4 ms·
A lot of people have proposed using Rust for OS development. There are even plans to write Linux kernel modules in Rust. I think this article is a very good de
by kramerger 4y ago
A lot of people have proposed using Rust for OS development. There are even plans to write Linux kernel modules in Rust.
I think this article is a very good demonstration of why Rust is not a silver bullet. It was created with userspace applications in mind and a system application is an entirely different beats.
Think about it this way: in C it is easy to shoot yourself in the foot. But in kernel space you can easily blow up the entire building.
- pornel 4y agoIt doesn't have to be a silver bullet to be a net improvement. There's a ton of other code in firecracker that is using safe Rust, and without that safety we could have had this bug and more. This bug exists because it's exactly C-style code manipulating buffers using raw pointers without length instead of slices.
- staticassertion 4y agoI kind of took the opposite away from this work. I think that after digging into Firecracker it was clear that exploitation of Rust code is extremely difficult.
- tptacek 4y agoThis bug is one of the exceptions that proves the rule about memory safety: it occurred because the KVM interface requires working in memory-unsafe interfaces. Raw pointers in idiomatic Rust code are practically FFI objects. Almost nobody thinks Rust is a silver bullet, but eliminating memory-unsafety is an absolute good; the more of it we can get rid of in the kernel, the better off we'll be.