systemd Adds Rust Program Support

systemd, the system and service manager used by many modern Linux operating systems, shipped support for writing programs in Rust.

Rust is a programming language touted for being fast, low-level, and safe.

One of the most common types of vulnerabilities is memory safety vulnerabilities, where memory is mishandled and potentially accessed or manipulated when it's not supposed to be. Estimates from Microsoft and Google put the prevalence of memory safety vulnerabilities at around 70%, however efforts to move to memory-safe languages have drastically reduced this number in Google's case.

Namely, their adoption of Rust for new code in Android has had a massive impact on the prevalence of memory safety issues. However it's not practical to rewrite all old code in Rust, so likely memory safety bugs will continue to haunt software for many years to come.

But, it's hard to argue with the results: going from 76% of bugs in Android being memory safety issues to just 24% is nothing to scoff at.

The Linux kernel itself, which Android uses, has been making progress with the Rust for Linux project for years now. The Linux kernel is millions and millions of lines of code, though, so making a dent in it is an uphill battle.

The systemd Rust support is only for new leaf components, according to the GitHub pull request, and pre-existing C code won't be ported over.

There is no Cargo, Rust's package manager, and everything is built with Meson. There's also no other crates besides the core, alloc, and libc crates.

C linkage is mandatory as well for now.

Rust is optional but the support itself is a big step toward memory safety in Linux distributions. As AI-assisted security research finds more and more bugs in the Linux kernel, it's going to be important to reduce the attack surface as much as possible.

Linux is already removing old, barely used code to stave off the deluge of AI bug reports.

Some organizations like Mozilla have embraced the use of AI-assisted security research, but it's hard to deny the impact of the current wave of bug reports putting strain on projects. Some have resorted to shutting down their bug bounty program to avoid the landslide of AI slop.