Intel® Software Guard Extensions SDK for Linux\* OS

July 3, 2026 · View on GitHub

Introduction

Intel® Software Guard Extensions (Intel® SGX) is an Intel technology for application developers seeking to protect select code and data from disclosure or modification.

This repository hosts the Intel® SGX SDK and the Intel® SGX enclave runtime for Linux*. It provides the trusted and untrusted libraries, the build and signing tools (sgx_edger8r, sgx_sign, ...), the untrusted runtime system (urts) and the enclave-common loader API, and a set of code samples. It is part of the confidential-computing.sgx project: it is consumed there as the sdk submodule, and it also builds on its own.

Note

:jigsaw: This repository is the extracted Intel® SGX SDK

Starting with release 2.30, the SDK (including samples) and the SGX enclave runtime libraries were split out of the consolidated :octocat: confidential-computing.sgx project (previously under sdk/ and psw/) and are vendored back there as the sdk submodule.1

The Intel® SGX SDK for Windows* is published separately, through NuGet and the Intel Download Center; this repository tracks the Linux* sources.

Note

The Linux* kernel includes the SGX driver since mainline release 5.11 — no separate driver installation is needed on modern kernels. Device nodes are at /dev/{sgx_enclave, sgx_provision}. The platform must support and have Flexible Launch Control configured.

Related Projects

The confidential-computing.sgx project assembles this SDK repository with the Intel® SGX PSW, packaging, and reproducibility tooling. See its Quick Start for end-to-end stack bring-up and its installation guidance when you need the full software stack rather than just the SDK.

The intel-sgx-ssl project provides a full-strength general purpose cryptography library for Intel® SGX enclave applications. It is based on the underlying OpenSSL* Open Source project. Intel® SGX SDK provides a build combination to build out a SGXSSL-based SDK. Users can also use this cryptography library in SGX enclave applications separately.

The Intel® SGX Data Center Attestation Primitives (DCAP) project provides libraries and tools for ECDSA-based remote attestation. For concrete remote-attestation examples, start with the QuoteGenerationSample and QuoteVerificationSample in the DCAP repository's SampleCode/.

Repository layout

  • sdk/ — the Intel® SGX SDK: the trusted runtime and libraries (trts, tlibc, tlibcxx, tlibcrypto, tservice, tprotected_fs, ...), untrusted helper libraries, and the host tools (sgx_edger8r, sgx_sign, sgx_encrypt, ...).
  • enclave_runtime/ — enclave runtime (launch) components of Intel® SGX Platform Software (PSW): the untrusted runtime system (urts) and the enclave-common loader API (enclave_common).
  • SampleCode/ — sample enclaves and host applications.
  • common/ — shared headers and support code, including SGX API headers in common/inc/; the runtime-facing subset is provided by the libsgx-headers DEB/RPM package.
  • external/ — third-party dependencies consumed as submodules (IPP crypto, protobuf/abseil, OpenMP, libcxxrt, cbor, SGX EMM, ...).
  • build_infrastructure/ — packaging, installer and reproducibility scripts, including Docker container build helpers.

License

See License.txt for details.

Contributing

See CONTRIBUTING.md for details.

For questions and general discussion, the Intel® SGX community forum is a good place to start.

Documentation

Downloads

Pre-built packages and the SDK installer binary for Linux are published on 01.org as part of the confidential-computing.sgx release:

For package repository setup, package-signing details, and Windows* distribution notes, see the consolidated repository's Downloads section.

Quick Start

Choose the path that matches your goal:

Containerized sample bring-up

For a single sample-enclave bring-up in Docker, this repository includes two containerized paths:

Supported Operating Systems

The following Linux* distributions are supported for both building and installing the Intel® SGX SDK and enclave runtime:

  • Ubuntu* Server (64-bit): 22.04, 24.04, 26.04 LTS
  • Red Hat Enterprise Linux* Server (64-bit): 9.6, 9.8, 10.0, 10.2
  • CentOS* Stream (64-bit): 9, 10
  • SUSE Linux Enterprise Server* (64-bit): 15 SP7, 16
  • Anolis* OS (64-bit): 8.10
  • Azure* Linux (64-bit): 3.0
  • Debian* (64-bit): 10, 12, 13

Building

Prerequisites

  • Ensure that you have one of the supported operating systems.

