On Wed, 15 May 2019, Andy Lutomirski wrote:

quoted

Why not just use an xattr, like security.sgx ?

Wouldn't this make it so that only someone with CAP_MAC_ADMIN could
install an enclave?  I think that this decision should be left up the
administrator, and it should be easy to set up a loose policy where
anyone can load whatever enclave they want.  That's what would happen
in my proposal if there was no LSM loaded or of the LSM policy didn't
restrict what .sigstruct files were acceptable.

You could try user.sigstruct, which does not require any privs.

-- 
James Morris
[off-list ref]