机密计算与可信执行环境安全取证深度分析

#!/bin/bash
echo "=== SGX Prime+Probe Cache Side Channel Detection ==="
echo ""
echo "[*] Checking RAPL (Running Average Power Limit) interface..."
if [ -r /sys/class/powercap/intel-rapl:0/energy_uj ]; then
    ENERGY_BEFORE=$(cat /sys/class/powercap/intel-rapl:0/energy_uj)
    sleep 1
    ENERGY_AFTER=$(cat /sys/class/powercap/intel-rapl:0/energy_uj)
    DELTA=$((ENERGY_AFTER - ENERGY_BEFORE))
    echo "[!] Energy delta in 1s: ${DELTA} uJ"
    if [ "$DELTA" -gt 500000 ]; then
        echo "[HIGH] Abnormal energy consumption detected - possible side channel activity"
    fi
else
    echo "[-] RAPL interface not available"
fi
echo ""
echo "[*] Checking perf_event_open for cache monitoring..."
if [ -r /proc/sys/kernel/perf_event_paranoid ]; then
    PARANOID=$(cat /proc/sys/kernel/perf_event_paranoid)
    echo "[*] perf_event_paranoid = ${PARANOID}"
    if [ "$PARANOID" -le 1 ]; then
        echo "[!] Low paranoid level - cache events accessible to unprivileged users"
    fi
else
    echo "[-] Cannot read perf_event_paranoid"
fi
echo ""
echo "[*] Scanning for suspicious cache-line flush patterns..."
FLUSH_CNT=$(perf stat -e 'LLC-load-misses,LLC-store-misses' -a -- sleep 1 2>&1 | grep -c "LLC")
echo "[*] LLC miss events detected: ${FLUSH_CNT}"

#include <stdint.h>
#include <stdio.h>
#include <x86intrin.h>

volatile uint64_t shared_line[8] __attribute__((aligned(64)));

uint64_t measure_reload_time(volatile uint64_t *addr) {
    uint64_t start = __rdtsc();
    volatile uint64_t val = *addr;
    uint64_t end = __rdtsc();
    _mm_mfence();
    return end - start;
}

void flush_reload_detector() {
    printf("=== Flush+Reload Detection Monitor ===\n");
    for (int i = 0; i < 10000; i++) {
        _mm_clflush((void*)&shared_line[0]);
        _mm_mfence();
        uint64_t time = measure_reload_time(&shared_line[0]);
        if (time < 100) {
            printf("[ALERT] Fast reload at iteration %d: %lu cycles\n", i, time);
            printf("[!] Possible Flush+Reload attack in progress\n");
            return;
        }
    }
    printf("[OK] No Flush+Reload pattern detected\n");
}

#!/bin/bash
echo "=== Page Table Side Channel Detection ==="
echo ""
echo "[*] Monitoring EPC page faults..."
EPCF=$(cat /proc/vmstat 2>/dev/null | grep "pgfault")
echo "[*] Current page fault count: ${EPCF}"
echo "[*] Monitoring SGX-specific EPC events via perf..."
PERF_OUTPUT=$(perf stat -e 'cacheline_access,cacheline_refill' -p $(pgrep -f "sgx" | head -1) -- sleep 2 2>&1)
echo "${PERF_OUTPUT}"
echo ""
echo "[*] Checking for EPC size anomalies..."
EPC_TOTAL=$(dmesg 2>/dev/null | grep -i "SGX EPC" | tail -1)
echo "[*] EPC configuration: ${EPC_TOTAL}"
echo ""
echo "[*] Analyzing TLB miss patterns for enclave processes..."
SGX_PROCS=$(ps aux | grep -i sgx | grep -v grep)
if [ -n "$SGX_PROCS" ]; then
    for PID in $(pgrep -f "enclave\|aesm\|sgx"); do
        TLB_MISSES=$(perf stat -e 'dTLB-load-misses' -p "$PID" -- sleep 1 2>&1 | tail -5)
        echo "[*] PID ${PID} TLB activity:"
        echo "${TLB_MISSES}"
    done
else
    echo "[-] No SGX processes found"
fi

