Use security enclaves

[ivanpauno]

Feature request

Feature description

Tracking issue for changes started in #177.
Design document: ros2/design#274

Implementation considerations

• Update policy schema with contexts (Use Contexts #177)
• Update policy transforms for DDS (Use Contexts #177)
• Update keystore layout with pubic, private, contexts sub folders (Use Contexts #177)
• Update existing tests and downstream packages (Use Contexts #177)

---

• security-context -> enclave
  • security-context -> enclave rcl#612
  • security-context -> enclave rmw#211
  • security-context -> enclave rmw_connext#407
  • security-context -> enclave rmw_cyclonedds#146
  • security-context -> enclave rmw_dds_common#13
  • security-context -> enclave rmw_implementation#91
  • Enclaves rmw_fastrtps#365
  • security-context -> enclave #198
  • security-context -> enclave system_tests#414

---

• Update policy auto generation (Update generate_policy verb for enclaves #203).
• Make use of context name validation, instead of using namespace validation for it. Requires Add a way to validate a security context name rclpy#528.
• Update documentation (update basic tutorials for foxy #201)
• Support for metadata and type attribute
  • e.g. associating profiles to domains, validity times, singing CA
  • may need more thought, could look back at keymint for config patterns
• Fix security directory lookup for '/' security contexts Fix security directory lookup for '/' security contexts rcl#609
• Add security context introspection Add enclaves introspection method in Node rclpy#538

[ruffsl]

I've add the draft PR started by @mikaelarguedas , as well as ros2/rcl#609 and ros2/rclpy#538 . Given some are in flight, we'll want to make sure to refactor enclave changes depending on which merge.

[mikaelarguedas]

@ivanpauno Is it still on your radar to update and reenable policy generation ?
Update policy auto generation. Disabled in #177. Would require ros2/rclpy#529 to be re-enabled.

[ivanpauno]

@ivanpauno Is it still on your radar to update and reenable policy generation ?
Update policy auto generation. Disabled in #177. Would require ros2/rclpy#529 to be re-enabled.

No sorry, I won't have the time to do it in a near future.
The needed function in rclpy was added ros2/rclpy#538.