I-Android 13 inguqulo yokuqala ye-Android lapho iningi lekhodi entsha engezwe enguqulweni lingolimi oluphephile ngenkumbulo.
Ngokuthunyelwe kwebhulogi, onjiniyela be-Google ikhiphe isifinyezo semiphumela yokuqala yesingeniso Ukusekelwa kokuthuthukiswa kokugqwala ku-Android.
I-Android 13, cishe u-21% wekhodi entsha ehlanganisiwe Isamba sibhalwe nge-Rust kanye no-79% ku-C/C++, okuyi-AOSP (Android Open Source Project) inqolobane, ethuthukisa ikhodi yomthombo yeplathifomu ye-Android, enemigqa ecishe ibe yizigidi ezingu-1,5 yekhodi yokugqwala.
Ikhodi inikezwe yi-AOSP ihlobene nezingxenye ezintsha ezifana ne-keystore2 cryptographic keystore, isitaki sama-chips e-UWB (Ultra-Wideband), ukuqaliswa kwephrothokholi ye-DNS phezu kwe-HTTP3, uhlaka lwe-AVF lwe-virtualization (Android Virtualization Framework), izitaki zokuhlola ze-Bluetooth ne-Wi-Fi.
Kulayini ngesu elamukelwe ngenhla lokunciphisa ubungozi bokuba sengozini kwephutha lenkumbulo, Kuze kube manje i-Rust isetshenziselwe ikakhulukazi ukuthuthukiswa kwekhodi entsha kanye nokuqinisa kancane kancane ukuphepha kwezingxenye zesofthiwe ezisengozini kakhulu nezibalulekile.
Njengoba inombolo yekhodi entsha engavikelekile yenkumbulo engena ku-Android yehlile, inani lobungozi benkumbulo nalo lehlile. Kusukela ngo-2019 kuya ku-2022, yehle isuka ku-76% yaya ku-35% yokulimala okuphelele kwe-Android. Unyaka ka-2022 uphawula unyaka wokuqala lapho ukuba sengozini kokuvikela inkumbulo akubaleli ubungozi obuningi be-Android.
Umgomo ojwayelekile wokudlulisela yonke inkundla ku-Rust awumisiwe, futhi ikhodi endala ihlala iku-C/C++, futhi ukulwa nezimbungulu kuyo kwenziwa ngokusebenzisa izivivinyo ezixakile, ukuhlaziya okumile, kanye nokusetshenziswa kwamasu afanayo. ukusetshenziswa kohlobo lwe-MiraclePtr (ukubopha phezu kwezikhombi ezingavuthiwe, okuhlola okwengeziwe ukuze kufinyelelwe ezindaweni zenkumbulo ezikhululekile), uhlelo lokwabiwa kwenkumbulo ye-Scudo (ukubuyisela okuphephile kwe-malloc/yamahhala) kanye nezindlela zokuthola amaphutha lapho usebenza nenkumbulo ye-HWAsan(Hardware Assisted AddressSanitizer) , GWP-ASAN kanye ne-KFENCE.
Mayelana nezibalo zemvelo ye ukuba sengozini endaweni yesikhulumi se-Android, kuyabonakala ukuthi yehlisa inani lekhodi entsha esebenza nenkumbulo ngezindlela ezingavikelekile, iphinde yehlise inani lobungozi obudalwa amaphutha uma usebenza ngenkumbulo.
Isibonelo, ingxenye yobungozi obubangelwa izinkinga zenkumbulo yehla isuka ku-76% ngo-2019 yaya ku-35% ngo-2022. Ngezinombolo eziphelele, ubungozi obuhlobene nenkumbulo obungu-223 bahlonzwa ngo-2019, obungu-150 ngo-2020, abangu-100 ngo-2021, kanye no-85. abatholakalanga). Unyaka ka-2022 kwaba unyaka wokuqala lapho ukuba sengozini okuhlobene nenkumbulo kuyeka ukubusa.
Kuze kube manje, abukho ubungozi benkumbulo obutholakele kukhodi ye-Android Rust.
Asilindele ukuthi leyo nombolo ihlale kuqanda phakade, kodwa uma kubhekwa umthamo wekhodi entsha ye-Rust kuzo zonke izinguqulo ezimbili ze-Android kanye nezingxenye ezizwelayo kwezokuvikela lapho isetshenziswa khona, iwumphumela obalulekile. Kubonisa ukuthi i-Rust isebenzisa injongo yayo ehlosiwe yokuvimbela umthombo ovame kakhulu wokuba sengozini kwe-Android.
Kusukela ubuthakathaka obuhlobene nenkumbulo ngokuvamile buyingozi kakhulu, izibalo zizonke futhi zibonisa ukwehla kwenani lezinkinga ezibalulekile nezinkinga ezingase zisetshenziswe kude. Ngesikhathi esifanayo, amandla okuthola ukukhubazeka okungahlobene nokusebenza ngenkumbulo abe cishe ezingeni elifanayo eminyakeni engu-4 edlule - ukukhubazeka okungu-20 ngenyanga.
Isilinganiso sezinkinga eziyingozi nokuba sengcupheni okubangwa amaphutha enkumbulo nakho kuyefana (kodwa njengoba inani lobungozi lincipha, inani lezinkinga eziyingozi nalo liyehla).
Izibalo ziphinde zilandelele ukuhlobana phakathi kwenani lekhodi entsha esebenza nenkumbulo ngendlela engavikelekile kanye nenani lobungozi obuhlobene nenkumbulo (ukuchichima kwebhafa, ukufinyelela kumemori ekhululiwe kakade, njll.).
Lokhu kubuka qinisekisa umcabango we ukuthi ukunakwa okuyinhloko ku ukuqaliswa kwamasu okuhlela avikelekile kufanele inikezwe ikhodi entsha futhi ingabhalwa kabusha ekhona, njengoba ubungozi obuningi bukhona kukhodi entsha.
Umthombo: https://security.googleblog.com/