Skip to content

Commit ad6a43f

Browse files
DougAnsonAustinTXDougAnsonAustinTX
committed
pacbti testing using aws greengrass
1 parent bb71a7e commit ad6a43f

32 files changed

Lines changed: 594 additions & 0 deletions

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/.python-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2.7.18

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/_index.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: Test Arm PAC/BTI instruction readiness with an AWS IoT Greengrass custom component
3+
4+
description: Learn how to deploy an AWS IoT Greengrass custom component to Arm devices and verify PAC/BTI support through MQTT-triggered tests.
5+
6+
draft: true
7+
cascade:
8+
draft: true
9+
10+
minutes_to_complete: 30
11+
12+
who_is_this_for: This Learning Path is for developers who want to use AWS IoT Greengrass to deploy a PAC/BTI test component to Arm platforms.
13+
14+
learning_objectives:
15+
- Create an AWS IoT Greengrass custom component with the PAC/BTI test harness.
16+
- Register an Armv8 and an Armv9 device as AWS IoT Greengrass core devices.
17+
- Run PAC/BTI checks through MQTT and interpret the results for each device.
18+
19+
prerequisites:
20+
- A [Amazon AWS](https://aws.amazon.com/) account with access to AWS IoT Greengrass and AWS S3
21+
22+
23+
author: Varun Chari, Doug Anson
24+
25+
### Tags
26+
skilllevels: Introductory
27+
subjects: Performance and Architecture
28+
cloud_service_providers:
29+
- AWS
30+
31+
armips:
32+
- Neoverse
33+
34+
tools_software_languages:
35+
- Python
36+
- Java
37+
- MQTT
38+
- YAML
39+
40+
operatingsystems:
41+
- Linux
42+
43+
further_reading:
44+
- resource:
45+
title: AWS IoT Greengrass documentation
46+
link: https://aws.amazon.com/greengrass/
47+
type: documentation
48+
49+
50+
### FIXED, DO NOT MODIFY
51+
# ================================================================================
52+
weight: 1 # _index.md always has weight of 1 to order correctly
53+
layout: "learningpathall" # All files under learning paths have this same wrapper
54+
learning_path_main_page: "yes" # This should be surfaced when looking for related content. Only set for _index.md of learning path content.
55+
---

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/_next-steps.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
# ================================================================================
3+
# FIXED, DO NOT MODIFY THIS FILE
4+
# ================================================================================
5+
weight: 21 # Set to always be larger than the content in this path to be at the end of the navigation.
6+
title: "Next Steps" # Always the same, html page title.
7+
layout: "learningpathall" # All files under learning paths have this same wrapper for Hugo processing.
8+
---

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/background.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: Overview of AWS IoT Greengrass and the Arm v9 PAC and BTI instructions
3+
4+
weight: 2
5+
6+
layout: "learningpathall"
7+
---
8+
9+
### AWS IoT Greengrass
10+
11+
AWS IoT Greengrass is an edge runtime and cloud service for building, deploying, and managing software on devices outside the cloud, such as industrial gateways, robots, cameras, and other IoT systems. It lets devices run applications locally for lower latency, reduced bandwidth use, and continued operation when connectivity is limited, while still integrating with AWS services. In Greengrass V2, key features include a modular component model for packaging software, support for Lambda functions, containers, native processes, and custom runtimes, secure communication with AWS IoT Core, local messaging and device state handling, fleet deployments and over-the-air updates, optional stream processing, and edge machine learning inference.
12+
13+
14+
### PAC/BTI Arm v9 instructions
15+
16+
Armv9 Pointer Authentication (PAC) and Branch Target Identification (BTI) are security features designed to make control-flow attacks harder. PAC helps protect return addresses and pointers by adding a cryptographic signature that is checked before the pointer is used, which can detect tampering such as return-oriented programming attempts. BTI complements this by restricting where indirect branches are allowed to land, helping prevent attackers from jumping into unintended instruction sequences. Together, PAC and BTI strengthen software defenses at the instruction-set level, especially for modern operating systems, hypervisors, and applications that need improved resistance to memory-corruption exploits.
17+
18+
### What you've learned and what's next
19+
20+
Next, you'll use AWS IoT Greengrass to create and deploy a custom component to local Arm-based devices and verify each device's PAC/BTI support.