#!/bin/bash
echo "=== Interrupt Side Channel Detection ==="
echo ""
echo "[*] Analyzing interrupt distribution..."
cat /proc/interrupts | head -20
echo ""
echo "[*] Checking NMI counter..."
NMI_COUNT=$(cat /proc/interrupts | grep "NMI" | awk '{sum+=$2} END {print sum}')
echo "[*] Total NMIs: ${NMI_COUNT}"
if [ "$NMI_COUNT" -gt 100 ]; then
    echo "[!] High NMI count may indicate interrupt-based side channel"
fi
echo ""
echo "[*] Checking for timer interrupt anomalies..."
HPET_STATUS=$(dmesg 2>/dev/null | grep -i "hpet\|pit\|apic" | tail -5)
echo "[*] Timer subsystem status:"
echo "${HPET_STATUS}"
echo ""
echo "[*] Scanning for enclave-related NMI handlers..."
cat /proc/kallsyms 2>/dev/null | grep -i "sgx.*nmi\|nmi.*sgx" | head -10

#!/bin/bash
echo "=== AMD SEV Security Audit ==="
echo ""
echo "[*] Checking processor support..."
if grep -qi "sev" /proc/cpuinfo; then
    SEV_FLAGS=$(grep -m1 flags /proc/cpuinfo | tr ' ' '\n' | grep -i "sev")
    echo "[*] SEV flags detected:"
    echo "${SEV_FLAGS}"
    echo ""
    if echo "${SEV_FLAGS}" | grep -q "sev_snp"; then
        echo "[OK] SEV-SNP supported"
    elif echo "${SEV_FLAGS}" | grep -q "sev_es"; then
        echo "[WARN] Only SEV-ES supported, consider upgrading to SEV-SNP"
    elif echo "${SEV_FLAGS}" | grep -q "sev"; then
        echo "[WARN] Only basic SEV supported - no integrity protection"
    fi
else
    echo "[-] SEV not supported by this CPU"
fi
echo ""
echo "[*] Checking SEV firmware version..."
if command -v sev-tool &>/dev/null; then
    sev-tool --version
    echo ""
    echo "[*] Querying SEV status..."
    sev-tool --pinfo
else
    echo "[-] sev-tool not found, using lspci fallback..."
    lspci -vv 2>/dev/null | grep -i "AMD.*SEV\|Secure.*Encrypted" | head -5
fi
echo ""
echo "[*] Checking /dev/sev device..."
if [ -c /dev/sev ]; then
    echo "[OK] /dev/sev device exists"
    ls -la /dev/sev*
else
    echo "[-] /dev/sev not found - SEV not available"
fi
echo ""
echo "[*] Checking SEV-related kernel modules..."
lsmod | grep -i "kvm_amd\|sev"
echo ""
echo "[*] Checking SEV VM count..."
if command -v sev-tool &>/dev/null; then
    sev-tool --count
fi

#!/bin/bash
echo "=== SEV Memory Encryption Forensics ==="
echo ""
echo "[*] Collecting SEV-related system state..."
echo "[*] VM Configuration:"
virsh dumpxml 2>/dev/null | grep -A20 "sev\|memory" | head -30
echo ""
echo "[*] SEV Policy Check:"
cat /sys/module/kvm_amd/parameters/sev_enabled 2>/dev/null
echo ""
echo "[*] Collecting PSP firmware logs..."
if [ -d /sys/kernel/debug/sev ]; then
    find /sys/kernel/debug/sev -type f 2>/dev/null | while read f; do
        echo "--- ${f} ---"
        cat "$f" 2>/dev/null
    done
else
    echo "[-] SEV debugfs not available"
fi
echo ""
echo "[*] Checking for SEV-related QEMU processes..."
ps aux | grep -i "qemu\|kvm" | grep -i "sev"
echo ""
echo "[*] Analyzing SEV session keys in memory..."
if [ -r /proc/kcore ]; then
    echo "[!] /proc/kcore accessible - checking for SEV key material"
    strings /proc/kcore 2>/dev/null | grep -i "sev.*key\|aes.*key" | head -5
fi

