{"id":183346,"date":"2026-09-14T10:53:47","date_gmt":"2026-09-14T08:53:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ubuntu-26-10-polnostyu-perevedyon-na-rust-coreutils"},"modified":"2026-09-14T10:53:51","modified_gmt":"2026-09-14T08:53:51","slug":"ubuntu-26-10-fully-switches-to-rust-coreutils","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ubuntu-26-10-fully-switches-to-rust-coreutils","title":{"rendered":"Ubuntu 26.10 Fully Transitioned to Rust Coreutils","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the package base of the Ubuntu 26.10 distribution, scheduled for release on October 15, there has been a complete transition to the uutils coreutils (Rust Coreutils) toolkit, written in Rust. The utilities from Rust Coreutils have fully replaced all components of the GNU Coreutils package, including the cp, mv, and rm utilities, which were supplied in Ubuntu 26.04 from GNU Coreutils. <\/p>\n
The rust-coreutils package was initially included by default in the Ubuntu 25.10 release, but in the LTS branch of Ubuntu 26.04, there was a rollback to supplying the cp, mv, and rm utilities from the GNU Coreutils set. The cp, mv, and rm variants were reinstated due to security issues identified during an audit of the Rust Coreutils codebase. Most vulnerabilities in Rust Coreutils are caused by the presence of a race condition that allows data to be modified after validation but before the operation on it is executed (TOCTOU \u2014 Time-Of-Check-To-Time-Of-Use). Among other things, such vulnerabilities allow a file to be replaced with a symbolic link in the time between the completion of the check and the start of the operation. <\/p>\n
In the context of using the cp, mv, and rm utilities in system scripts running with root privileges, substituting a symbolic link enables the copying, overwriting, or deletion of arbitrary files. For instance, during recursive directory deletions, the rm utility first checked all directories and then removed them sequentially in reverse order by calling the rmdir() function. If the parent directory is substituted with a symbolic link immediately after checking this directory but before checking the nested child directories, it could lead to the deletion of any directory in the system during the daily execution of the script \/etc\/cron.daily\/apport, which, running with root privileges, recursively deletes the contents of the \/var\/crash directory, writable by all users in the system. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"