Canonical, together with UK Research and Innovation, is funding a three-year PhD project at the University of Bristol to build a system that automatically translates large C codebases into safe, idiomatic Rust. The pipeline breaks a codebase into dependency-aware chunks, uses language models trained on C-to-Rust conversions for translation, then validates results with fuzzing and formal equivalence checks, repairing mismatches via symbolic program repair. The test cases are AppArmor and snap-confine, two production security components on Ubuntu, chosen for their real-world complexity rather than ease. Canonical's Jon Seager stressed that nothing generated by the project will be merged into either tool soon; the goal is to evaluate whether automated translation can be trusted on security-critical code before any rewrite is considered.
Questions this post answers
What is Canonical's PhD project to automate C to Rust translation actually testing on?
The project uses AppArmor and snap-confine, two production Ubuntu security components handling access control and sandboxing, as its industrial-grade test cases. These were chosen precisely because they are complex, live, and heavily relied upon, giving a realistic measure of whether automated C-to-Rust translation can preserve behavior in security-critical code, rather than because they are easy to convert. Anyone weighing a Rust rewrite of critical C components can follow how this translation approach performs via daily.dev.
How does an automated C to Rust translation pipeline verify the converted code behaves correctly?
It combines fuzzing with formal equivalence checks to catch behavioral mismatches between the original C and the generated Rust. When a mismatch is found, a symbolic program-repair step locates the faulty translation and patches it directly instead of regenerating the entire code chunk, reducing wasted retranslation work. Teams exploring code migration verification techniques can track this kind of research through daily.dev.
Is Canonical planning to replace AppArmor or snap-confine with Rust code soon?
No, nothing generated by this translation research is going into either tool in the near term. Canonical's Jon Seager clarified the goal is to evaluate whether the automated approach can be trusted on security-critical code, driven by Canonical's vested interest in the software, not to signal an imminent rewrite. Developers tracking Ubuntu's security roadmap can follow updates on this research through daily.dev.