#!/bin/bash
echo "=== ARM TrustZone Forensics ==="
echo ""
echo "[*] Checking TrustZone support..."
if grep -qi "trustzone\|tzasc\|tzpc" /proc/device-tree 2>/dev/null; then
    echo "[OK] TrustZone support detected"
else
    echo "[!] TrustZone status unknown from /proc/device-tree"
fi
echo ""
echo "[*] Scanning for OP-TEE instances..."
if [ -c /dev/tee0 ] || [ -c /dev/teepriv0 ]; then
    echo "[!] OP-TEE device nodes found:"
    ls -la /dev/tee* /dev/optee* 2>/dev/null
else
    echo "[-] No OP-TEE device nodes found"
fi
echo ""
echo "[*] Checking TrustZone driver modules..."
lsmod | grep -i "optee\|trusty\|tz\|tee"
echo ""
echo "[*] Scanning for TEE-related kernel logs..."
dmesg 2>/dev/null | grep -i "tee\|optee\|trusty\|smc\|trustzone" | tail -20
echo ""
echo "[*] Checking TEE client applications..."
find /system /vendor -name "*.ta" -o -name "*trusted*" 2>/dev/null | head -20
echo ""
echo "[*] Analyzing SMC call frequency..."
if [ -r /sys/kernel/debug/SMC ]; then
    cat /sys/kernel/debug/SMC 2>/dev/null | head -30
else
    echo "[*] SMC debug interface not available, using kprobe approach..."
    cat /proc/kallsyms 2>/dev/null | grep -i "smc\|smc_call\|arm_smccc" | head -10
fi

#!/bin/bash
echo "=== Remote Attestation Audit ==="
echo ""
echo "[*] Checking Intel DCAP installation..."
if command -v quote_verify &>/dev/null; then
    echo "[OK] DCAP quote_verify found"
    quote_verify --help 2>&1 | head -5
else
    echo "[-] DCAP quote_verify not found"
fi
echo ""
echo "[*] Checking SGX Quote Generation Service..."
if systemctl is-active --quiet azure-quote-service 2>/dev/null || \
   pgrep -f "quote_generation\|aesmd" >/dev/null 2>&1; then
    echo "[OK] Quote Generation Service is running"
    ps aux | grep -E "aesm|quote_gen" | grep -v grep
else
    echo "[!] Quote Generation Service not detected"
fi
echo ""
echo "[*] Checking attestation collateral..."
SGX_COLLATERAL="/opt/intel/attestation"
if [ -d "${SGX_COLLATERAL}" ]; then
    echo "[*] Collateral directory contents:"
    ls -la "${SGX_COLLATERAL}"/
    echo ""
    echo "[*] Certificate chain status:"
    find "${SGX_COLLATERAL}" -name "*.pem" -o -name "*.crt" 2>/dev/null | while read cert; do
        EXPIRY=$(openssl x509 -enddate -noout -in "$cert" 2>/dev/null)
        echo "  ${cert}: ${EXPIRY}"
    done
else
    echo "[-] SGX collateral directory not found"
fi
echo ""
echo "[*] Checking attestation logs..."
ATTEST_LOG="/var/log/aesm.log"
if [ -f "${ATTEST_LOG}" ]; then
    echo "[*] Last 20 attestation log entries:"
    tail -20 "${ATTEST_LOG}"
    echo ""
    ATTEST_FAIL=$(grep -ci "fail\|error" "${ATTEST_LOG}")
    echo "[!] Total attestation failures: ${ATTEST_FAIL}"
else
    echo "[-] AESM log not found"
fi