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/custom-component.md‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
---
2+
title: Creating an AWS IoT Greengrass custom component
3+
4+
weight: 5
5+
6+
layout: "learningpathall"
7+
---
8+
9+
### Introduction
10+
11+
In this section, you create an AWS IoT Greengrass custom component that uses an artifact package to test PAC/BTI support on target Arm devices.
12+
13+
### S3 bucket creation for the custom component artifact
14+
15+
1. In the AWS Console, go to **S3**.
16+
17+
![Creating an S3 bucket](images/s3-1.png "Creating an S3 bucket to store our component's artifact")
18+
19+
2. Create a bucket and give it a name. Keep the default settings for this tutorial.
20+
21+
![Creating an S3 bucket](images/s3-2.png "Creating an S3 bucket to store our component's artifact")
22+
23+
3. Select **Create bucket**.
24+
25+
![Creating an S3 bucket](images/s3-3.png "Creating an S3 bucket to store our component's artifact")
26+
27+
4. Record the bucket name. You will use it in the YAML recipe.
28+
29+
5. On your local machine, clone the asset repository:
30+
31+
```bash
32+
git clone https://github.com/DougAnsonAustinTx/pac-bti-gg-assets
33+
cd ./pac-bti-gg-assets
34+
```
35+
36+
6. In the S3 bucket view, select **Upload** and upload this artifact from the cloned repository:
37+
`./arm-pac-bti-greengrass-demo-mqtt-trigger.zip`
38+
39+
![Upload to an S3 bucket](images/upload-1.png "Uploading to our S3 bucket")
40+
41+
7. Select **Add files**, choose the artifact, and then select **Upload**.
42+
43+
![Upload to an S3 bucket](images/upload-2.png "Uploading to our S3 bucket")
44+
45+
Your artifact is now available in S3. Next, create the custom Greengrass component.
46+
47+
### Custom component creation
48+
49+
1. In the AWS Console, go to **IoT Core** -> **Greengrass devices** and select **Components**.
50+
51+
2. Select **Create component**.
52+
53+
![Creating a Greengrass custom component](images/custom-1.png "Creating a custom component")
54+
55+
3. Select **Enter recipe as YAML** and clear the default sample content.
56+
57+
![Creating a Greengrass custom component](images/custom-2.png "Creating a custom component")
58+
59+
4. Copy and paste the following YAML recipe into the editor.
60+
61+
{{% notice Note %}}
62+
In the YAML code below, locate **YOUR_S3_BUCKET** and replace it with the S3 bucket name you created in the previous step.
63+
{{% /notice %}}
64+
65+
66+
67+
```yaml
68+
RecipeFormatVersion: '2020-01-25'
69+
ComponentName: arm-com.arm.demo.PacBtiDemo
70+
ComponentVersion: '1.0.4'
71+
ComponentDescription: Demonstrate how PAC/BTI changes the exploit outcome for the same vulnerable app deployed with AWS IoT Greengrass.
72+
ComponentPublisher: Arm
73+
ComponentType: aws.greengrass.generic
74+
75+
ComponentConfiguration:
76+
DefaultConfiguration:
77+
accessControl:
78+
aws.greengrass.ipc.mqttproxy:
79+
com.arm.demo.PacBtiDemo:mqttproxy:1:
80+
policyDescription: Allow the PAC/BTI demo to subscribe for attack triggers and publish result events.
81+
operations:
82+
- aws.greengrass#PublishToIoTCore
83+
- aws.greengrass#SubscribeToIoTCore
84+
resources:
85+
- arm/demo/*/security/pacbti/attack/trigger
86+
- arm/demo/*/security/pacbti/attack/result
87+
88+
Manifests:
89+
- Platform:
90+
os: linux
91+
92+
Artifacts:
93+
- Uri: s3://YOUR_S3_BUCKET/arm-pac-bti-greengrass-demo-mqtt-trigger.zip
94+
Unarchive: ZIP
95+
Permission:
96+
Read: OWNER
97+
Execute: OWNER
98+
99+
Lifecycle:
100+
Install:
101+
RequiresPrivilege: true
102+
Script: |-
103+
set -e
104+
105+
PROJECT_ROOT="{artifacts:decompressedPath}/arm-pac-bti-greengrass-demo-mqtt-trigger/arm-pac-bti-greengrass-demo"
106+
WORK_DIR="{work:path}"
107+
VENV_DIR="{work:path}/venv"
108+
109+
python3 -m venv "${VENV_DIR}"
110+
"${VENV_DIR}/bin/python" -m pip install --upgrade pip
111+
"${VENV_DIR}/bin/pip" install --no-cache-dir awsiotsdk
112+
113+
bash "${PROJECT_ROOT}/greengrass/install.sh" \
114+
"${PROJECT_ROOT}" \
115+
"${WORK_DIR}"
116+
117+
Run:
118+
Script: |-
119+
set -e
120+
121+
PROJECT_ROOT="{artifacts:decompressedPath}/arm-pac-bti-greengrass-demo-mqtt-trigger/arm-pac-bti-greengrass-demo"
122+
WORK_DIR="{work:path}"
123+
VENV_DIR="{work:path}/venv"
124+
125+
BUILD_FLAVOR="$(cat "${WORK_DIR}/state/selected_flavor")"
126+
BINARY="${WORK_DIR}/build/${BUILD_FLAVOR}/vuln_demo"
127+
OUTPUT_DIR="${WORK_DIR}/results"
128+
THING_NAME="{iot:thingName}"
129+
TRIGGER_TOPIC="arm/demo/${THING_NAME}/security/pacbti/attack/trigger"
130+
RESULT_TOPIC="arm/demo/${THING_NAME}/security/pacbti/attack/result"
131+
132+
133+
mkdir -p "${OUTPUT_DIR}"
134+
135+
echo "THING_NAME=${THING_NAME}"
136+
echo "TRIGGER_TOPIC=${TRIGGER_TOPIC}"
137+
echo "RESULT_TOPIC=${RESULT_TOPIC}"
138+
139+
if [ ! -x "${VENV_DIR}/bin/python" ]; then
140+
echo "Virtual environment Python not found at ${VENV_DIR}/bin/python"
141+
exit 1
142+
fi
143+
144+
if [ ! -x "${BINARY}" ]; then
145+
echo "Binary not found or not executable: ${BINARY}"
146+
exit 1
147+
fi
148+
149+
export PYTHONUNBUFFERED=1
150+
151+
exec "${VENV_DIR}/bin/python" "${PROJECT_ROOT}/tools/demo_runner.py" \
152+
--project-root "${PROJECT_ROOT}" \
153+
--binary "${BINARY}" \
154+
--build-flavor "${BUILD_FLAVOR}" \
155+
--output-dir "${OUTPUT_DIR}" \
156+
--trigger-topic "${TRIGGER_TOPIC}" \
157+
--result-topic "${RESULT_TOPIC}"
158+
```
159+
160+
5. After you update the bucket name, select **Create component**.
161+
162+
![Creating a Greengrass custom component](images/custom-3.png "Creating a custom component")
163+
164+
6. Confirm the custom component appears in the component list.
165+
166+
![Creating a Greengrass custom component](images/custom-4.png "Creating a custom component")
167+
168+
### What we've accomplished
169+
170+
You created an AWS IoT Greengrass custom component and connected it to the S3-hosted artifact. In the next section, you'll deploy it to both Greengrass core devices.

