kernel: Prune allowlist only after boot completed

For unknown reason, packages.list is not reliable during boot for oplus
devices, so we have to disable pruning and re-run pruning after boot.

kernel/allowlist.c

@@ -15,6 +15,7 @@
 #endif
 
 #include "klog.h" // IWYU pragma: keep
+#include "ksud.h"
 #include "selinux/selinux.h"
 #include "allowlist.h"
 #include "manager.h"
@@ -489,6 +490,11 @@ void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *),
     struct perm_data *np = NULL;
     struct perm_data *n = NULL;
 
+    if (!ksu_boot_completed) {
+        pr_info("boot not completed, skip prune\n");
+        return;
+    }
+
     bool modified = false;
     // TODO: use RCU!
     mutex_lock(&allowlist_mutex);

kernel/ksud.c

@@ -24,6 +24,7 @@
 #include "ksud.h"
 #include "selinux/selinux.h"
 #include "syscall_hook_manager.h"
+#include "throne_tracker.h"
 
 bool ksu_module_mounted __read_mostly = false;
 bool ksu_boot_completed __read_mostly = false;
@@ -126,6 +127,7 @@ void on_module_mounted(void){
 void on_boot_completed(void){
     ksu_boot_completed = true;
     pr_info("on_boot_completed!\n");
+    track_throne(true);
     // remark process, we don't want to mark other init
     // forked process excepte zygote and adbd
     ksu_mark_running_process();

kernel/pkg_observer.c

@@ -37,7 +37,7 @@ static int ksu_handle_inode_event(struct fsnotify_mark *mark, u32 mask,
         if (ksu_uid_scanner_enabled) {
             ksu_request_userspace_scan();
         }
-        track_throne();
+        track_throne(false);
     }
     return 0;
 }

kernel/throne_tracker.c

@@ -427,7 +427,7 @@ static bool is_uid_exist(uid_t uid, char *package, void *data)
     return exist;
 }
 
-void track_throne(void)
+void track_throne(bool prune_only)
 {
     struct list_head uid_list;
     struct uid_data *np, *n;
@@ -504,6 +504,9 @@ void track_throne(void)
     }
 
 uid_ready:
+    if (prune_only)
+        goto prune;
+
     // first, check if manager_uid exist!
     list_for_each_entry(np, &uid_list, list) {
         if (np->uid == current_manager_uid) {
@@ -547,6 +550,7 @@ uid_ready:
         pr_info("Manager search finished\n");
     }
     
+prune:
     // then prune the allowlist
     ksu_prune_allowlist(is_uid_exist, &uid_list);
 out:

kernel/throne_tracker.h

@@ -5,6 +5,6 @@ void ksu_throne_tracker_init();
 
 void ksu_throne_tracker_exit();
 
-void track_throne();
+void track_throne(bool prune_only);
 
 #endif