I am studying some published papers that demonstrate how I can a secure file system been implemented with the assistance of Intel SGX.
However, in each one of these papers, the threat model is not clearly defined. I know that SGX prevents privileged code from reading enclave's memory or tampering the code that enclaves execute. But a "successful" file system, at some point, has to transfer data to/from a physical volume (SSD,HDD) -they cannot always remain on cached pages or EPC in our case. So I will assume that the threat model that they implicitly state is that of a compromised OS. But such a threat model means that all OCALLS that read/write from/on volumes cannot be trusted because the system calls can be intercepted and return "success" without executing the operations in fact.
So file systems that are built with SGX can only protect the already stored encrypted files and prevent an attacker from extracting the encryption keys that were used to encrypt them inside the enclaves (lets assume for simplicity that SGX has no flaws for the matter of this question), but at the moment the OS (or hypervisor in case of cloud) is compromised, no operations on and from disks can be guaranteed. Shouldn't this be explicitly stated or am I missing something that can ensure secure read/write even with a compromised kernel?
