use LVI mitigation when building enclave (#412)

* use LVI mitigation when building enclave

This is done by setting the env variable MITIGATION-CVE-2020-0551 to LOAD
#373.
The Makefile has been updated to match the templates from teaclave's samplecode

* Fix minor typo in buildenv.mk

.github/workflows/build_and_test.yml

@@ -32,7 +32,7 @@ jobs:
         run: rustup show
 
       - name: Build
-        run:  SGX_MODE=SW make
+        run:  env "MITIGATION-CVE-2020-0551=LOAD" "SGX_MODE=SW" make
       - name: Test Service & Client
         run: cargo test
       - name: Test Enclave # cargo test is not supported, see: https://github.com/apache/incubator-teaclave-sgx-sdk/issues/232
@@ -200,7 +200,6 @@ jobs:
           echo "${{ env.TLS_PRIVATE_KEY }}" > end.rsa
           chmod 644 end.fullchain
           chmod 644 end.rsa
-          ls -al .
 
       - name: Run local setup
         # * `set -eo pipefail` is needed to return an error even if piped to `tee`.

Makefile

@@ -68,6 +68,8 @@ else
 	CARGO_TARGET := --release
 endif
 
+SGX_COMMON_CFLAGS += -fstack-protector
+
 ifeq ($(SGX_PRODUCTION), 1)
 	SGX_ENCLAVE_MODE = "Production Mode"
 	SGX_ENCLAVE_CONFIG = "enclave-runtime/Enclave.config.production.xml"
@@ -134,7 +136,7 @@ RustEnclave_C_Objects := $(RustEnclave_C_Files:.c=.o)
 RustEnclave_Include_Paths := -I$(CUSTOM_COMMON_PATH)/inc -I$(CUSTOM_EDL_PATH) -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/stlport -I$(SGX_SDK)/include/epid -I ./enclave-runtime -I./include
 
 RustEnclave_Link_Libs := -L$(CUSTOM_LIBRARY_PATH) -lenclave
-RustEnclave_Compile_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -fstack-protector $(RustEnclave_Include_Paths)
+RustEnclave_Compile_Flags := $(SGX_COMMON_CFLAGS) $(ENCLAVE_CFLAGS) $(RustEnclave_Include_Paths)
 RustEnclave_Link_Flags := -Wl,--no-undefined -nostdlib -nodefaultlibs -nostartfiles -L$(SGX_LIBRARY_PATH) \
 	-Wl,--whole-archive -l$(Trts_Library_Name) -Wl,--no-whole-archive \
 	-Wl,--start-group -lsgx_tstdc -lsgx_tcxx -l$(Crypto_Library_Name) -l$(Service_Library_Name) -l$(ProtectedFs_Library_Name) $(RustEnclave_Link_Libs) -Wl,--end-group \

rust-sgx-sdk/buildenv.mk

@@ -83,7 +83,7 @@ ifneq (,$(findstring 86,$(UNAME)))
         HOST_ARCH := x86_64
     endif
 else
-    $(info Unknown host CPU arhitecture $(UNAME))
+    $(info Unknown host CPU architecture $(UNAME))
     $(error Aborting)
 endif