Syd: Dɔwɔwɔ ƒe Kernel ŋɔŋlɔ le Rust [Video]

me

Syd nye dɔ gã aɖe si ɖe alesi woateŋu azã Rust atsɔ aŋlɔ dɔwɔwɔ ƒe kernel si le dedie, si wɔa dɔ nyuie — sandboxing layer si xea mɔ na ɖoɖo ƒe yɔyɔwo eye wòkpɔa wo dzi be woakpɔ host systems ta tso dɔwɔwɔ siwo dzi womeka ɖo o me. Video ƒe azɔlizɔzɔ sia ku xɔtuɖaŋu ŋuti nyametsotsowo, dedienɔnɔ ƒe kakaɖedziwo, kple xexeame ŋutɔŋutɔ ƒe dɔwɔwɔ ƒe gɔmesese siwo le xɔtuɖaŋu ƒe akpa vevi sia tɔgbe tutu me le ɖoɖowo ƒe gbegbɔgblɔ si wowɔ na kakaɖedzi me.

Na ƒuƒoƒo siwo le asitsadɔ sesẽwo wɔm — eɖanye to mɔ̃wo abe Mewayz alo ememe dɔwɔnu tɔxɛwo dzi o — alesi egbegbe kernel-level dedienɔnɔ wɔa dɔe gɔmesese le vevie ŋutɔ. Gɔmeɖose siwo le megbe na Syd la gblɔa alesi dɔwɔƒewo ƒe kɔmpiuta dɔwɔɖoɖowo kpɔa nyatakakawo ta, ɖea dɔwɔwɔ ƒe agbawo ɖe vovo, eye wòléa liƒo si dzi zãla 138,000+ nɔa te ɖo gbesiagbe la me ɖe asi tẽ.

Nuka Tututu Nye Dɔwɔwɔ ƒe Kernel Kple Nukatae Wòle Vevie?

Dɔwɔɖoɖo ƒe kernel nɔa zãla-teƒe ƒe ɖoɖowo kple dɔwɔɖoɖoa dome, eye wòwɔa dɔ abe agbonudzɔla ene na dɔwɔɖoɖo ƒe yɔyɔwo. To vovo na OS kernel blibo la, eƒe susu nɔa sandboxing ŋu kpuie — si xea mɔ na nusiwo dɔwɔɖoɖo aɖe koŋ ateŋu akpɔ, atrɔ asi le, alo awɔ. Syd tsɔa susu sia eye wòwɔa eŋudɔ bliboe le Rust me, ewɔa gbea ƒe aƒetɔ ƒe kpɔɖeŋu kple ŋkuɖodzinyawo ƒe dedienɔnɔ ƒe kakaɖedziwo ŋudɔ tsɔ ɖea afɔku ƒe hatsotso blibowo ɖa.

Esia le vevie elabena sandboxing mɔnu xoxowo nɔa te ɖe C-dzi dɔwɔwɔwo dzi zi geɖe afisi buffer ɖeka ƒe yɔyɔ alo use-after-free bug ateŋu agblẽ dedienɔnɔ ƒe liƒo bliboa me. To Rust tiatia me la, Syd dɔa ɖea amedzidzedze ƒe anyigba dzi kpɔtɔna le kɔmpiutadziɖoɖowo ƒe ƒuƒoƒoa ƒe akpa vevitɔ kekeake. Le asitsaƒe siwo kpɔa ganyawo ŋuti nyatakaka veviwo, asisiwo ƒe nuŋlɔɖiwo, kple dɔwɔwɔ ƒe dɔwɔwɔ ƒe ɖoɖowo gbɔ la, xɔtuɖaŋu ƒe tiatia siawo ƒoa ƒu ɖe dedienɔnɔ me tsonu ŋutɔŋutɔwo me.

Nukatae Gbeɖuɖɔ Le Gbegbɔgblɔ Tiatia Na Dedienɔnɔ-Vevietɔ Dɔwɔƒewo?

Rust ƒe dzidziɖedzi le systems programming me menye nusi dzɔ le vo me o. Gbea nana be ŋkuɖodzinu ƒe dedienɔnɔ nanɔ anyi le nuƒoƒoƒuɣi me evɔ meɖoa ŋu ɖe gbeɖuɖɔ nudzɔla ŋu o, si wɔe be wòsɔ etɔxɛe na kɔpi si sea nu le dɔwɔwɔ dzi, si le vevie ŋutɔ le dedienɔnɔ gome. Syd dɔa ɖe Rust ƒe viɖe geɖewo fia siwo ku ɖe dɔwɔƒewo ƒe kɔmpiuta dɔwɔɖoɖowo wɔwɔ ŋu le mɔ gbadza nu:

