gRPC包目录的挂载规则：

fs.mount = [
    # 保留原有其他挂载项
    {
        "path": "/usr/local/lib/python3.8/dist-packages/grpc",
        "uri": "file:/usr/local/lib/python3.8/dist-packages/grpc",
        "type": "gramine",
        "read_only": true
    }
]

如果有其他Python依赖包需要访问，可直接挂载整个dist-packages目录：

fs.mount = [
    # 保留原有其他挂载项
    {
        "path": "/usr/local/lib/python3.8/dist-packages",
        "uri": "file:/usr/local/lib/python3.8/dist-packages",
        "type": "gramine",
        "read_only": true
    }
]

2. 重新生成签名后的SGX Manifest #

修改完manifest后，需重新生成签名文件才能在SGX环境运行：

# 若使用模板文件，先生成完整manifest
gramine-manifest python.manifest.template python.manifest
# 生成SGX签名的manifest
gramine-sgx-sign --manifest python.manifest --output python.manifest.sgx

3. 验证Python解释器配置 #

确保manifest中指定了正确的Python路径和启动参数：

loader.argv = ["/usr/bin/python3", "app.py"]

同时确认Python自身依赖目录（如/usr/lib/python3.8）已在manifest中配置挂载。

4. 重新运行应用 #

执行以下命令启动：

gramine-sgx ./python app.py

内容的提问来源于stack exchange，提问作者sama