This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann#1785
tiann#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann/KernelSU#1785
tiann/KernelSU#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann/KernelSU#1785
tiann/KernelSU#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann/KernelSU#1785
tiann/KernelSU#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann/KernelSU#1785
tiann/KernelSU#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann/KernelSU#1785
tiann/KernelSU#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann#1785
tiann#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann#1785
tiann#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann#1785
tiann#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

* This is a squashed of un-merged pull requests of Official KernelSU
* LKM support are not available.
* Require this additional patch to avoid kernel panic because of "Too many LSMs registered":
android-generic/kernel-zenith@7042991

* Un-merged pull requests of Official KernelSU:
tiann#1785
tiann#2662

* This commit probably not 100% completed.

Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>

Require [this PR](#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

* kernel: replace renameat hook with fsnotify (#910)

* kernel: replace renameat hook with fsnotify

* kernel: fix compile

* kernel: fix compile below 6.0

---------

Co-authored-by: weishu <twsxtd@gmail.com>

* new supercall impl (tiann/KernelSU#2835)

Co-authored-by: weishu <twsxtd@gmail.com>

* Fix ksud build (tiann/KernelSU#2841)

* fix: a lot (tiann/KernelSU#2843)

* fix: a lot again (tiann/KernelSU#2845)

* Fix ksud build, take 3 (tiann/KernelSU#2842)

* Fix ksud build, take 4 (tiann/KernelSU#2846)

Remove init_driver_fd function for non-linux/android targets

* fix ksucalls, same now

* kernel: remove unused

* back to kprobe setuid hook

* Implement workqueue for unmounting

umount schedules, so it cannot be used in kprobe context.

* switch ns umount

* refact: use feature subsystem

* use 64bit feature

* fix

* add fixme

* add feature max to get_info

* use 32bit feature id

* allow root to get/set feature

* more clean perm_check functions

* do not expose perm checker

* add feature command to ksud

* fix security_task_fix_setuid_handler_pre

* manager: add kernel_umount switch (tiann/KernelSU#2848)

* add name and print command value

* fix

* ksud: clippy

* ksud: cargo fmt

* update ioctl macro (tiann/KernelSU#2850)

* use cap_task_fix_setuid hook to avoid inline issue

* kernel: disable setuid debug log

* update embed ksuinit to v2

* kernel: remove dynamic alloc in feature

* Reapply: "kernel: Allow to use in Private Space" (tiann/KernelSU#2857)

rebase of
tiann/KernelSU@0576495

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Co-authored-by: weishu <twsxtd@gmail.com>

* add legacy get_version

* fix: get legacy version

* [PARTIAL] ksud: migrate to Rust 2024 edition

* ksud: add managed_feature

* add check_managed_features to installer.sh

* manager: fix legacy get version

* rename to managedFeatures

* ksud: clippy

* Revert "Implement workqueue for unmounting"

This reverts commit tiann/KernelSU@ec0e5da.

* kernel: rework umount with task_work

* kernel: init/exit umount feature

* Fix legacy prctl check condition (tiann/KernelSU#2864)

* kernel: supercall: allow escalation on ioctl interface (tiann/KernelSU#2862)

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>

* Support building for kernel 6.14+  (tiann/KernelSU#2662)

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

* support mainline kernel (tiann/KernelSU#2869)

* kernel: use sys_enter tracepoint for sucompat (tiann/KernelSU#2866)

Co-authored-by: weishu <twsxtd@gmail.com>

* fix: mark tif (tiann/KernelSU#2871)

* fix sepolicy patch hint (tiann/KernelSU#2872)

* kernel: remove unused workqueue

* feature: add enhanced security (tiann/KernelSU#2873)

* kernel: Set the tracepoint flag in a tracepoint manner

* kernel: clean headers

* fix: sucompat (tiann/KernelSU#2874)

Co-authored-by: Wang Han <416810799@qq.com>

* add mutex for sucompat mark

* kill pgrp in enhanced security

* fix: enhanced security register

* skip init_features in safe mode

* revert: still using workqueue for allowlist

* Revert "kernel: remove unused workqueue"

This reverts commit tiann/KernelSU@9060e61.

* build: remove -Wno-implicit-function-declaration

* Replace mutex with spinlock for tracepoint registration (tiann/KernelSU#2882)

* Switch kretprobe to heap (tiann/KernelSU#2880)

Co-authored-by: Ylarod <me@ylarod.cn>

* kernel: Refactor selinux/selinux.c (tiann/KernelSU#2881)

Signed-off-by: shadichy <shadichy@blisslabs.org>
Co-authored-by: Wang Han <416810799@qq.com>

* Use force_sig(SIGKILL) to kill process

* kernel: remove workqueue for allowlist

* kernel: remove ksu_compat_{open,read,write} because we're in the right context now

* kernel: remove unused wrapper for

* kernel: Use real_parent to avoid interference from ptrace.

