System Programming in Rust

Abstract

Rust is a new system programming language that offers a practical and safe alternative to C. Rust is unique in that it enforces safety without runtime overhead, most importantly, without the overhead of garbage collection. While zero-cost safety is remarkable on its own, we argue that the superpowers of Rust go beyond safety. In particular, Rust's linear type system enables capabilities that cannot be implemented efficiently in traditional languages, both safe and unsafe, and that dramatically improve security and reliability of system software. We show three examples of such capabilities: zero-copy software fault isolation, efficient static information flow analysis, and automatic checkpointing. While these capabilities have been in the spotlight of systems research for a long time, their practical use is hindered by high cost and complexity. We argue that with the adoption of Rust these mechanisms will become commoditized.

Automatically enforcing fresh and consistent inputs in intermittent systems

“…Pointer alias analysis is a hard problem in C. Missing an alias leads to memory corruption if the compiler fails to checkpoint an aliased memory location that must be checkpointed. Rust's ownership and immutability properties make alias analysis more precise [1]. Sections 5 and 6 describe how this precision benefits Ocelot's analyses.…”

Exploiting Mixed Binaries

“…The ideas behind this, which is generically known as the borrow checker, are central to the language design and are not covered in this article. For more information, we refer the reader to the official documentation [32] and other reviews of the programming language [42,59].…”

“…The ideas behind this, which is generically known as the borrow checker, are central to the language design and are not covered in this article. For more information, we refer the reader to the official documentation [32] and other reviews of the programming language [42,59]. In this article, we only expand on particular features of Rust, which are central to the attacks we present, and these are (a) mixing Rust with C/C++ unsafe code (covered in Section 3.4), and (b) code constructs of Rust that force the compiler to emit indirect branches in the final binary (covered in Section 4).…”

Verification of Programs with Pointers in SPARK

“…Cyclone and Rust achieve absence of harmful aliasing by enforcing an ownership type system on the memory pointed to by objects [13,14]. Furthermore, Rust has many sophisticated lifetime checks, that prevent dangling pointers,…”