Canonical is funding a University of Bristol PhD to automate translation of C code into Rust for Ubuntu’s security tools.
The three-year project, backed with matched funding from UK Research and Innovation (UKRI), aims to address a difficult problem: manual conversion of C code is expensive and carries risk, yet leaving it untouched means forgoing the memory-safety guarantees Rust provides.
Jon Seager, VP of Engineering at Canonical, argued that Rust gives systems programmers more control over performance and resource use while eliminating whole classes of memory-safety defects. That combination, he explains, makes it useful for software sitting at security boundaries.
Canonical has already brought Rust-based replacements into Ubuntu, including the uutils coreutils project and sudo-rs. Seager described both as established projects with mature test suites and committed maintainers. The harder problem, according to Seager, is the volume of mature C code already running in production.
Building an end-to-end translation platform
Professor Meng Wang will lead the PhD project at Bristol. Dr Cristina David and Seager will act as co-supervisors. The goal is an end-to-end platform capable of translating repositories running to hundreds of thousands of lines of C into Rust that is safe, behaviourally-correct, and maintainable.
Existing approaches fall short in different ways. Source-to-source translators can process large amounts of code, but they tend to preserve the structure of the original C too closely. The resulting Rust may compile while still depending heavily on unsafe operations, retaining awkward C idioms and requiring considerable manual work before a Rust maintainer would want to own it.
Large language models show the opposite pattern. They produce convincing idiomatic Rust for small and well-defined examples, but they lose coherence once the context spans an entire repository. Plausible output, Seager noted, is not evidence that a translated program behaves like its source.
Four stages combine machine learning with formal methods
The Bristol project will combine machine learning techniques with program analysis, testing, and formal methods across four stages.
Scheduling divides a large repository into chunks that can be translated independently, without losing the context needed to understand types, dependencies, and behaviour. Seager explained that the order and boundaries chosen at this stage affect how much the system can infer later and what it can subsequently validate.
Translation uses language models trained or fine-tuned against a library of known C-to-Rust conversions. The aim is to produce Rust that expresses the intent of the original program through Rust abstractions instead of mirroring C syntax.
Validation then checks that the Rust implementation behaves like the C source, drawing on fuzz testing alongside formal equivalence-checking methods. Debugging and repair analyses any failed validations, locates the likely fault in the translation, and applies symbolic program-repair techniques to correct it.
Seager treats the language model as only one component in that system. “Generated code should be treated as untrusted until there is evidence that it preserves the desired behaviour,” he explained. He linked the approach to his broader view of agentic software development, describing generation as useful only when it sits inside a system of constraints, feedback, and verification.
AppArmor and snap-confine become the test cases
The project will target AppArmor and snap-confine as its industrial case studies, Seager confirmed. Both tools are at the centre of Ubuntu’s security model. Choosing them gives the researchers a far harder test than translation exercises drawn from small benchmarks.
Long-standing repositories of this kind accumulate build-system complexity and platform-specific behaviour. They also develop error paths that are not obvious from reading an individual function.
Security-sensitive code tends to contain exactly the low-level operations that resist clean translation, and Seager selected AppArmor and snap-confine because both contain that kind of code rather than a simplified example built for a benchmark. Seager was explicit that the choice is not a commitment to replace either tool with generated output. Canonical has a vested interest in the software, he said, and wants to see what the project produces.
Open questions shape the PhD’s research agenda
Seager believes that the problem needs research and not an engineering sprint. Connecting a language model to a compiler with a test loop and iterating until the output builds risks overlooking edge cases or encoding project-specific assumptions into the system.
His list of open questions covers partitioning a repository without losing semantic context, and establishing equivalence when the C source contains undefined or implementation-dependent behaviour. It also covers handling pointer-heavy APIs, concurrency, foreign interfaces and OS boundaries, and distinguishing a translation defect from an ambiguity in the original program.
Bristol’s programming languages research group gives Canonical access to that expertise. The university, in turn, gains case studies drawn from production systems software instead of an idealised model of it. Alex Wood, the student selected for the role, has a background spanning compiler construction and functional programming. He has also worked on Rust, low-level security engineering, and cryptographic protocol implementation.
Seager set out the most optimistic outcome: a system able to translate large C repositories into Rust with strong evidence of behavioural equivalence and comparatively little manual intervention. Short of that outcome, he expects the project to produce better methods for decomposing repositories and stronger validation techniques. It could also generate reusable translation datasets and improved program-repair tools, plus a more precise understanding of where automated migration stops being reliable.
The starting pistol for the PhD is set to fire later this year.
See also: Google says Go is well suited to AI-generated code
Want to learn more about cybersecurity from industry leaders? Check out Cyber Security & Cloud Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including the AI & Big Data Expo. Click here for more information.
Developer is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.
