The upcoming Linux 7.3 kernel release will disable the RandStruct security feature by default if Rust support is present. This change, authored by Mark Brown, aims to allow for better Rust coverage, specifically within the ‘allmodconfig’ build configuration which builds all kernel modules. RandStruct randomizes the memory layout of kernel C structures at build time as a security hardening measure.
Currently, RandStruct is incompatible with Rust, creating a dependency conflict that prevents Rust from being enabled in ‘allmodconfig’ builds. As Mark Brown explained in a patch, “Currently randstruct does not support rust so we have Kconfig dependencies which prevent rust being enabled when randstruct is. Unfortunately this prevents rust being enabled in allmodconfig, our standard coverage build. randstruct gets turned on by default, then the dependency on !RANDSTRUCT causes rust to get disabled.”
The solution implemented disables RandStruct by default when a usable Rust toolchain and Rust support for the CPU architecture are available. Brown notes this approach avoids a circular dependency and is expected to yield the desired result, though it may occasionally disable both Rust and RandStruct. The change was merged into Linux Git ahead of the Linux 7.3-rc2 release, expected this weekend. Users desiring the RandStruct security feature can still enable it by using a non-default kernel configuration with Rust support disabled.
Read the original coverage
💬 Comments
📜 Comment Policy