#!/bin/bash
echo "=== Attestation Chain Integrity Check ==="
echo ""
echo "[*] Verifying Intel SGX attestation report chain..."
SGX_MRENCLAVE_LOG="/var/log/sgx_mrenclave"
if [ -f "${SGX_MRENCLAVE_LOG}" ]; then
    echo "[*] MRENCLAVE measurements:"
    cat "${SGX_MRENCLAVE_LOG}"
    echo ""
    EXPECTED_HASH=$(head -1 "${SGX_MRENCLAVE_LOG}" | awk '{print $NF}')
    echo "[*] Expected MRENCLAVE: ${EXPECTED_HASH}"
else
    echo "[-] No MRENCLAVE measurement log found"
fi
echo ""
echo "[*] Checking Intel Provisioning Certification Service (PCS)..."
PCS_CERT_URL="https://api.trustedservices.intel.com/sgx/certification/v4"
echo "[*] PCS endpoint: ${PCS_CERT_URL}"
echo ""
echo "[*] Verifying TCB info freshness..."
TCB_INFO="/opt/intel/attestation/tcb_info.json"
if [ -f "${TCB_INFO}" ]; then
    TCB_DATE=$(grep -o '"date"[[:space:]]*:[[:space:]]*"[^"]*"' "${TCB_INFO}" | head -1)
    echo "[*] TCB info date: ${TCB_DATE}"
else
    echo "[-] TCB info not found"
fi
echo ""
echo "[*] Checking AMD VCEK certificate chain..."
if command -v sev-tool &>/dev/null; then
    sev-tool --fetch_cert_chain 2>&1
fi

#!/bin/bash
echo "=== Confidential Containers Audit ==="
echo ""
echo "[*] Checking CoCo runtime status..."
if crictl info 2>/dev/null | grep -q "kata\|coco"; then
    echo "[OK] CoCo runtime detected"
    crictl info 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(json.dumps(d.get('config',{}).get('containerdConfigPath','N/A')))" 2>/dev/null
else
    echo "[-] CoCo runtime not detected via crictl"
fi
echo ""
echo "[*] Checking Confidential Container Pods..."
kubectl get pods -A -o json 2>/dev/null | python3 -c "
import sys, json
data = json.load(sys.stdin)
for pod in data.get('items', []):
    annotations = pod.get('metadata', {}).get('annotations', {})
    for k, v in annotations.items():
        if 'confidential' in k.lower() or 'tee' in k.lower() or 'sgx' in k.lower() or 'sev' in k.lower():
            ns = pod['metadata']['namespace']
            name = pod['metadata']['name']
            print(f'[CONFIDENTIAL POD] {ns}/{name}: {k}={v}')
" 2>/dev/null
echo ""
echo "[*] Checking TDX/SEV node labels..."
kubectl get nodes -o json 2>/dev/null | python3 -c "
import sys, json
data = json.load(sys.stdin)
for node in data.get('items', []):
    labels = node.get('metadata', {}).get('labels', {})
    for k, v in labels.items():
        if 'tdx' in k.lower() or 'sev' in k.lower() or 'tee' in k.lower() or 'confidential' in k.lower():
            name = node['metadata']['name']
            print(f'[NODE LABEL] {name}: {k}={v}')
" 2>/dev/null
echo ""
echo "[*] Checking KBS (Key Broker Service)..."
if pgrep -f "kbs" >/dev/null 2>&1; then
    echo "[OK] KBS process detected"
    ps aux | grep kbs | grep -v grep
else
    echo "[-] KBS process not found"
fi
echo ""
echo "[*] Checking Attestation Agent..."
if pgrep -f "attestation.agent\|attestation-agent" >/dev/null 2>&1; then
    echo "[OK] Attestation Agent detected"
else
    echo "[-] Attestation Agent not found"
fi

