Rust Security

Rust security

Contract

Inputs

1. Audit target (required): the Cargo project path or dependency list.
2. Tool (required): cargo-audit, cargo-deny, cargo-fuzz, Miri, or manual review.
3. Policy context (optional): license allowlist, banned crates, allowed sources, CI environment.

Procedure

1. Run cargo-audit. Install cargo-audit 0.22.2 with cargo install cargo-audit --locked, then run cargo audit. Use cargo audit --deny warnings, cargo audit --file Cargo.lock, or cargo audit --json for CI. The --format json and --format sarif options are also available. Done when: the audit output lists advisories or reports none.
2. Run cargo-deny. Install cargo-deny 0.20.2 with cargo install cargo-deny --locked, run cargo deny init for a template, then run cargo deny check [advisories|licenses|bans|sources|all]. Configure deny.toml as shown below. Done when: the check runs and any policy violation is reported.

[advisories]
yanked = "deny"
unmaintained = "workspace"
ignore = [
    "RUSTSEC-2021-0145",
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
deny = [
    { crate = "openssl", use-instead = "rustls" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = [
    "https://github.com/my-org/private-crate",
]

3. Check the RUSTSEC database. Use cargo audit or browse https://rustsec.org/. Classify advisories as vulnerability, unmaintained, or unsound. Done when: the advisory list and categories are known.
4. Review FFI boundaries. For each extern "C" function, validate pointer and length arguments, document the C invariant, and prefer safe wrapper crates. Done when: each FFI entry point has explicit validation.
5. Fuzz for security bugs. Install cargo-fuzz with cargo install cargo-fuzz, run cargo fuzz init, cargo fuzz add <target>, and cargo fuzz run --sanitizer address <target>. Reproduce crashes with cargo fuzz run <target> <artifact>. Done when: a fuzz target runs or a crash is reproduced.
6. Confirm soundness with Miri. Run cargo +nightly miri test on unsafe code. Use MIRIFLAGS="-Zmiri-disable-isolation -Zmiri-backtrace=full" when needed. Done when: Miri reports UB or completes cleanly.
7. Harden the supply chain. Keep Cargo.lock for binaries, run cargo fetch --locked, review duplicates with cargo tree -d, consider cargo vet for peer-reviewing new dependencies, and use cargo-machete to find unused dependencies. Done when: the supply-chain state is reported.

Failure and recovery

Output

1. A security report with vulnerabilities, advisories, policy violations, and FFI risks.
2. Recommended commands and configuration files.
3. A fuzzing and Miri test plan.
4. A prioritized remediation list.