sgx_ioc_encl..._permissions(9)

📦 version 7.3.1, in nixpkgs unstable

💅 NAME 💅

sgx_ioc_enclave_restrict_permissions — okay bestie, this is the handler for %SGX_IOC_ENCLAVE_RESTRICT_PERMISSIONS, and yes that is a mouthful, we love her anyway 🫶

This page lives in the Kernel API Manual section, so sgx_ioc_encl..._permissions(9) is the name we're on 🌸

✨ SYNOPSIS ✨

long sgx_ioc_enclave_restrict_permissions (struct sgx_encl *encl , void
__user *arg );

That's the whole vibe. One function, two args, slay 💅

🎀 ARGUMENTS 🎀

  • encl — an enclave pointer. Just a lil pointer to the enclave, that's her 🦋
  • arg — a userspace pointer to a struct sgx_enclave_restrict_permissions instance. Yep, userspace hands it over, no cap 🔥

👑 DESCRIPTION 👑

So here's the tea ☕ — SGX2 distinguishes between relaxing and restricting the enclave page permissions that the hardware maintains (those are the EPCM permissions, iykyk) on pages belonging to an initialized enclave, and "initialized" means after SGX_IOC_ENCLAVE_INIT bestie 🌈

Now the important part: EPCM permissions cannot be restricted from within the enclave itself. The enclave literally needs the kernel to run the privileged level 0 instructions ENCLS[EMODPR] and ENCLS[ETRACK] for her. That's the whole point of this call, periodt 💜

And if you try to relax EPCM permissions with this call? The hardware will literally ignore you 🙈 Like, read the room. That's not what this function is for, bestie 💀

⭐ RETURN ⭐

  • 0 — success! we ate 💖
  • -errno — otherwise, so, not that 😭

💜 SEE ALSO 💜

Kernel file ./arch/x86/kernel/cpu/sgx/ioctl.c, plus the whole friend group:

Go read them, they're iconic too 🧚

And that's a wrap, bestie! 🎀 This page came from ./arch/x86/kernel/cpu/sgx, dated October 2026, all about sgx_ioc_encl..._permissions(9) — she's giving kernel main character energy and we're obsessed ✨👑💅

📦 where this page comes from