title: Intel SGX Enclave Abnormal Loading Activity
id: 6b7d8a2c-1f3e-4a9b-b8c2-5d6e7f8a9b0c
status: stable
description: Detects abnormal SGX enclave loading patterns that may indicate side-channel attack preparation
references:
  - https://github.com/intel/sgx
author: Security Forensics Team
date: 2026/07/24
tags:
  - attack.credential_access
  - attack.t1212
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  sel:
    Image|endswith:
      - '/aesm_service'
      - '/sgx_enclave'
      - '/sgx_sign'
      - '/sgx_test'
    CommandLine|contains:
      - 'enclave'
      - 'ecall'
      - 'ocall'
  condition: sel
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
falsepositives:
  - Legitimate SGX application deployment
level: medium
---
title: SGX Remote Attestation Failure Surge
id: 8a2c1f3e-4a9b-b8c2-5d6e7f8a9b0d
status: stable
description: Detects abnormal surge in SGX remote attestation failures that may indicate attestation chain tampering
references:
  - https://github.com/intel/SGXDataCenterAttestationPrimitives
author: Security Forensics Team
date: 2026/07/24
tags:
  - attack.defense_evasion
  - attack.t1553
logsource:
  product: linux
  service: aesm
detection:
  sel:
    EventID|contains: 'attestation'
    EventID|endswith:
      - 'FAILED'
      - 'ERROR'
      - 'TIMEOUT'
  condition: sel
fields:
  - EventID
  - Message
  - Hostname
  - Timestamp
falsepositives:
  - Network connectivity issues to Intel PCS
  - TCB version mismatch during legitimate updates
level: high
---
title: AMD SEV Memory Encryption Key Anomaly
id: 9b3e5d7f-2a4c-8e1a-b6d0-4c7f8a9e1b2c
status: stable
description: Detects anomalies in AMD SEV memory encryption key management that may indicate key extraction attempts
references:
  - https://github.com/AMDESE/sev-tool
author: Security Forensics Team
date: 2026/07/24
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1212
logsource:
  category: process_creation
  product: linux
detection:
  sel:
    Image|endswith:
      - '/sev-tool'
      - '/sevctl'
    CommandLine|contains:
      - '--export'
      - '--pinfo'
      - '--set_me_policy'
      - '--validate_guest'
  condition: sel
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate SEV management operations
level: critical
---
title: TrustZone SMC Call Volume Anomaly
id: 4c7f8a9e-1b2c-3d4e-5f6a-7b8c9d0e1f2a
status: stable
description: Detects abnormal SMC call volume that may indicate TrustZone side-channel exploitation
references:
  - https://developer.arm.com/documentation
author: Security Forensics Team
date: 2026/07/24
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: linux
  service: kernel
detection:
  sel:
    EventID: 'kernel'
    Message|contains:
      - 'smc'
      - 'arm_smccc'
      - 'trustzone'
    Message|contains:
      - 'rate limit'
      - 'overflow'
      - 'anomaly'
  condition: sel
fields:
  - Message
  - Hostname
  - Timestamp
falsepositives:
  - High-throughput TEE applications
level: medium

#!/bin/bash
SGX_LOG="/var/log/sgx_security_audit.log"
timestamp() {
    date '+%Y-%m-%d %H:%M:%S'
}
echo "$(timestamp) === SGX/SEV Security Audit Started ===" > "${SGX_LOG}"

echo "[1/8] Checking CPU TEE capabilities..."
if grep -q "sgx" /proc/cpuinfo; then
    SGX_CAPS=$(grep -m1 flags /proc/cpuinfo | tr ' ' '\n' | grep -E "sgx|sgx2|sgxlc")
    echo "$(timestamp) SGX capabilities: ${SGX_CAPS}" >> "${SGX_LOG}"
    echo "[OK] SGX supported"
else
    echo "$(timestamp) SGX not supported" >> "${SGX_LOG}"
    echo "[-] SGX not supported"
fi

