Google has announced the inclusion of the Rust programming language among the languages permitted for Android platform development. The Rust compiler was integrated into the Android source tree back in 2019, but support for this language remained experimental. Among the first components to be provided in Android using Rust are new implementations of the Binder inter-process communication mechanism and the Bluetooth stack.
The adoption of Rust is part of a project aimed at enhancing security, promoting safe programming practices, and improving the detection of memory-related issues in Android. It is noted that approximately 70% of all critical vulnerabilities identified in Android are caused by memory management errors. The use of Rust, which focuses on safe memory operation and provides automatic memory management, will reduce the risk of vulnerabilities resulting from memory management errors, such as accessing memory after it has been freed and buffer overflows.
Safe memory operation in Rust is ensured at compile time through reference checks, ownership tracking of objects, and consideration of object lifetimes (scope), as well as assessing correct memory access during code execution. Rust also provides tools to guard against integer overflows, mandates mandatory initialization of variable values before use, better handles errors in the standard library, adopts the concept of immutability for references and variables by default, and offers strong static typing to minimize logical errors.
In Android, safe memory operation is ensured in already supported languages such as Kotlin and Java, but they are not suitable for developing system components due to high overhead. Rust enables performance close to that of C and C++, making it suitable for developing low-level parts of the platform and components for hardware interaction.
To ensure the security of code in C and C++ on Android, sandbox isolation, static analysis, and fuzz testing are applied. The sandbox isolation capabilities are limited and have reached the limit of their effectiveness (further fragmentation into processes is inefficient in terms of resource consumption). Limitations of sandbox usage include significant overhead and increased memory consumption caused by the need to spawn new processes, as well as the introduction of additional delays associated with IPC usage.
However, the sandbox does not eliminate vulnerabilities in the code; it only reduces risks and complicates the execution of an attack since exploiting requires identifying not just one but several vulnerabilities. Code testing methods are limited by the need to create conditions for manifesting the problem to detect errors. It is not feasible to cover all possible scenarios, therefore many errors remain unnoticed.
For system processes in Android, Google adheres to the 'principle of two', which states that any added code must fall under no more than two of three conditions: handling unverified input, using an unsafe programming language (C/C++), and executing without strict sandbox isolation (having elevated privileges). From this rule, it follows that the code for processing external data should either be trimmed to minimal privileges (isolated) or be written in a safe programming language.
Google does not aim to rewrite the existing C/C++ code in Rust but plans to use this language for developing new code. Using Rust for new code makes sense, as statistically, most errors emerge in new or recently modified code. Notably, about 50% of identified memory-related errors in Android are found in code written less than a year ago.
Source: opennet.ru
