zBulk: Towards Automatic Compartmentalization in Rust with Zero Manual Retrofitting

von Onciul M, Raffeck P, Wägemann P, Kapitza R (2026)

Publication Language: English

Publication Type: Conference contribution, Conference Contribution

Publication year: 2026

Publisher: ACM

Series: Workshop on Programming Languages and Operating Systems

City/Town: New York, NY, USA

Book Volume: 14

Conference Proceedings Title: Proceedings of the 14th Workshop on Programming Languages and Operating Systems

Event location: Prague, Czechia CZ

ISBN: 979-8-4007-2877-8/2026/09

URI: https://doi.org/10.1145/3831586.3838149

DOI: 10.1145/3831586.3838149

Open Access Link: https://doi.org/10.1145/3831586.3838149

Abstract

Memory safety is a dominant driver in security and systems research. Rust has become a viable alternative to C/C++ for systems programming because of its strong memory safety guarantees. However, it is not a silver bullet. Unsafe sections, foreign code, and compiler-soundness bugs still pose vulnerabilities. Compartmentalization splits a program into pieces and executes these in isolated, collaborating contexts. This way, the impact of a software vulnerability can, ideally, be limited to a single compartment. However, manual compartmentalization approaches are considered labor-intensive and error-prone, and require deep system expertise.

We present zBulk, an automatic compartmentalization system that requires zero retrofitting to application code and paves the way for flexible fine-grained compartmentalization. We achieve this high degree of automation by leveraging static type- and call information, and language constructs that declare mutability and ownership. We show how to design zBulk, leveraging rustc's intermediate representations. We verify the approach by fully automatically compartmentalizing a relatively small systems application with a single dependency into up to eight compartments. We discuss how this number can be increased for even more flexibility. We report overhead measurements for Intel SGX as a first isolation mechanism, with more to follow.


Authors with CRIS profile

Maxim Ritter von Onciul Lehrstuhl für Informatik 4 (Systemsoftware) Phillip Raffeck Lehrstuhl für Informatik 4 (Systemsoftware) Peter Wägemann Lehrstuhl für Informatik 4 (Systemsoftware) Rüdiger Kapitza Lehrstuhl für Informatik 4 (Systemsoftware)

How to cite

APA:

von Onciul, M., Raffeck, P., Wägemann, P., & Kapitza, R. (2026). zBulk: Towards Automatic Compartmentalization in Rust with Zero Manual Retrofitting. In Association for Computing Machinery (Eds.), Proceedings of the 14th Workshop on Programming Languages and Operating Systems. Prague, Czechia, CZ: New York, NY, USA: ACM.

MLA:

von Onciul, Maxim, et al. "zBulk: Towards Automatic Compartmentalization in Rust with Zero Manual Retrofitting." Proceedings of the 14th Workshop on Programming Languages and Operating Systems (PLOS 2026), Prague, Czechia Ed. Association for Computing Machinery, New York, NY, USA: ACM, 2026.

BibTeX: Download