Truncating encrypted files viability

[tiagorvmartins]

Hello Gramine team,
Currently we are having issues (on a subset of scenarios) with a specific application which we 'graminised'.

The issue we are currently facing happens anytime the application itself tries to truncate encrypted files to an arbitrary size that is not zero.

According to our digging we believe it's using the package os/File from Golang which has the following details in documentation:
"Truncate changes the size of the file. It does not change the I/O offset. If there is an error, it will be of type *PathError."

From our understanding, we believe it's using the underlying file operation primitives truncate or ftruncate, according to the docs in Gramine we have found the following:

"Gramine supports file truncation (via truncate() and ftruncate()). There is one exception currently: shrinking encrypted files to arbitrary size is not supported (only shrink-to-zero is supported)."

Also doing some reading on the 27 February notes, it seems there is some discussion going related with the truncate operations and encrypted files.

We would like to know if there are plans to support this specific scenario (truncate encrypted files to arbitrary size [non-zero] ) in the future or not at all, since it seems a blocker for the time being, unless we fork/adapt the underlying app being 'graminised'.

Thank you again for your support!

[kailun-qin]

Hi @tiagorvmartins, thanks for your question!

We would like to know if there are plans to support this specific scenario (truncate encrypted files to arbitrary size [non-zero] ) in the future or not at all

Pls take a look at #1785 and see if it serves your requirements.

[tiagorvmartins]

Hi @kailun-qin this looks exactly what we need,

May I ask when would be a reasonable date to expect a release tagged version with this changes included?
Then we could attempt to reproduce the same error we were having before and check if it solved.

Our solution is currently relying on a tagged Gramine docker image (this one being gramineproject/gramine:1.6-jammy),
For testing this we could maybe (I guess?) fetch the commit hash and build a docker image from source, but in fact we would prefer to use an image published by Gramine itself.

Thank you!

[kailun-qin]

May I ask when would be a reasonable date to expect a release tagged version with this changes included?

I think we should be able to include it in our next (v1.7) release which will possibly happen in late May (not confirmed yet).

For testing this we could maybe (I guess?) fetch the commit hash and build a docker image from source

Yes.

[dimakuv]

Btw, this was indeed included in Gramine v1.7 release.

[tiagorvmartins]

Thank you @dimakuv we saw it!