* kernel: remove unused kernel_compat

* kernel: fix save allowlist

* Fix missing unlock on error path

* use proxy file for pts (tiann/KernelSU#2886)

Signed-off-by: 5ec1cff <56485584+5ec1cff@users.noreply.github.com>
Co-authored-by: Wang Han <416810799@qq.com>
Co-authored-by: Ylarod <me@ylarod.cn>

* kernel: fix put_task if alloc failed.

* clean unused header

* on_module_mounted in ksud.c

* refact: use app_profile

* unified hook manager

* add zygote to hook target

* use kprobe for reboot hook

* move reboot hook to supercall.c

* refactor: kernel_umount setuid_hook

* update mark rules, add init mark tracker

* update setuid_hook, remove uneeded sucompat enable

* log freely

* cli: add ksud debug mark

* Fix rustfmt warning

* Clean up kernel code (tiann/KernelSU#2898)

1) Fix memory leak of callback head in allowlist.c
2) Remove duplicated logic and incorrect log in kernel_umount.c
3) Prevent sleep in kprobe context in ksud.c
4) Remove useless is_unsupported_uid, use euid for security enhance,
   add FIXME in setuid_hook.c
5) Remove useless fd argument for execve hook, fix incorrent pointer
   usage in syscall_hook_manager.c and sucompat.c
6) Use correct errno in supercalls.c

---------

Co-authored-by: Ylarod <me@ylarod.cn>

* manager: fix KsuCli cmd

* fix missing header

* kernel: Don't save allowlist on module exit

This is not needed and may trigger UAF as work is async.

* kernel: Use task work to install fd

There are many fd related functions that can sleep, so we have no choice
but move operations to task work. Also close fd when copy_to_user fails.

* kernel: Fix task flag marking for root and shell UID

Signed-off-by: Wang Han <416810799@qq.com>
Co-authored-by: 5ec1cff <56485584+5ec1cff@users.noreply.github.com>

* kernel: fix wrong show_fdinfo impl

Signed-off-by: Wang Han <416810799@qq.com>

* kernel: refine file wrapper

Signed-off-by: Wang Han <416810799@qq.com>

* kernel: fix zygote mark on first boot (tiann/KernelSU#2924)

* kernel: refine syscall_hook_manager

- Don't unmark process when setuid if syscall tracepoint is in use
- Remark process when app profile updated
- Ensure zygote is marked on first boot

* userspace: ksud: removed dual mount system and kept only overlayfs for now for future meta module plans and also updated code to follow new  ioctl calls

* manager: native: introduce new enhanced security functions

* manager: removed susfs info and control

* manager: remove dual mount system functionality

* ksud: fix module mount info

* ksud: removed unused variable

* script: updated userspace build script

* manager: add enhanced security toggle

* kernel: remove redundant code

* manager: removed redundant minimal checks

* manager; fix supported kmi command

* manager: refine webui package manager

use superuser viewmodel companion to get applist, no longer require QUERY_ALL_PACKAGES permission.

Signed-off-by: rifat azad <rifat.44.azad.rifs@gmail.com>

* feat(ksud): Optimize ensure_dir_exist and do not hardcode path (#2932)

I believe that hardcoding `/proc/self/exe` is not feasible, so I used an
implementation from the std library.

And I optimized ensure_dir_exist logic.

Signed-off-by: Tools-app <localhost.hutao@gmail.com>

* kernel: Prune allowlist only after boot completed

For unknown reason, packages.list is not reliable during boot for oplus
devices, so we have to disable pruning and re-run pruning after boot.

* kernel: no need to remark process on post-fs-data and boot-completed

- Remark on post-fs-data may unmark zygote unexpectedly, and there is no
necessity to remark on these stages, so simply remove them.

* kernel: file_wrapper: copy mode of original inode

Bionic uses fstat to determine whether an fd is a tty and set proper
buffering flags, so we also need to set the wrapper file's inode mode to
the original inode mode.

see:
https://cs.android.com/android/platform/superproject/main/+/main:bionic/libc/upstream-openbsd/lib/libc/stdio/makebuf.c;l=61-95;drc=9a4b68e20d617b2cb3355071521f16e8c3d538df

* kernel: Replace kmalloc() usages with kzalloc() (#2939)

This ensures we won't use uninitialized pointers for task work.

* support metamodule, remove built-in overlayfs mount (#2929)

Co-authored-by: weishu <twsxtd@gmail.com>
Co-authored-by: YuKongA <70465933+YuKongA@users.noreply.github.com>

* kernel: Add nuke_ext4_sysfs interface

* ksud: Add cli interface for nuke_ext4_sysfs

* ksud: add modules_update back (#2948)

* manager: remove overlayfs quard and shrink sparse

* kernel/ksud: Fix KSU_IOCTL_NUKE_EXT4_SYSFS definition

* kernel: expose umount list to ioctl interface (#2950)

This idea is borrowed from simonpunk's susfs4ksu.
What we see here is that, yeah well, lets just have userspace send us
what it
wants unmounted, this is better than hardcoding everything.

This also solves that issue where MNT_DETACH fails, as long as we send
unmountables in proper order.

A small anti-duplicate mechanism is also added.

While in-kernel umount is a bit worse than zygisk-provider-based ones,
this can still
serve as a healthy alternative.

