Rust Security

mohitmishra786/low-level-dev-skills/skills/rust/rust-security

作者 mohitmishra786bdc58472fa9f无许可证253 个星标收录于 2026年10月9日更新于 2026年10月9日仓库3个月前更新

Rust security skill for supply chain safety and memory-safe development. Use when auditing dependencies with cargo-audit, enforcing policies with cargo-deny, reviewing RUSTSEC advisories, writing memory-safe FFI patterns, or integrating fuzzing and Miri into a security review pipeline. Activates on queries about cargo-audit, cargo-deny, RUSTSEC advisories, supply chain security, Rust CVEs, safe FFI, or fuzzing for security.

仅含说明Security Software Development

AI 生成的概览

指导 Rust 安全工作：依赖审计、策略执行、RUSTSEC 公告、安全 FFI、模糊测试与 Miri。

功能: 该技能提供审计 Rust 项目安全问题的操作说明。内容涵盖使用 cargo-audit 扫描漏洞、使用 cargo-deny 执行策略、查阅 RUSTSEC 公告数据库、编写内存安全的 FFI 模式、使用 cargo-fuzz 与 honggfuzz 进行模糊测试，以及用 Miri 检查健全性。还介绍了供应链加固步骤，如锁定 lockfile、使用 cargo-vet 审查以及查找未使用的依赖。它产出的是指导与命令示例，而非文件或脚本。
适用场景: 适用于检查 Rust 依赖中的 CVE、在 CI 中执行依赖策略、查阅 RUSTSEC 公告或加固 Rust 代码库。也适合对 unsafe 或 FFI 代码进行安全审查，以及在安全流程中配置模糊测试与 Miri。
运行要求: 不附带脚本，仅为说明性内容。按指引操作需要 Rust 工具链与 Cargo，以及需另行安装的可选工具：cargo-audit、cargo-deny、cargo-fuzz、honggfuzz、cargo-vet、cargo-machete，以及带 Miri 的 nightly 工具链。获取 crate、公告数据库与 RUSTSEC 公告数据需要网络访问。

Rust Security

Purpose

Guide agents through Rust security practices: dependency auditing with cargo-audit, policy enforcement with cargo-deny, RUSTSEC advisory database, memory-safe patterns for FFI, and combining fuzzing with Miri for security review.

Triggers

"How do I check my Rust dependencies for CVEs?"
"How do I use cargo-audit?"
"How do I enforce dependency policies in CI?"
"What's the RUSTSEC advisory database?"
"How do I write memory-safe FFI in Rust?"
"How do I fuzz-test my Rust library for security bugs?"

Workflow

1. cargo-audit — vulnerability scanning

bash

# Installcargo install cargo-audit --locked
# Scan current projectcargo audit
# Full output including ignoredcargo audit --deny warnings
# Audit the lockfile (CI-friendly)cargo audit --file Cargo.lock
# JSON output for CI integrationcargo audit --json | jq '.vulnerabilities.list[].advisory.id'

# Installcargo install cargo-audit --locked
# Scan current projectcargo audit
# Full output including ignoredcargo audit --deny warnings
# Audit the lockfile (CI-friendly)cargo audit --file Cargo.lock
# JSON output for CI integrationcargo audit --json | jq '.vulnerabilities.list[].advisory.id'

Output format:

error[RUSTSEC-2023-0052]: Vulnerability in `vm-superio`    Severity: low       Title: MMIO Register Misuse    Solution: upgrade to `>= 0.7.0`

error[RUSTSEC-2023-0052]: Vulnerability in `vm-superio`    Severity: low       Title: MMIO Register Misuse    Solution: upgrade to `>= 0.7.0`

2. cargo-deny — policy enforcement

cargo-deny goes beyond audit: it enforces license policies, bans specific crates, checks source origins, and validates duplicate dependency versions.

