[PATCH] samples: nitro_enclaves: reject invalid boot heartbeat

[PATCH] samples: nitro_enclaves: reject invalid boot heartbeat

[Avi Weiss]

ne_start_enclave_check_booted() expects zero on success and a negative
return value on failure. However, when the received heartbeat is incorrect
or the connection closes before sending one, it returns the result of
read() unchanged.

An incorrect heartbeat therefore returns 1, while EOF returns 0. The caller
treats both nonnegative values as successful enclave boot verification.

Return -EINVAL through the existing cleanup path when heartbeat
validation fails.

Although this is sample code, it demonstrates enclave boot verification and
may be copied or adapted into real enclave-management applications. Better
to correct the example to avoid propagating this false-success behavior
into real implementations.

Amazon's standalone Nitro Enclaves kernel driver does not implement
heartbeat verification. The Nitro Enclaves CLI implements this check
separately in Rust and there I believe it correctly rejects invalid or
missing heartbeats.

Fixes: acc4229c39903 ("nitro_enclaves: Add sample for ioctl interface usage")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
diff --git a/samples/nitro_enclaves/ne_ioctl_sample.c b/samples/nitro_enclaves/ne_ioctl_sample.c
index 765b131c73190..a620f81581c2b 100644
--- a/samples/nitro_enclaves/ne_ioctl_sample.c
+++ b/samples/nitro_enclaves/ne_ioctl_sample.c
@@ -744,6 +744,7 @@ static int ne_start_enclave_check_booted(int enclave_fd)
 		printf("Read %d instead of %d\n", recv_buf,
 		       NE_IMAGE_LOAD_HEARTBEAT_VALUE);
 
+		rc = -EINVAL;
 		goto out;
 	}