Linux 7.3 Will Disable RandStruct by Default for the Sake of Rust Support

The Linux kernel developers have adopted a change that alters the default configuration behavior: the RandStruct protection feature will now be disabled if the system has a working Rust toolchain and Rust support for the corresponding processor architecture. The patch has already been merged into the kernel's Git tree ahead of the release of Linux 7.3-rc2, expected this weekend.

What the conflict is about

RandStruct is a security-hardening mechanism that, at build time, randomly shuffles the in-memory layout of sensitive C structures in the kernel. This makes exploiting vulnerabilities harder, since an attacker can't know in advance exactly where the fields they need are located.

The problem is that RandStruct can't work with Rust code. Because of this, dependencies are written into Kconfig that forbid enabling Rust and RandStruct at the same time. In practice, this got in the way of building the kernel with Rust support in the allmodconfig configuration — the standard build that enables all kernel modules and is used to check coverage. RandStruct was enabled by default, and the !RANDSTRUCT dependency would then automatically disable Rust.

A compromise solution

The author of the change, Mark Brown, explained the reasoning in the patch description: they decided to work around the problem by having RandStruct now be disabled by default whenever a working Rust toolchain and Rust support for the architecture are available. Circular dependencies prevent tying it directly to the !RUST condition, so the solution turned out to be less than ideal. As Brown himself honestly admits, you can end up with a configuration where both Rust and RandStruct are disabled at once — but, in his words, such an approach “is more likely to give the expected result.”

In other words, in order for Rust to participate fully in test builds, the developers agreed to sacrifice a security-hardening feature by default. The irony of the situation is that Rust is usually presented as a language that improves memory safety — and here its presence leads to another protective measure being turned off.

What to do for those who care about protection

Phoronix notes that in the future Rust and RandStruct will probably learn to coexist, but for now the default configuration takes the path of disabling protection wherever Rust is available. If you do need RandStruct, you can always build the kernel with a non-standard configuration that disables Rust support.

Source: Phoronix