echo "[2/8] Checking SEV support..."
if grep -q "sev" /proc/cpuinfo; then
    SEV_CAPS=$(grep -m1 flags /proc/cpuinfo | tr ' ' '\n' | grep -iE "sev")
    echo "$(timestamp) SEV capabilities: ${SEV_CAPS}" >> "${SGX_LOG}"
    echo "[OK] SEV supported"
else
    echo "$(timestamp) SEV not supported" >> "${SGX_LOG}"
fi

echo "[3/8] Auditing SGX driver status..."
SGX_MOD=$(lsmod | grep "intel_sgx\|isgx")
if [ -n "${SGX_MOD}" ]; then
    echo "$(timestamp) SGX driver: ${SGX_MOD}" >> "${SGX_LOG}"
    echo "[OK] SGX driver loaded: ${SGX_MOD}"
else
    echo "$(timestamp) SGX driver not loaded" >> "${SGX_LOG}"
    echo "[-] SGX driver not loaded"
fi

echo "[4/8] Listing running enclave processes..."
ENCLAVE_PROCS=$(ps aux | grep -E "enclave|aesm|sgx" | grep -v grep)
if [ -n "${ENCLAVE_PROCS}" ]; then
    echo "$(timestamp) Enclave processes:" >> "${SGX_LOG}"
    echo "${ENCLAVE_PROCS}" >> "${SGX_LOG}"
    echo "${ENCLAVE_PROCS}" | wc -l | xargs -I{} echo "[!] {} enclave-related processes running"
else
    echo "$(timestamp) No enclave processes found" >> "${SGX_LOG}"
    echo "[OK] No enclave processes found"
fi

echo "[5/8] Checking EPC memory allocation..."
EPC_INFO=$(dmesg 2>/dev/null | grep -i "EPC\|SGX" | tail -5)
if [ -n "${EPC_INFO}" ]; then
    echo "$(timestamp) EPC info: ${EPC_INFO}" >> "${SGX_LOG}"
    echo "${EPC_INFO}"
else
    echo "$(timestamp) No EPC info in dmesg" >> "${SGX_LOG}"
fi

echo "[6/8] Analyzing attestation log for failures..."
if [ -f /var/log/aesm.log ]; then
    FAILURES=$(grep -ci "fail\|error\|timeout" /var/log/aesm.log)
    TOTAL=$(wc -l < /var/log/aesm.log)
    if [ "${TOTAL}" -gt 0 ]; then
        FAIL_RATE=$((FAILURES * 100 / TOTAL))
        echo "$(timestamp) Attestation failure rate: ${FAIL_RATE}% (${FAILURES}/${TOTAL})" >> "${SGX_LOG}"
        if [ "${FAIL_RATE}" -gt 30 ]; then
            echo "[CRITICAL] Attestation failure rate is ${FAIL_RATE}% - possible tampering"
        else
            echo "[OK] Attestation failure rate: ${FAIL_RATE}%"
        fi
    fi
else
    echo "$(timestamp) AESM log not found" >> "${SGX_LOG}"
    echo "[-] AESM log not found"
fi

echo "[7/8] Checking SEV VM status..."
if command -v sev-tool &>/dev/null; then
    SEV_STATUS=$(sev-tool --pinfo 2>&1)
    echo "$(timestamp) SEV platform info: ${SEV_STATUS}" >> "${SGX_LOG}"
    echo "${SEV_STATUS}"
else
    echo "$(timestamp) sev-tool not available" >> "${SGX_LOG}"
    echo "[-] sev-tool not available"
fi

echo "[8/8] Generating audit summary..."
AUDIT_FILES=$(find /var/log -name "*sgx*" -o -name "*sev*" -o -name "*aesm*" -o -name "*attest*" 2>/dev/null)
AUDIT_COUNT=$(echo "${AUDIT_FILES}" | grep -c . 2>/dev/null)
echo "$(timestamp) Total audit-relevant files: ${AUDIT_COUNT}" >> "${SGX_LOG}"
echo "$(timestamp) Audit complete. Log: ${SGX_LOG}" >> "${SGX_LOG}"
echo ""
echo "=== Audit complete. Log saved to ${SGX_LOG} ==="

