Re: Rust kernel policy

Bart Van Assche
2025-02-23T02:08:58Z

On 2/22/25 8:04 AM, Kent Overstreet wrote:
> On Wed, Feb 19, 2025 at 06:39:10AM +0100, Greg KH wrote:
>> Rust isn't a "silver bullet" that will solve all of our problems, but it
>> sure will help in a huge number of places, so for new stuff going
>> forward, why wouldn't we want that?
>
> I would say that Rust really is a silver bullet; it won't solve
> everything all at once but it's a huge advance down the right path, and
> there's deep theoretical reasons why it's the right approach - if we
> want to be making real advances towards writing more reliable code.

The ultimate goal is probably that we can prove that code will behave as
intended before it is run. That goal might be difficult to achieve. It
would e.g. require a formal specification of the requirements, a formal
specification of the hardware the Linux kernel is interacting with and
software that helps with generating correctness proofs.

This goal falls outside the scope of the Rust programming language.

The following issues are not addressed by the Rust programming language
(this list is probably incomplete):
* Preventing DMA controller misconfiguration. This is a potential source
of memory corruption that falls outside the scope of the Rust type
system.
* Preventing privilege escalation issues.
* Preventing security configuration errors.

As an example, one of the most significant security incidents,
log4shell, is a type of security vulnerability that cannot be prevented
by the selection of the programming language.

Bart.