SGX-POL-01: Enclave is not debuggable and holds no privileged keys

Property	Value
Severity	critical
Platform	Intel SGX fleets
Lifecycle stage	hardware
Policy	P-05: No debug TEEs in production
Evaluated from	Evidence sent to the service (collector bundles or registry scans), not from a cloud API scan.

What it checks

It passes when:

• ATTRIBUTES: DEBUG, PROVISIONKEY and EINITTOKEN_KEY are clear.

How to fix

• Sign and launch the enclave as a production enclave without the PROVISIONKEY or EINITTOKEN_KEY attributes: a debug enclave's memory is readable by the host, and those keys belong only to Intel's architectural enclaves.

After the fix, scan again: the check should report PASS.

Related

• Other checks for policy P-05: CCA-POL-01, CSPACE-DEBUG-01, SE-POL-01, SNP-POL-01, TDX-POL-01

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).