Fidelius Charm: Isolating Unsafe Rust Code
The Rust programming language has a safe memory model that
promises to eliminate critical memory bugs. While the language is
strong in doing so, its memory guarantees are lost when any unsafe
blocks are used. Unsafe code is often needed to call library functions
written in an unsafe language inside a Rust program. We present
Fidelius Charm (FC), a system that protects a programmer-specified
subset of data in memory from unauthorized access through vulner-
able unsafe libraries. FC does this by limiting access to the program’s
memory while executing unsafe libraries. FC uses standard features
of Rust and utilizes the Linux kernel as a trusted base for splitting
the address space into a trusted privileged region under the control
of functions written in Rust and a region available to unsafe exter-
nal libraries. This paper presents our design and implementation
of FC, presents two case studies for using FC in Rust TLS libraries,
and reports on experiments showing its performance overhead is
low for typical uses.
Almohri, H. M. J., and Evans, D. “Fidelius Charm: Isolating Unsafe Rust Code.” ACM Conference on Data and Application Security and Privacy, Mar. 2018, pp. 248–255.