  • Use the following command(s) to install the required tools to build the Intel® SGX SDK:

    • On Debian 10, Debian 12, and Debian 13: 
      sudo apt-get install build-essential ocaml ocamlbuild automake autoconf \
    libtool wget python3 libssl-dev git cmake perl
sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
    • On Ubuntu 22.04, Ubuntu 24.04, and Ubuntu 26.04: 
      sudo apt-get install build-essential ocaml ocamlbuild automake autoconf \
    libtool wget python-is-python3 libssl-dev git cmake perl
    • On Red Hat Enterprise Linux 9 and 10: 
      sudo yum groupinstall 'Development Tools'
sudo yum install ocaml ocaml-ocamlbuild wget python3 openssl-devel git cmake perl
    • On CentOS Stream 9 and 10, and Azure Linux 3.0: 
      sudo dnf group install 'Development Tools'
sudo dnf install ocaml ocaml-ocamlbuild redhat-rpm-config openssl-devel \
    wget rpm-build git cmake perl python3
    • On Anolis OS 8.10: 
      sudo dnf group install 'Development Tools'
sudo dnf --enablerepo=powertools install ocaml ocaml-ocamlbuild \
    redhat-rpm-config openssl-devel wget rpm-build git cmake perl python3
sudo alternatives --set python /usr/bin/python3
    • On SUSE Linux Enterprise Server 15 SP7 and 16: 
      sudo zypper install --type pattern devel_basis
sudo zypper install ocaml ocaml-ocamlbuild automake autoconf libtool wget \
    python3 libopenssl-devel rpm-build git cmake perl
sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1

    ℹ️ Note: To build the Intel® SGX SDK, gcc 7.3+ and glibc 2.27+ are required.

  • Clone this repository and prepare the submodules and prebuilt binaries:

    git clone --recurse-submodules \
    https://github.com/intel/confidential-computing.sgx.sdk.git sgx-sdk
cd sgx-sdk && make preparation

    make preparation initialises git submodules, applies patches, and runs build_infrastructure/download_prebuilt.sh to fetch prebuilt binaries. If you prefer to initialise submodules manually, do so before running make preparation:

    git submodule update --init --recursive

    💡 Tip: download_prebuilt.sh uses wget to fetch over the network. If you are behind a proxy, set the relevant proxy variables first, e.g.:

    export https_proxy=http://proxy:port
export no_proxy=localhost,127.0.0.1

    ℹ️ Note: When pulling a new release, run make distclean first if patched submodules changed — this avoids patch conflicts (error: Your local changes to the following files would be overwritten by checkout). Caution: this deletes all submodule working trees; commit any local changes first.

    make distclean

  • (Debian 10 only) The system binutils on Debian 10 lack mitigation options support. Copy the patched tools downloaded by make preparation to /usr/local/bin:

    sudo cp external/toolset/debian10/* /usr/local/bin

    Repeat after any update to ensure the latest versions are used.

Build the Intel® SGX SDK

Note

After pulling a new release, run make distclean and make preparation again to update changed submodules.

  • To build the Intel® SGX SDK with the default configuration:

    make sdk

    make sdk runs three sequential sub-make passes with MITIGATION-CVE-2020-0551 set to LOAD, CF, and unset, producing a full set of mitigation variants in build/.

    Key build variables (passed as make <target> VAR=value):

    VariableDefaultEffect
    USE_OPT_LIBS1Crypto library choice (see below)
    DEBUG0Set to 1 to include debug symbols

    USE_OPT_LIBS combinations:

    • ValueCrypto
      0SGXSSL (:warning: this flavor is deprecated)
      1 (default)IPP

      To use a non-default crypto combination:

      make sdk USE_OPT_LIBS=0

      ℹ️ Note: USE_OPT_LIBS=2 and USE_OPT_LIBS=3 (using the prebuilt "optimized" Intel string/math libraries) have been removed. The last release to support them is 2.29. Passing either value now aborts the build with an error.

      Use USE_OPT_LIBS=0 (SGXSSL) or USE_OPT_LIBS=1 (IPP); both build the open-sourced string/math libraries.

      • Caution: USE_OPT_LIBS=0 flavor (OpenSSL-based) is deprecated. Support is planned to be removed in an upcoming release. Consider migrating to the default (IPP-based) variant.

  • To build without CVE-2020-0551 mitigations (single pass):

    make sdk_no_mitigation

  • To build the Intel® SGX SDK with debug information:

    make sdk DEBUG=1

  • To clean the files generated by a previous make sdk:

    make clean

  • To build and package the SDK installer:

    make sdk_install_pkg

    sdk_install_pkg depends on sdk, so it runs all three mitigation-mode passes automatically before packaging. The result is a single .bin installer (sgx_linux_x64_sdk_${version}.bin under build_infrastructure/linux/installer/bin/) that bundles all three mitigation variants (LOAD, CF, none). There is no need to run make sdk separately first.

    To include debug symbols in the installer:

    make sdk_install_pkg DEBUG=1

    For a no-mitigation-only installer:

    make sdk_install_pkg_no_mitigation

Build the Intel® SGX Enclave Runtime Packages

The SGX enclave runtime (libsgx-urts, libsgx-enclave-common) lives in enclave_runtime/ and is packaged here independently of the SDK installer. The consolidated repo (confidential-computing.sgx) pulls these in automatically as part of make deb_local_repo / make rpm_local_repo.