bash

cargo install cargo-deny --locked
# Initialize deny.tomlcargo deny init
# Run all checkscargo deny check
# Run specific checkcargo deny check advisoriescargo deny check licensescargo deny check banscargo deny check sources

cargo install cargo-deny --locked
# Initialize deny.tomlcargo deny init
# Run all checkscargo deny check
# Run specific checkcargo deny check advisoriescargo deny check licensescargo deny check banscargo deny check sources

deny.toml configuration:

toml

[advisories]vulnerability = "deny"      # Deny known vulnerabilitiesunmaintained = "warn"       # Warn on unmaintained cratesyanked = "deny"             # Deny yanked versions
# Ignore specific advisoriesignore = [    "RUSTSEC-2021-0145",    # known false positive for our usage]
[licenses]unlicensed = "deny"allow = [    "MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception",    "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-DFS-2016",]# Deny GPL for proprietary projectsdeny = ["GPL-2.0", "GPL-3.0"]
[bans]multiple-versions = "warn"  # Warn if same crate appears twicewildcards = "deny"          # Deny wildcard dependencies
[[bans.deny]]name = "openssl"            # Force rustls insteadwrappers = ["reqwest"]      # Allow if only required by these
[sources]unknown-registry = "deny"unknown-git = "deny"allow-git = [    "https://github.com/my-org/private-crate",]

[advisories]vulnerability = "deny"      # Deny known vulnerabilitiesunmaintained = "warn"       # Warn on unmaintained cratesyanked = "deny"             # Deny yanked versions
# Ignore specific advisoriesignore = [    "RUSTSEC-2021-0145",    # known false positive for our usage]
[licenses]unlicensed = "deny"allow = [    "MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception",    "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-DFS-2016",]# Deny GPL for proprietary projectsdeny = ["GPL-2.0", "GPL-3.0"]
[bans]multiple-versions = "warn"  # Warn if same crate appears twicewildcards = "deny"          # Deny wildcard dependencies
[[bans.deny]]name = "openssl"            # Force rustls insteadwrappers = ["reqwest"]      # Allow if only required by these
[sources]unknown-registry = "deny"unknown-git = "deny"allow-git = [    "https://github.com/my-org/private-crate",]

GitHub Actions CI integration:

3. RUSTSEC advisory database

The RUSTSEC database at https://rustsec.org/ tracks vulnerabilities, unmaintained crates, and unsound code.

bash

# Browse advisories from CLIcargo audit --db ~/.cargo/advisory-db fetchls ~/.cargo/advisory-db/crates/
# Check a specific advisorycurl https://rustsec.org/advisories/RUSTSEC-2023-0001.json | jq .
# Common categories# type: vulnerability — exploitable security bug# type: unmaintained — no longer maintained (supply chain risk)# type: unsound — documented unsoundness in safe API# type: yanked — crate version yanked from crates.io

# Browse advisories from CLIcargo audit --db ~/.cargo/advisory-db fetchls ~/.cargo/advisory-db/crates/
# Check a specific advisorycurl https://rustsec.org/advisories/RUSTSEC-2023-0001.json | jq .
# Common categories# type: vulnerability — exploitable security bug# type: unmaintained — no longer maintained (supply chain risk)# type: unsound — documented unsoundness in safe API# type: yanked — crate version yanked from crates.io

4. Memory-safe FFI patterns

Common sources of unsafety at the Rust/C boundary:

rust

// UNSAFE pattern — raw pointer from C, no lifetimeextern "C" fn process_data(data: *const u8, len: usize) {    // Don't do this — no bounds check, no lifetime guarantee    let slice = unsafe { std::slice::from_raw_parts(data, len) };}
// SAFE pattern — validate before usingextern "C" fn process_data(data: *const u8, len: usize) -> i32 {    // Validate pointer and length    if data.is_null() || len == 0 || len > 1024 * 1024 {        return -1;    }    // Safety: non-null, len validated, called from C with valid buffer    let slice = unsafe { std::slice::from_raw_parts(data, len) };    do_work(slice);    0}
// Use safe wrapper crates for common patternsuse nix::unistd::read;   // safe POSIX wrappersuse windows::Win32::System::Memory::VirtualAlloc;  // safe Windows bindings

// UNSAFE pattern — raw pointer from C, no lifetimeextern "C" fn process_data(data: *const u8, len: usize) {    // Don't do this — no bounds check, no lifetime guarantee    let slice = unsafe { std::slice::from_raw_parts(data, len) };}
// SAFE pattern — validate before usingextern "C" fn process_data(data: *const u8, len: usize) -> i32 {    // Validate pointer and length    if data.is_null() || len == 0 || len > 1024 * 1024 {        return -1;    }    // Safety: non-null, len validated, called from C with valid buffer    let slice = unsafe { std::slice::from_raw_parts(data, len) };    do_work(slice);    0}
// Use safe wrapper crates for common patternsuse nix::unistd::read;   // safe POSIX wrappersuse windows::Win32::System::Memory::VirtualAlloc;  // safe Windows bindings

