Re: [Ksummit-discuss] [TECH TOPIC] Rust

From: "Theodore Ts'o" <tytso@mit.edu>
To: Linus Walleij <linus.walleij@linaro.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>,
	James Bottomley <James.Bottomley@hansenpartnership.com>,
	Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
	Jens Axboe <axboe@kernel.dk>,
	Christoph Hellwig <hch@infradead.org>,
	Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>,
	ksummit@lists.linux.dev
Subject: Re: [Ksummit-discuss] [TECH TOPIC] Rust
Date: Sat, 25 Jun 2022 22:52:27 -0400	[thread overview]
Message-ID: <YrfJ63hN+htFMQVA@mit.edu> (raw)
In-Reply-To: <CACRpkdY1UUqvhKj+a9hOkQo1XG27TvLqweB-EgMdrFuzP38Afw@mail.gmail.com>

On Sun, Jun 26, 2022 at 12:29:27AM +0200, Linus Walleij wrote:
> 
> I think it is important to keep in mind that Rust may save us
> from a few crashes when used in drivers, but that can't be the
> main target for Rust.
> 
> Rust needs to be put facing the enemy, i.e. people who exploit the
> kernel to run arbitrary code and gain local root.

In order to solve the problem you've articulated, the entire kernel
would have to be rewritten in Rust.  And that's not going to happen
for... a while.

Rust has more opportunities to improve things in drivers because (a)
they aren't tested as well (for example, it's a lot harder for fuzzers
to exercise drivers if the hardware isnt available on the VM or server
where the fuzzers are running), and (b) very often drivers are written
by less experienced engineers --- in some cases the drivers are
authored by hardware engineers.

> OK the USB protocol may be close to the driver but
> I'm thinking the network stack and I think during initial review I
> suggested things like ksmbd as Windows SMB is known to have been
> exploited by intelligence agencies we know things like that is facing
> the enemy. I don't know what the ksmbd people feel about that, or
> nfsd for that matter, but this kind of code is what matters most
> for Rust deployment to pay off.

ksmbd needs to interface with a large number of subsystems that are
written in C.  So even if you rewrite ksmbd in Rust, it will need to
made a huge number of unsafe calls into C code.  Speaking personally
my solution for ksmbd is "Just Say No".  Obviously, that won't be a
solution for everyone, but if you want a short-term solution, and you
care more about security than performance, I'd suggest using a
userspace file server, such as Samba or Ganesha.

Cheers,

					- Ted