The project goal: Build a platform that can translate repositories of C code into behaviorally correct, maintainable Rust.
Rust is slated to play a huge part in Ubuntu’s future. As a language that allows programmers more control over resource use and performance as well as removing many classes of memory safety issues, it’s an especially good choice for building security-sensitive software.
But modernizing huge amounts of the legacy C code that currently powers the Linux operating system has been, and continues to be, a major challenge.
“Rewrites have long been expensive and risky, and do not often materialize obvious improvements. Established codebases often contain years of bug fixes, compatibility decisions, operational knowledge, and hard-won performance optimizations,” Jon Seager, VP engineering at Canonical wrote In a blog post on Wednesday. “If we want more systems software to benefit from memory safety, we need better ways to reduce the cost and risk of migration.”
To that end, Canonical, along with UK Research and Innovation, is funding a three year PhD project to create a platform that will translate hundreds of thousands of lines of C code into Rust. The project will be led by Professor Meng Wang, with Seager and Dr. Cristina David as co-supervisors of PhD student Alex Wood.
It’s not as easy as it may sound, Seager wrote. “Traditional source-to-source translators can process substantial amounts of code, but often preserve the structure of the C too literally. The result may compile as Rust, but still rely heavily on unsafe operations, retain awkward C idioms and require significant manual work before it resembles code a Rust maintainer would choose to own.”
On the other hand, a large language model (LLM) can create “convincing, idiomatic Rust” but struggles with “repository-scale context,” Seager said. And, he added, “more importantly, plausible-looking output is not evidence that the translated program behaves like its source.”
Thus, the project will combine the two techniques, machine learning and conventional program analysis, to build the system.
Its proposed architecture consists of four components: scheduling, which will split a repository into chunks containing sufficient context to give the translation mechanism understanding of types, dependencies, and behavior; translation using models trained against a library of known C-to-Rust translations; validation to check that the translation behaves like its C source; and debugging and repair to analyze and correct issues.
“Here,” Seager wrote, “the language model is only one component in the system. Generated code should be treated as untrusted until there is evidence that it preserves the desired behavior.”
Two Ubuntu security components, AppArmor and snap-confine, will be targeted as case studies. “This is not a commitment to replace AppArmor or snap-confine with what is generated,” Seager noted, but “rather that we have a vested interest in the software and are keen to see the results.”
The project’s “most optimistic outcome,” Seager said, “would be a system capable of translating substantial C repositories into Rust with strong evidence of behavioral equivalence and relatively little manual intervention. The research could also produce better methods for decomposing repositories, stronger validation techniques, reusable translation datasets, improved program-repair tools, and a more precise understanding of where automated migration stops being reliable.”