---------

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Co-authored-by: weishu <twsxtd@gmail.com>

* Prevent regular installs when metamodule unstable

* userspace: add missing update flag

* ksud: Add `mount` flag for module list

* ksud: respect `skip_mount`

* ksud: Fix the blocking installation issue; it is not working with a fresh installation of the metamodule.

* ksud: 1. Handle module upgrade first; 2. Ensure that disabling persists across module upgrades.

* ksud: Fix the issue where a newly installed module is not uninstalled after being immediately removed and rebooted.

* ksud: Fix the metamodule's non-meta stage script, which is executed twice.

* meta-overlayfs: avoid moving skip-mount modules

* ksud: make rustix version fixed

tiann/KernelSU#2947 (comment)

Co-authored-by: CanerKaraca23

* metaovl: use `cp` instead of `mv` to copy files

* metaovl: Use xcp to copy image faster.

* metaovl: copy selinux context when install

* add module config, migrate managedFeatures (#2965)

Co-authored-by: YuKongA <70465933+YuKongA@users.noreply.github.com>

* ksud: larger config value size limit, update docs

* ksud: config set support read from stdin, and less restriction

* ksud: Set KSU_MODULE only for module script (#2971)

* ksud: fmt

* kernel: remove OVERLAY_FS dependency

* kernel: Unmount all isolated process which forks from zygote

Kernel has few information about which isolated process belongs to which
application, so there is actually no good choice if we don't implement a
userspace daemon. One choice is to access cmdline memory from kernel,
but cmdline is __user, and it is likely to trigger detections. Before we
have more good ideas, use this.

* kernel: Remove unreachable vfs_statx handling

* sucompat: Fix execve filename access on ARM64

* kernel: Add preempt_{disable|enable}_notrace for MODULE

* kernel: Fix execve filename access on ARM64

* ksud: Remove warning for non-tty std

* kernel: remove redundant KSU_KPROBES_HOOK guard

* kernel: remove unused functions and KSU_ALLOWLIST_WORKAROUND guard

* kernel: fix selinux

* meta-overlayfs: Moved to module repo

* workflow: test new workflow

* kernel: update Makefile

* kernel: replace deprecated strlcpy and use strscpy

* manager: remove closed source lkm warning

* userspace: add `feature get --config`

* fix #2980

* manager: upgrade ndk29

* kernel: tweak Makefile

Signed-off-by: rifat azad <rifat.44.azad.rifs@gmail.com>

* manager: bump gradle version

* manager: add additional gradle properties

* manager: fix exec command

* manager: remove build output verbose

* manager: bump agp lib version

* workflow: add manager dispatch trigger

* manager: add empty newline to avoid buildtime append syntax error

* workflow: add missing API id/hash for telegram upload

* kernel: try fix manager crowning

* userspace: rename mount system to meta

* src: release v3.0.0

* mananger: fix memory leak

* manager: combine 3 list packages api into 1

* manager: filter ksuapp in superuser screen
this will allow showing kernelsu app info in webui

Signed-off-by: KOWX712 <leecc0503@gmail.com>

* workflow: configure spoofed and ci manager build

---------

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Signed-off-by: hmtheboy154 <buingoc67@gmail.com>
Signed-off-by: shadichy <shadichy@blisslabs.org>
Signed-off-by: 5ec1cff <56485584+5ec1cff@users.noreply.github.com>
Signed-off-by: Wang Han <416810799@qq.com>
Signed-off-by: rifat azad <rifat.44.azad.rifs@gmail.com>
Signed-off-by: Tools-app <localhost.hutao@gmail.com>
Signed-off-by: KOWX712 <leecc0503@gmail.com>
Co-authored-by: pershoot <190600+pershoot@users.noreply.github.com>
Co-authored-by: weishu <twsxtd@gmail.com>
Co-authored-by: Ylarod <me@ylarod.cn>
Co-authored-by: Wang Han <416810799@qq.com>
Co-authored-by: YuKongA <70465933+YuKongA@users.noreply.github.com>
Co-authored-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Co-authored-by: Huy Minh <39849246+hmtheboy154@users.noreply.github.com>
Co-authored-by: libingxuan <84086386+aaaaaaaa-815@users.noreply.github.com>
Co-authored-by: Shadichy <60534636+shadichy@users.noreply.github.com>
Co-authored-by: 5ec1cff <56485584+5ec1cff@users.noreply.github.com>
Co-authored-by: KOWX712 <leecc0503@gmail.com>
Co-authored-by: 生于生时 亡于亡刻 <127004703+Tools-cx-app@users.noreply.github.com>

Require [this PR](tiann#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann/KernelSU#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

Require [this PR](tiann#1785) which is
made for 6.8+ to be able to build.

---------

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>

This is based on commit "LSM: Identify modules by more than name"
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.8&id=f3b8788cde61b02f1e6c202f8fac4360e6adbafc

Which is a requirement to build on kernel 6.8+. I use 912 as the ID
for KernelSU as that's the date the Github repo was created.

Signed-off-by: hmtheboy154 <buingoc67@gmail.com>