A group of developers from China is developing the Asterinas kernel, written in Rust and designed for use in general-purpose operating systems. To simplify integration with already developed system components, the kernel provides an ABI (Application Binary Interface) that is compatible with the Linux kernel and can be used as a substitute. The project's code is distributed under the MPL (Mozilla Public License).
The project has been in development since autumn 2022 and intends to achieve a usable level for widespread use this year. virtual machines with an x86-64 architecture. Starting next year, the main focus will shift to implementing support for hardware and other CPU architectures. Priority application areas include systems tied to Linux ABI that require a higher level of security. For example, Asterinas is proposed for creating a secure system environment. of virtual machines, which utilizes technologies such as ARM CCA, AMD SEV, and Intel TDX, as well as on the host system side that supports container execution.
To reduce the likelihood of memory errors, which are the main source of the most dangerous vulnerabilities, the Asterinas project employs the Rust language and a strategy of limited use of unsafe blocks. The kernel is built using the framekernel architecture, where developers have attempted to combine the isolation capabilities of microkernels with the efficiency of monolithic kernels.
The kernel components in Asterinas are placed in a shared address space, and security is achieved through logical separation of safe code and code where security issues may arise. The kernel is divided into two parts, written in Rust: OS Framework and OS Services. The use of unsafe blocks is prohibited in OS Services, and all low-level operations requiring execution of code in unsafe blocks are moved to OS Framework, accessible only through a high-level API. All system calls, file systems, and drivers are implemented at the OS Services level and cannot include unsafe blocks.
When developing system services and kernel modules, it is suggested to use the OSDK (Operating System Development Kit), which provides the cargo-osdk utility for creating, building, testing, and launching operating system components. A set of OSTD (Operating System Standard Library) libraries has been prepared for developers, which is an edition of the standard Rust libraries (crate std) adapted for use in operating system components.
Source: opennet.ru