#!/usr/bin/env python3
import subprocess
import os
import json
import sys
from datetime import datetime
from pathlib import Path


class TEESecurityAuditor:
    def __init__(self):
        self.findings = []
        self.timestamp = datetime.now().isoformat()
        self.platform_info = {}

    def check_sgx_support(self):
        result = {"check": "SGX Support", "status": "unknown", "details": []}
        try:
            with open("/proc/cpuinfo", "r") as f:
                cpuinfo = f.read()
            if "sgx" in cpuinfo:
                result["status"] = "supported"
                flags_line = [l for l in cpuinfo.split("\n") if l.startswith("flags")][0]
                sgx_flags = [f for f in flags_line.split() if f.startswith("sgx")]
                result["details"] = sgx_flags
            else:
                result["status"] = "not_supported"
        except Exception as e:
            result["status"] = "error"
            result["details"].append(str(e))
        self.findings.append(result)
        return result

    def check_sev_support(self):
        result = {"check": "SEV Support", "status": "unknown", "details": []}
        try:
            with open("/proc/cpuinfo", "r") as f:
                cpuinfo = f.read()
            sev_flags = []
            for line in cpuinfo.split("\n"):
                if line.startswith("flags"):
                    sev_flags.extend([f for f in line.split() if f.startswith("sev")])
            if sev_flags:
                result["status"] = "supported"
                result["details"] = list(set(sev_flags))
            else:
                result["status"] = "not_supported"
        except Exception as e:
            result["status"] = "error"
            result["details"].append(str(e))
        self.findings.append(result)
        return result

    def check_sgx_driver(self):
        result = {"check": "SGX Driver", "status": "unknown", "details": []}
        try:
            lsmod_out = subprocess.check_output(["lsmod"], text=True, timeout=5)
            if "intel_sgx" in lsmod_out or "isgx" in lsmod_out:
                result["status"] = "loaded"
                for line in lsmod_out.split("\n"):
                    if "sgx" in line.lower():
                        result["details"].append(line.strip())
            else:
                result["status"] = "not_loaded"
        except Exception as e:
            result["status"] = "error"
            result["details"].append(str(e))
        self.findings.append(result)
        return result

    def check_sev_device(self):
        result = {"check": "SEV Device Node", "status": "unknown", "details": []}
        sev_dev = Path("/dev/sev")
        if sev_dev.exists():
            result["status"] = "present"
            result["details"].append(f"/dev/sev mode: {oct(sev_dev.stat().st_mode)}")
        else:
            result["status"] = "not_present"
        self.findings.append(result)
        return result

    def check_enclave_processes(self):
        result = {"check": "Enclave Processes", "status": "unknown", "details": []}
        try:
            ps_out = subprocess.check_output(
                ["ps", "aux"], text=True, timeout=5
            )
            enclave_lines = [
                l for l in ps_out.split("\n")
                if any(kw in l.lower() for kw in ["enclave", "aesm", "sgx"])
            ]
            if enclave_lines:
                result["status"] = "active"
                result["details"] = [l.strip() for l in enclave_lines[:10]]
            else:
                result["status"] = "none"
        except Exception as e:
            result["status"] = "error"
            result["details"].append(str(e))
        self.findings.append(result)
        return result