  • To build and package the enclave runtime (DEB — libsgx-urts, libsgx-enclave-common, libsgx-headers): 
    make deb_sgx_sdk_pkg
    Or individually: 
    make deb_libsgx_urts
make deb_libsgx_enclave_common
  • To build and package the enclave runtime (RPM): 
    make rpm_sgx_sdk_pkg
    Or individually: 
    make rpm_libsgx_urts
make rpm_libsgx_enclave_common
  • To build the runtime libraries only (without packaging): 
    make enclave_runtime

Installation

Before installing, ensure that:

  • Your system runs one of the supported operating systems.
  • Install the runtime prerequisites for your distribution:
    • On Debian 10, Debian 12, and Debian 13: 
      sudo apt-get install build-essential python3
sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1
    • On Ubuntu 22.04, Ubuntu 24.04, and Ubuntu 26.04: 
      sudo apt-get install build-essential python-is-python3
    • On Red Hat Enterprise Linux 9 and 10: 
      sudo yum groupinstall 'Development Tools'
sudo yum install python3
    • On CentOS Stream 9 and 10, and Azure Linux 3.0: 
      sudo dnf group install 'Development Tools'
sudo dnf install python3
    • On Anolis OS 8.10: 
      sudo dnf group install 'Development Tools'
sudo dnf install python3
sudo alternatives --set python /usr/bin/python3
    • On SUSE Linux Enterprise Server 15 SP7 and 16: 
      sudo zypper install --type pattern devel_basis
sudo zypper install python3
sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 1

Install the Intel® SGX SDK

The make sdk_install_pkg build produces the installer at build_infrastructure/linux/installer/bin/sgx_linux_x64_sdk_${version}.bin. Install it as follows (the installer will prompt you to accept the license; adjust --prefix to your preferred location):

cd build_infrastructure/linux/installer/bin
./sgx_linux_x64_sdk_${version}.bin --prefix {SDK_INSTALL_PATH_PREFIX}

Note

Set up the environment variables before compiling your code:

source ${sgx-sdk-install-path}/environment

Install the Intel® SGX Enclave Runtime Packages

This repository also builds the SGX enclave runtime library packages (libsgx-urts, libsgx-enclave-common) and the accompanying development headers package (libsgx-headers).

For package repository setup, distro-specific install commands, upgrade guidance, and optional DCAP/AESM components, follow the consolidated repository's Install the Intel® SGX PSW3 section. If you are bringing up remote attestation, use that guide together with the DCAP samples linked above.

Test the Intel® SGX SDK Package with the Code Samples

  • Compile and run each code sample in Simulation mode to verify the package: 
    cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation
make SGX_MODE=SIM
cd bin && ./app
    Use similar commands for other code samples.

Compile and Run the Code Samples in the Hardware Mode

If you use an Intel SGX hardware enabled machine, you can run the code samples in hardware mode. Ensure that your machine is running a Linux* kernel with SGX driver support4 and that the Intel® SGX PSW is installed. See the confidential-computing.sgx project for how to build and install the Intel® SGX PSW.

  • Compile and run each code sample in hardware mode (debug build):

    cd ${sgx-sdk-install-path}/SampleCode/LocalAttestation
make
cd bin && ./app

    Use similar commands for other code samples.

    ℹ️ Note: On Ubuntu 22.04 or any distro with systemd v248 or later, /dev/sgx_enclave is only accessible by users in the sgx group. Run the enclave application as a user in that group:

    # check systemd version:
systemctl --version
# add the sgx group to the user if v248 or above:
sudo usermod -a -G sgx <username>

Reproducibility

Intel® SGX SDK binaries are built inside a reproducible Docker container to allow independent verification. To reproduce the build environment and verify the binaries, follow the reproducibility README.

Most binaries can be compared against a locally rebuilt output using the standard diff command. A reproducibly built SDK is also a prerequisite for reproducing the Architectural Enclave (AE) binaries in the consolidated repository — see that project's reproducibility README and AE reproducibility verifier for details.

Footnotes

  1. This is a source-layout change only: the consolidated build is unchanged and the released packages, installers and download locations are not affected. ↩

  2. The original standalone doc (329298) has been absorbed into the Intel® Software Developer's Manual (SDM); the two SDM volumes above are the current authoritative references. ↩

  3. In the consolidated repository, the runtime shared libraries (libsgx_urts.so, libsgx_enclave_common.so) are packaged with the Intel® SGX Platform Software (PSW); here they are built directly from enclave_runtime/. ↩

  4. The Linux* kernel contains the necessary driver since the mainline kernel release 5.11. ↩