ƒe nyawo
• Zero-cost abstractions: Kpɔɖeŋu siwo le ɖoƒe kɔkɔwo ƒoa ƒu vaseɖe mɔ̃ ƒe kɔpi nyui dzi, eyata dɔwɔlawo metsɔa dɔwɔwɔ saa vɔe ɖe nuxexlẽ alo dedienɔnɔ ta o.
• Aƒetɔ nyenye kple fedodo: Nuƒoƒoƒula xea mɔ na nyatakakawo ƒe duɖimekeke kple dzesi siwo le ʋuʋum hafi kɔdasia naƒu du gbeɖeka, si ɖea dedienɔnɔ ƒe gbɔdzɔgbɔdzɔtsoƒe siwo bɔ wu le ɖoɖowɔɖi ƒe kɔmpiuta dɔwɔɖoɖowo me ɖa.
• Vɔvɔ̃manɔmee ƒe ɣeyiɣi ɖeka me: Syd kpɔa sandbox ƒe dɔwɔwɔ geɖewo gbɔ le ɣeyiɣi ɖeka me ka-dedienɔnɔ ƒe vodada siwo ɖea fu na C kple C++ dɔwɔwɔwo manɔmee.
• Rich type system: Encoding invariants in types fia be woléa susuŋudɔwɔwɔ ƒe vodada geɖewo le nuƒoƒoƒu me tsɔ wu be woalée le ewɔwɔ me, si ɖea dɔwɔwɔ ƒe agba si le ƒuƒoƒo siwo kpɔa ɖoɖo sesẽwo dzi dzi kpɔtɔna.
• Nugbenɔnɔ ƒe ɖoɖo si le tsitsim: Crates na seccomp, ptrace, kple Linux ŋkɔteƒe dzikpɔkpɔ na Rust va le dɔ wɔm geɖe wu na kernel-adjacent ŋgɔyiyi.

ƒe nyawo

ƒe nyawo

"Kɔda si le dedie wu enye kɔda si me vodadawo ƒe hatsotso blibowo mateŋu adzɔ le xɔtuɖoɖo me o. Menye ɖeko Rust kpena ɖe ŋuwò nèŋlɔa kɔmpiuta dɔwɔɖoɖo siwo le dedie wu o — enaa kpɔɖeŋu siwo mele dedie o la mate ŋu atsi tre ɖi o. Le mɔ̃ ɖesiaɖe si kpɔa dɔwɔna vevi siwo le asitsatsa me gbɔ le agbɔsɔsɔ me gome la, vovototo ma nye vovototo si le mɔkpɔkpɔ na dedienɔnɔ kple eƒe mɔ̃ɖaŋudɔwɔwɔ dome."

ƒe nyawo

Aleke Syd ƒe Xɔtuɖaŋu Gɔmeɖeɖe Ðe Asitsatsa ƒe Kɔmpiutadziɖoɖowo ƒe Dedienɔnɔ Ŋu?

Sandboxing gɔmeɖose siwo woɖe fia le Syd la sɔ kple wo nɔewo tẽ le alesi egbegbe asitsamɔnuwo kpɔa zãlawo ƒe nyatakakawo tae me. Dɔwɔwɔ ƒe vovototodedeameme, mɔnukpɔkpɔ suetɔ kekeake ƒe mɔɖeɖe, kple ɖoɖo ƒe kaƒoƒo ƒe ʋuʋu nye gɔmeɖoanyi nukpɔsusu mawo ke siwo naa ŋusẽ SaaS xɔtuɖaŋu siwo xɔhaya geɖe. Ne mɔ̃ abe Mewayz ene subɔa asitsaha akpe geɖe le ɣeyiɣi ɖeka me le modules 207 siwo wotsɔ wɔ ɖekae me la, ele be woaɖe aƒehayala ɖesiaɖe ƒe nyatakakawo ɖe vovo vevie — le susu me la, esɔ kple alesi Syd ɖea dɔwɔɖoɖo siwo dzi womeka ɖo o ɖe vovo tso amedzroxɔla ƒe ɖoɖoa gbɔ.

| Videoa ɖee fia be dedienɔnɔ menye nusi wotsɔ ga bla ɖe nyateƒea megbe o ke boŋ enye xɔtuɖaŋu ƒe gɔmeɖoanyi si wolɔ̃ ɖe ɖoɖoa ƒe akpa ɖesiaɖe.

Nukae Ŋgɔyiyi Ƒuƒoƒowo Ate Ŋu Asrɔ̃ tso Kernel-Level Engineering me?

Ne wò ƒuƒoƒoa meŋlɔa kernel code gbeɖe o hã la, amehehe si woɖe fia le Syd dɔa me la naa nusɔsrɔ̃ veviwo. Kernel dɔwɔlawo wɔa dɔ le mɔxenu siwo zi mɔ̃ɖaŋudɔwɔwɔ ƒe sesẽ tɔxɛ aɖe dzi — teƒe aɖeke meli na ŋkuɖodzinu ƒe sisi o, mɔɖeɖe ɖe nuwɔna si womeɖe o ŋu meli o, vovototo aɖeke meli na ameƒomevinyenye ƒe nɔnɔmewo o. Susu sia ƒe akpa sue aɖe gɔ̃ hã xɔxɔ nana application-layer code ƒe nyonyome nyona ɖe edzi ŋutɔ.

| Dɔwɔnu kple nuwɔna siawo ke li na Rust dɔ ɖesiaɖe, eɖanye be èle kernel module alo business automation engine tum o. Ƒuƒoƒo siwo kpɔa dɔwɔnawo dzi le CRM, ganyawo, HR, nudzraɖoƒewo, kple dɔa dzikpɔkpɔ ƒe modules katã me kpɔa viɖe geɖe tso xɔtuɖoɖo siwo wotu kple beléle ƒe ɖoɖo sia me.