    def check_attestation_logs(self):
        result = {"check": "Attestation Logs", "status": "unknown", "details": []}
        log_paths = [
            "/var/log/aesm.log",
            "/var/log/sgx_attestation.log",
            "/opt/intel/attestation/log"
        ]
        for log_path in log_paths:
            p = Path(log_path)
            if p.exists():
                try:
                    lines = p.read_text().strip().split("\n")
                    total = len(lines)
                    errors = sum(1 for l in lines if "fail" in l.lower() or "error" in l.lower())
                    fail_rate = (errors / total * 100) if total > 0 else 0
                    result["details"].append({
                        "file": log_path,
                        "total_lines": total,
                        "error_count": errors,
                        "failure_rate": f"{fail_rate:.1f}%"
                    })
                    if fail_rate > 30:
                        self.findings.append({
                            "check": "Attestation Anomaly",
                            "status": "critical",
                            "details": [f"High failure rate {fail_rate:.1f}% in {log_path}"]
                        })
                except Exception as e:
                    result["details"].append({"file": log_path, "error": str(e)})
        result["status"] = "analyzed" if result["details"] else "no_logs_found"
        self.findings.append(result)
        return result

    def check_attestation_chain_integrity(self):
        result = {"check": "Attestation Chain Integrity", "status": "unknown", "details": []}
        collateral_dirs = [
            "/opt/intel/attestation",
            "/opt/intel/sgx-dcap-pccs"
        ]
        for d in collateral_dirs:
            p = Path(d)
            if p.exists():
                cert_files = list(p.rglob("*.pem")) + list(p.rglob("*.crt"))
                result["details"].append({
                    "directory": d,
                    "certificates_found": len(cert_files)
                })
                for cert in cert_files[:5]:
                    try:
                        openssl_out = subprocess.check_output(
                            ["openssl", "x509", "-enddate", "-noout", "-in", str(cert)],
                            text=True, timeout=5, stderr=subprocess.DEVNULL
                        )
                        result["details"].append({
                            "cert": str(cert),
                            "expiry": openssl_out.strip()
                        })
                    except Exception:
                        result["details"].append({
                            "cert": str(cert),
                            "expiry": "unable to read"
                        })
        result["status"] = "analyzed" if result["details"] else "no_collateral"
        self.findings.append(result)
        return result

    def generate_report(self):
        critical = [f for f in self.findings if f["status"] in ("critical", "error")]
        warnings = [f for f in self.findings if f["status"] in ("not_loaded", "not_present", "no_logs_found")]
        report = {
            "audit_timestamp": self.timestamp,
            "platform": self.platform_info,
            "total_checks": len(self.findings),
            "critical_findings": len(critical),
            "warnings": len(warnings),
            "checks": self.findings
        }
        return report

    def print_summary(self):
        report = self.generate_report()
        print(f"\n{'='*60}")
        print(f"  TEE Security Audit Report")
        print(f"  Generated: {self.timestamp}")
        print(f"{'='*60}")
        for finding in self.findings:
            status_icon = {"supported": "[+]", "loaded": "[+]", "active": "[!]",
                           "present": "[+]", "analyzed": "[*]", "none": "[-]",
                           "not_supported": "[-]", "not_loaded": "[-]",
                           "not_present": "[-]", "no_logs_found": "[-]",
                           "no_collateral": "[-]", "unknown": "[?]",
                           "critical": "[!!!]", "error": "[ERR]"}.get(
                finding["status"], "[?]")
            print(f"  {status_icon} {finding['check']}: {finding['status']}")
            for detail in finding["details"][:3]:
                if isinstance(detail, dict):
                    print(f"      -> {json.dumps(detail, indent=0)}")
                else:
                    print(f"      -> {detail}")
        print(f"\n  Summary: {report['critical_findings']} critical, "
              f"{report['warnings']} warnings")
        print(f"{'='*60}")
        return report


if __name__ == "__main__":
    auditor = TEESecurityAuditor()
    auditor.check_sgx_support()
    auditor.check_sev_support()
    auditor.check_sgx_driver()
    auditor.check_sev_device()
    auditor.check_enclave_processes()
    auditor.check_attestation_logs()
    auditor.check_attestation_chain_integrity()
    report = auditor.print_summary()
    output_path = "/tmp/tee_security_audit.json"
    with open(output_path, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"\n  Full report saved to: {output_path}")