# Oak Functions binaries with logging from Wasm disabled

Claim ID: 75606\
Link to self:
https://github.com/project-oak/oak/blob/main/docs/tr/claim/75606.md

Oak Functions API provides a
[`Log` method](https://github.com/project-oak/oak/blob/main/proto/oak_functions/sdk/oak_functions_wasm.proto#L56)
that the (untrusted) Wasm code can use for arbitrary logging.

As this can provide a way to exfiltrate data, Oak provides pairs of Oak
Functions binaries:

- `oak_functions_container` and `oak_functions_enclave_app` _disables_ logging
  from Wasm code (`Log` calls are dropped)
- `oak_functions_insecure_container` and `oak_functions_insecure_enclave_app`
  forward `Log` calls to the system log, making them visible.

Endorsements containing this claim assert that no logging from Wasm code happens
in the underlyinb binary.