Nyabiase Siwo Wobiana Enuenu

Nukae nye Syd eye kuxi ka gbɔe wòkpɔna?

Syd nye Rust-dzi dɔwɔwɔ ƒe kernel si wowɔ na sandboxing dɔwɔwɔ siwo dzi womeka ɖo o le Linux ɖoɖowo dzi. Exea mɔ na kɔmpiutadziɖoɖowo ƒe kaƒoƒo be woatsɔ awɔ dedienɔnɔ ŋuti ɖoɖowo dzi, si xea mɔ na dɔwɔɖoɖowo be woagage ɖe faɛl siwo ŋu womeɖe mɔ ɖo o, kɔmpiutadziɖoɖowo ƒe dɔwɔnuwo, alo ɖoɖoa ƒe ŋutetewo me o. To dedienɔnɔ ƒe akpa vevi sia zazã le Rust me tsɔ wu C me la, Syd ɖea ŋkuɖodzinu-dedienɔnɔ ƒe gbɔdzɔgbɔdzɔ siwo nye amedzidzedze vevitɔ le ŋutinya me ɖe sandboxing dɔwɔnuwo ŋu la ɖa.

Ðe wòhiã be manya Rust be mase dɔwɔwɔ ƒe kernel ƒe susuwo gɔmea?

Ao. Togbɔ be Syd ƒe dɔwɔwɔ nye Rust tɔ koŋ hã la, nukpɔsusu siwo le ete — ɖoɖo ƒe yɔyɔ ƒe mɔxexe, dɔwɔwɔ ƒe vovototodedeameme, mɔnukpɔkpɔ suetɔ kekeake ƒe sedziwɔwɔ, kple dedienɔnɔ ƒe ɖoɖowo dzikpɔkpɔ — nye gbeŋutise ƒe agnostic. Video la ɖe gɔmeɖose siawo me le mɔ si aɖe vi na dɔwɔƒe alo mɔ̃ɖaŋudɔwɔla ɖesiaɖe si tsi dzi ɖe kɔmpiuta dɔwɔɖoɖowo ƒe dedienɔnɔ ŋu, metsɔ le woƒe dɔwɔɖoɖo ƒe gbegbɔgblɔ vevitɔ me o.

Aleke dedienɔnɔ ŋuti nukpɔsusu siawo siwo le bɔbɔe la wɔa dɔ ɖe SaaS asitsamɔnuwo dzi?

Gɔmeɖose ɖesiaɖe si woɖe fia le Syd me la dzidzea dedienɔnɔ le dɔwɔwɔ ƒe ɖoɖo nu. Dɔwɔwɔ ɖe ame ɖokui ɖeɖe ɖe aga ƒe anyigbatatawo dzi yi aƒehayalawo ƒe ɖekematsɔleme le aƒehayala geɖe ƒe mɔ̃wo dzi. System call filtering sɔ kple API biabia ƒe kpeɖodzi kple mɔɖeɖe ƒe sedziwɔwɔ. Ametakpɔkpɔ ƒe mɔnu si de to si woɖe fia le videoa me la nye alesi tututu mɔ̃wo abe Mewayz ene kpɔa asitsatsa ŋuti nyatakaka veviwo ta le modules siwo ku ɖe ganyawo, dɔwɔnawo, amewo ƒe dɔwɔnawo, kple asisiwo dzikpɔkpɔ ŋu me — kpɔa egbɔ be zãla ɖesiaɖe, ƒuƒoƒo, kple habɔbɔ ɖesiaɖe kpɔa nusiwo ŋu woɖe mɔ ɖo be woakpɔ ko.

---

ƒe nyawo

Dedienɔnɔ kple kakaɖedzi menye nusiwo wowɔ le emegbe o — wonye mɔ̃ɖaŋudɔwo ƒe gɔmeɖoanyiwo. Eɖanye sandboxing dɔwɔwɔwo le kernel level alo asitsatsa ƒe dɔwɔwɔ blibo aɖe dzi kpɔkpɔ le modules siwo wowɔ ɖekae me o, gɔmeɖoseawo gakpɔtɔ le nenema. Èle klalo be yeawɔ yeƒe dɔwɔƒea le mɔ̃ si wotu kple dɔwɔƒe ƒe dedienɔnɔ kple dɔwɔwɔ ƒe goglome dzia? Dze wò Mewayz dodokpɔ femaxee gɔme egbea eye nàke ɖe alesi modules 207 siwo wotsɔ wɔ ɖekae ate ŋu ana nusianu nanyo ɖe edzi tso CRM dzi va ɖo akɔntabubu dzi, dɔa dzikpɔkpɔ dzi va ɖo HR dzi — wo katã le asitsadɔwɔɖoɖo ɖeka si le dedie me.

me