AI 生成 Rust のコンパイル成功を Canonical が懸念

Canonical wants to know whether automated tools can finally rewrite legacy C code in safe, maintainable Rust without altering the software. That’s why researchers at the University of Bristol are throwing the tool into the deep end with AppArmor and snap-confine.

AppArmor confines applications, while snap-confine creates the sandboxed environments where snaps run. Both perform security-critical jobs, and Canonical isn’t rushing to rewrite either one in Rust, but it wants to find out what evidence maintainers would need before trusting an automated translation of production code.

Proving behavioral equivalence at scale

Canonical’s proposed system will use language models to generate Rust code, then run it through a verification process designed to catch and repair differences in behavior. It’s a recognition that generating code at scale is no longer the hard part — the hard part is proving that code actually does what the original did.

Generated Rust code can compile cleanly while still behaving differently from the original C code. The researchers plan to combine fuzzing with formal program analysis to compare the two implementations and find differences that conventional tests may otherwise miss.

When the system detects a mismatch, it uses symbolic repair to diagnose the exact failure and fix the code directly. That feedback is critical for solving the overuse of unsafe.

Rust’s unsafe blocks allow operations that aren’t permitted in safe Rust, including some forms of raw pointer manipulation. A translator could use them to carry difficult C constructs into Rust, but relying on unsafe too heavily would bring many of the original memory-safety risks into the new code.

The harder target is Rust that is both safe enough to deliver the benefits of the language and close enough in behavior to the original C that maintainers can trust it.

The harder target is Rust that is both safe enough to deliver the benefits of the language and close enough in behavior to the original C that maintainers can trust it.

Security tools raise translation stakes

AppArmor makes a useful test of whether that is possible because mistakes in the translation could have security consequences.

The Linux security module restricts what applications can access according to defined policies. Its surrounding userspace tooling — written in a mix of C, Python, and C++ — has to parse, compile, and load those policies correctly. A Rust port that interprets a policy differently from the existing implementation might compile perfectly and still be wrong. As anyone covering AI-assisted development knows, code that passes every test can still break things in ways no one anticipated.

Snap-confine presents a related challenge because it helps set up the execution environment and confinement used by snaps. Rewriting C in Rust can eliminate entire classes of vulnerabilities, including use-after-free bugs and buffer overflows, but an automated translator can still introduce a logic error. The Bristol team must also show that the focus ion behaves like the original C.

Rewriting C in Rust can eliminate entire classes of vulnerabilities, including use-after-free bugs and buffer overflows, but an automated translator can still introduce a logic error.

Unsafe Rust defeats the purpose

Getting the full benefit of Rust often requires more than translating C syntax line by line. Writing idiomatic Rust can require changes to data structures and lifetimes across several functions or entire modules. An automated translator could stay close to the original C by leaning on unsafe, but those risks carrying the same bugs into the Rust code.

That’s why Canonical is funding the Bristol team to find answers to whether the approach can scale to entire repositories containing hundreds of thousands of lines of C.

Trust, not code, is bottleneck

Operating systems, libraries and infrastructure built over decades are still written in C, and much of that software remains actively maintained and deployed. Rewriting it by hand would take an enormous amount of engineering work and could introduce regressions. But generating code at scale is already a solved problem; the real bottleneck is developer trust. Canonical’s work with Bristol tackles the actual hurdle of proving that the resulting Rust is both memory-safe and functionally identical to the decades-old C it’s designed to replace.

Canonical’s work with Bristol tackles the actual hurdle of proving that the resulting Rust is both memory-safe and functionally identical to the decades-old C it’s designed to replace.

The post AI-generated Rust compiles perfectly. That’s the scary part. appeared first on The New Stack.