Linux 7.3 Now Disabling RandStruct Security Feature By Default If Rust Support Present

While Rust programming language use may help with memory safety and other security advantages, the default Linux kernel configuration is now losing randomization of sensitive kernel structures if Rust support is present. Affecting the default Linux kernel configuration, RandStruct will now be off-by-default to allow for better Rust coverage with allmodconfig support for building all kernel modules. RandStruct is a security hardening feature that randomizes the memory layout of the C structures in the kernel at build-time. Mark Brown who authored the now-merged change explained in the patch: "Currently randstruct does not support rust so we have Kconfig dependencies which prevent rust being enabled when randstruct is. Unfortunately this prevents rust being enabled in allmodconfig, our standard coverage build. randstruct gets turned on by default, then the dependency on !RANDSTRUCT causes rust to get disabled. Work around this by disabling randstruct by default if we have a usable rust toolchain and rust support for the architecture, circular dependencies prevent us directly depending on !RUST. This means we might end up with a configuration that disables both rust and randstruct but hopefully it's more likely go give the expected result." The change was merged yesterday to Linux Git ahead of Linux 7.3-rc2 due out this weekend. Hopefully Rust will end up playing nicely with the Linux kernel's RandStruct support in the future but for now the default kernel configuration is going ahead and disabling the security feature where as mentioned a Rust toolchain is available and Rust kernel support for the CPU architecture in use. If wanting this security hardening feature, you can always use a non-default kernel configuration with Rust support disabled.