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/deployment.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
title: Deploying an AWS IoT Greengrass custom component
3+
4+
weight: 6
5+
6+
layout: "learningpathall"
7+
---
8+
9+
### Introduction
10+
11+
In this section, you use a Greengrass thing group to deploy a set of components, including your PAC/BTI test component, to both Greengrass core devices.
12+
13+
### Create Deployment
14+
15+
1. In the AWS Console, go to **IoT Core** -> **Greengrass** -> **Deployments**, then select **Create**.
16+
17+
![Creating a Greengrass deployment](images/deploy-1.png "Creating a deployment")
18+
19+
2. Name your deployment and select the thing group `My_PAC_BTI_Test_Devices`, then select **Next**.
20+
21+
![Name and select thing group](images/deploy-2.png "Creating a deployment")
22+
23+
3. Select **Next**.
24+
25+
![Select Defaults](images/deploy-3.png "Select Defaults")
26+
27+
4. Select **Next**.
28+
29+
![Select Defaults](images/deploy-4.png "Select Defaults")
30+
31+
5. Select **Next**.
32+
33+
![Select Defaults](images/deploy-5.png "Select Defaults")
34+
35+
6. Scroll down and select **Deploy**.
36+
37+
![Deploy](images/deploy-6.png "Deploy")
38+
39+
7. Once deployed, Greengrass installs and prepares the custom component on each PAC/BTI test device (Thor and RPi5). Wait until the **Execution overview** shows **2** successful targets.
40+
41+
![Deploy status](images/deploy-7.png "Deploy status")
42+
43+
When both devices show successful deployment, you're ready to run PAC/BTI tests on each device.
44+
45+
### What we learned
46+
47+
In this section, you created a Greengrass deployment that targeted the thing group containing both PAC/BTI test devices. The deployment installed the PAC/BTI custom component by following the YAML recipe you defined.

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/images/custom-1.png‎

56.1 KB
Loading

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/images/custom-2.png‎

189 KB
Loading

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/images/custom-3.png‎

221 KB
Loading

‎content/learning-paths/servers-and-cloud-computing/aws-greengrass-pacbti-test/images/custom-4.png‎

218 KB
Loading

0 commit comments

Comments
 (0)