Rust User-Mode Program Management with Privilege-Bound Unsafe Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of the unsafe keyword in Rust-based operating systems poses significant security and stability risks due to the potential for incorrect usage, leading to system instability and crashes, and existing management systems fail to effectively restrict its use.
Innovation Solution
Implement a management architecture that separates code into privilege and non-privilege levels, with the privilege level allowing unsafe code usage only for essential security protection, while non-privilege code is restricted from using unsafe keywords, and includes modules like the user-mode interface, basic code, and thread management to ensure secure execution and minimize the trusted base.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the unsafe keyword is used to enable special operations and higher performance in Rust code, then program functionality and performance are improved, but system stability and security deteriorate due to potential incorrect usage and trust burdens
Solution Approach 1:
The patent segments the operating system code into privilege-level code (kernel mode) and non-privilege-level code (user mode). The unsafe keyword is restricted to privilege-level code only, creating clear boundaries that prevent incorrect usage in user-mode code while preserving necessary functionality in kernel-mode code.
Solution Approach 2:
The patent introduces a compiler intermediary mechanism that automatically inserts safety check code around unsafe blocks. This intermediary layer monitors and validates unsafe operations, preventing incorrect usage while maintaining the intended functionality and performance benefits of unsafe code.
2Productivity
If the unsafe keyword is extensively used to implement special functions and optimize performance, then program capabilities are enhanced, but the trusted base and security risks increase
Solution Approach 1:
The patent segments code execution into privileged and unprivileged regions, allowing high-performance unsafe code to exist only in the privileged kernel region where it can be tightly controlled and reviewed, while user-mode code operates in an unprivileged region without unsafe capabilities.
Solution Approach 2:
The patent applies different security qualities to different parts of the system: privilege-level code receives full unsafe capabilities with rigorous review, while non-privilege-level code receives restricted capabilities without unsafe keywords, creating localized security zones with appropriate trust levels.
3Reliability
If compiler checks are applied to all code to ensure safety, then system security is improved, but code flexibility and ability to perform special operations deteriorate
Solution Approach 1:
The patent implements dynamic security checking where the level of compiler enforcement varies by execution context. In privilege-level code, compiler checks are relaxed to allow unsafe operations, while in non-privilege-level code, strict compiler checks prevent unsafe operations, providing context-dependent flexibility.
Solution Approach 2:
The patent introduces a compiler intermediary that selectively applies safety checks based on code location and context. The intermediary inserts checks only where necessary while allowing unsafe operations in privileged contexts, balancing security enforcement with code flexibility.
Data Source
AI summary
Embodiments of this specification provide a method and an apparatus for managing a user-mode program in a target operating system. The target operating system is written in a Rust language. The Rust language includes an unsafe keyword. The method includes: in response to a kernel processing program requesting, by calling an interface function, to enter a user mode to execute a target program, confirming, by the user-mode interface module, security of a register access related to the request, where the kernel processing program is located at a non-privilege level and has no permission to use the unsafe keyword, and the user-mode interface module does not include the unsafe keyword; and activating, by the basic code module, a target page table corresponding to the target program through the register access by using first code that includes the unsafe keyword, and setting a mode of the operating system to the user mode.