5. Fuzzing for security bugs

bash

# cargo-fuzz — libFuzzer-basedcargo install cargo-fuzz
# Initializecargo fuzz initcargo fuzz add my_target
# fuzz/fuzz_targets/my_target.rs# #![no_main]# use libfuzzer_sys::fuzz_target;# fuzz_target!(|data: &[u8]| {#     if let Ok(s) = std::str::from_utf8(data) {#         let _ = my_lib::parse(s);#     }# });
# Run fuzzing (long-running)cargo fuzz run my_target
# With sanitizers for security coveragecargo fuzz run my_target -- -sanitizer=address
# Reproduce a crashcargo fuzz run my_target artifacts/my_target/crash-xxxx

# cargo-fuzz — libFuzzer-basedcargo install cargo-fuzz
# Initializecargo fuzz initcargo fuzz add my_target
# fuzz/fuzz_targets/my_target.rs# #![no_main]# use libfuzzer_sys::fuzz_target;# fuzz_target!(|data: &[u8]| {#     if let Ok(s) = std::str::from_utf8(data) {#         let _ = my_lib::parse(s);#     }# });
# Run fuzzing (long-running)cargo fuzz run my_target
# With sanitizers for security coveragecargo fuzz run my_target -- -sanitizer=address
# Reproduce a crashcargo fuzz run my_target artifacts/my_target/crash-xxxx

6. Miri for soundness

bash

# Install Mirirustup +nightly component add miri
# Run tests under Miricargo +nightly miri test
# Check for UB in unsafe codeMIRIFLAGS="-Zmiri-disable-isolation -Zmiri-backtrace=full" \  cargo +nightly miri test
# Miri detects:# - Use-after-free# - Dangling references# - Invalid pointer arithmetic# - Data races (with -Zmiri-tree-borrows)# - Uninitialized memory reads

# Install Mirirustup +nightly component add miri
# Run tests under Miricargo +nightly miri test
# Check for UB in unsafe codeMIRIFLAGS="-Zmiri-disable-isolation -Zmiri-backtrace=full" \  cargo +nightly miri test
# Miri detects:# - Use-after-free# - Dangling references# - Invalid pointer arithmetic# - Data races (with -Zmiri-tree-borrows)# - Uninitialized memory reads

7. Supply chain hardening

bash

# Pin Cargo.lock in applications (not libraries)# Always commit Cargo.lock for binaries
# Verify checksums (cargo already does this)cargo fetch --locked    # fails if Cargo.lock doesn't match
# Audit all dependencies including transitivecargo tree              # view full dependency treecargo tree -d           # show duplicate versions
# Use cargo-vet for peer review of new depscargo install cargo-vetcargo vet              # check all deps have been vetted
# Minimal dependency principlecargo machete          # finds unused dependencies

# Pin Cargo.lock in applications (not libraries)# Always commit Cargo.lock for binaries
# Verify checksums (cargo already does this)cargo fetch --locked    # fails if Cargo.lock doesn't match
# Audit all dependencies including transitivecargo tree              # view full dependency treecargo tree -d           # show duplicate versions
# Use cargo-vet for peer review of new depscargo install cargo-vetcargo vet              # check all deps have been vetted
# Minimal dependency principlecargo machete          # finds unused dependencies

Related skills

Use skills/rust/rust-sanitizers-miri for Miri and sanitizer details
Use skills/runtimes/fuzzing for fuzzing strategy and corpus management
Use skills/rust/rust-unsafe for unsafe code audit patterns
Use skills/rust/cargo-workflows for Cargo.lock and workspace management

来源与署名

来源：mohitmishra786/low-level-dev-skills位于skills/rust/rust-security提交bdc5847

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Rust Security

Rust Security

Purpose

Triggers

Workflow

1. cargo-audit — vulnerability scanning

2. cargo-deny — policy enforcement

3. RUSTSEC advisory database

4. Memory-safe FFI patterns

5. Fuzzing for security bugs

6. Miri for soundness

7. Supply chain hardening

Related skills

来源与署名

更多来自 mohitmishra786/low-level-dev-skills 的技能

Zig Debugging

Simd Intrinsics

Zig Cross

Rustc Basics

Zig Cinterop

Zig Build System

更多Security技能

Kyc Rules

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate