Rust developers have repeatedly raised concerned about an unaddressed privacy issue over the last few years.
Rust has rapidly gained momentum among developers, for its focus on performance, safety, safe concurrency, and for having a similar syntax to C++.
StackOverflow’s 2020 developer survey ranked Rust first among the ”
most loved programming languages.”
However, for the longest time developers have been bothered by their production builds leaking potentially sensitive debug information.
Rust compiled binaries retain username and home directory paths
In early 2017, a Rust developer filed an issue on the Rust lang’s GitHub asking, “How can I stop rustc [from] including system specific information such as absolute file paths of the source it’s compiled from in the binaries it generates?”
The developer shared some examples of paths retained in their production builds:/checkout/src/libcore/option.rs
/home/kfairmasterz/.cargo/registry/src/github.com-1ecc6299db9ec823/typeable-0.1.2/src/lib.rs
/home/kfairmasterz/.cargo/registry/src/github.com-1ecc6299db9ec823/openssl-0.9.7/src/ssl/bio.rs
These absolute path names revealed the developer’s system username and the overall structure of directories, including the home directory.
They further expressed in the same thread:
“If it helps, you including user ids like this violates GDPR… so this should be addressed by the rust team.”
“In 2020 people care about privacy and this can be a put off like rust-lang/mdBook#847 where people actively worked away from the project due to the disrespect of user privacy,” said the developer referring to a Rust project called mdBook.
On a first glance, this “leak” of usernames and absolute paths may seem trivial to a reader.
However, over years, many more developers were left surprised to notice such information being included not just in debug builds but their production Rust builds as well [1, 2, 3, 4, …] and pushed for a change.
BleepingComputer readers have also reached out to us on more than one occasion sharing their thoughts on the issue.
Since Rust project, at the time, did not fix this issue, some workarounds were proposed by the community members, such as using the “abort upon panic” option, but unfortunately none of these worked.
“I have tried to turn on ‘abort’ for panic in release profile. Even though this resulted in a smaller binary size, it doesn’t wipe out source file names from the binary,” stated developer Dmitry Zakablukov in August 2020.
Other proposed workarounds included varying parameters like system time, username, timezone, locale, hostname, and so on.
Interestingly, despite being a privacy risk, the inadvertent inclusion of metadata such as absolute paths may aid computer forensics experts and the law enforcement as the path could reveal system usernames.
Of course, any developer who is aware of this issue can trivially build their Rust applications inside of a container, and use a pseudonymous username to minimize impact from the issue.
Issue revived after 4 years, Rust team declares this a bug
This week, a pseudonymous developer chemsaf3 reached out to BleepingComputer reiterating their concern with this issue.
The developer filed yet another issue titled “Registry paths hard coded in binary” on the Rust project’s GitHub centering attention back towards this problem.
“Rust lang looks to leak sensitive information unnecessarily in compiled binaries such as system paths and usernames.”
“[This] happens in release (production) mode, not just debug, and [there is] no way to remove the info with existing tools.”
“People have reported the issue but no action or communication from the Rust team,” chemsaf3 told BleepingComputer.
The developer also stated that it remains unknown how many developers shipping Rust applications are likely unaware that their applications are revealing their system paths and usernames.
The developer’s main concern was:
“Rust is becoming more and more popular so this can start affecting larger number of developers.”
“This behavior is not documented, nor is there a way to prevent the leakage,” the developer further told us.
The GitHub request filed by the developer was quickly followed up with a response from Rust team member:
“Thanks for the report! It looks like you found several other issues related to this, so I’m unclear if this issue is covering anything new. It seems like #5505 covers dealing with remapping, can you clarify what is different here?” asked Eric Huss of the Rust team.
Eventually, after the issue resurfaced on Reddit, however, a Google team member Alexis Hunt stepped in on the Rust’s GitHub issue:
“I was linked this issue from Reddit, and I got interested as personally having good privacy-preserving defaults is important to me. I spoke informally with some colleagues…”
Hunt summarized some of developers’ concerns and shared some ideas on how the problem could be resolved.
“Personally, I think this is important and should be addressed quickly, but I’m not in a position at the moment to follow up and make this happen. I hope someone else can pick this up,” continued Hunt.
To understand if Rust considered this a vulnerability or planned on a bug fix, BleepingComputer reached out to the Rust core team for comment.
“We agree that this is a bug worth fixing and will be supporting our teams in solving it,” Manish Goregaokar of the Rust team and a senior software engineer at Google told BleepingComputer.https://06dafeb06b6d2591d81200e3518e2cc0.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Although at this time, it is not known how or when the Rust team plans on resolving this issue, the increased pressure from the developer community seems to be steering Rust maintainers into an actionable direction.
