linux-kernel - Re: Rust kernel policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b0a8ee53b767b7684de91eeb6924ecdf5929d31e.camel@HansenPartnership.com>
Date: Wed, 19 Feb 2025 09:05:48 -0500
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Christoph Hellwig <hch@...radead.org>, Miguel Ojeda
	 <miguel.ojeda.sandonis@...il.com>
Cc: rust-for-linux <rust-for-linux@...r.kernel.org>, Linus Torvalds
 <torvalds@...ux-foundation.org>, Greg KH <gregkh@...uxfoundation.org>,
 David Airlie <airlied@...il.com>, linux-kernel@...r.kernel.org,
 ksummit@...ts.linux.dev
Subject: Re: Rust kernel policy

On Tue, 2025-02-18 at 08:08 -0800, Christoph Hellwig wrote:
> Where Rust code doesn't just mean Rust code [1] - the bindings look
> nothing like idiomatic Rust code, they are very different kind of
> beast trying to bridge a huge semantic gap.  And they aren't doing
> that in a few places, because they are showed into every little
> subsystem and library right now.

If you'll permit me to paraphrase: the core of the gripe seems to be
that the contracts that underlie our C API in the kernel are encoded
into the rust pieces in a way that needs updating if the C API changes.
Thus, since internal kernel API agility is one of the core features we
value, people may break rust simply by making a usual API change, and
possibly without even knowing it (and thus unknowingly break the rust
build).

So here's a proposal to fix this: could we not annotate the C headers
with the API information in such a way that a much improved rust
bindgen can simply generate the whole cloth API binding from the C
code?  We would also need an enhanced sparse like tool for C that
checked the annotations and made sure they got updated.  Something like
this wouldn't solve every unintentional rust build break, but it would
fix quite a few of them.  And more to the point, it would allow non-
rust developers to update the kernel API with much less fear of
breaking rust.

Regards,

James