diff --git a/userspace/ksud/src/event.rs b/userspace/ksud/src/event.rs
index 61aa7ea2..6b79d8ee 100644
--- a/userspace/ksud/src/event.rs
+++ b/userspace/ksud/src/event.rs
@@ -92,6 +92,8 @@ pub fn mount_systemlessly(module_dir: &str) -> Result<()> {
 pub fn on_post_data_fs() -> Result<()> {
     crate::ksu::report_post_fs_data();
 
+    utils::umask(0);
+
     #[cfg(unix)]
     let _ = catch_bootlog();
 
@@ -100,7 +102,18 @@ pub fn on_post_data_fs() -> Result<()> {
         return Ok(());
     }
 
-    utils::umask(0);
+    let safe_mode = crate::utils::is_safe_mode();
+
+    if safe_mode {
+        // we should still mount modules.img to `/data/adb/modules` in safe mode
+        // becuase we may need to operate the module dir in safe mode
+        warn!("safe mode, skip common post-fs-data.d scripts");
+    } else {
+        // Then exec common post-fs-data scripts
+        if let Err(e) = crate::module::exec_common_scripts("post-fs-data.d", true) {
+            warn!("exec common post-fs-data scripts failed: {}", e);
+        }
+    }
 
     let module_update_img = defs::MODULE_UPDATE_IMG;
     let module_img = defs::MODULE_IMG;
@@ -129,7 +142,6 @@ pub fn on_post_data_fs() -> Result<()> {
         }
     }
 
-    // If there isn't any image exist, do nothing for module!
     if !Path::new(target_update_img).exists() {
         return Ok(());
     }
@@ -140,8 +152,8 @@ pub fn on_post_data_fs() -> Result<()> {
     mount::AutoMountExt4::try_new(target_update_img, module_dir, false)
         .with_context(|| "mount module image failed".to_string())?;
 
-    // check safe mode first.
-    if crate::utils::is_safe_mode() {
+    // if we are in safe mode, we should disable all modules
+    if safe_mode {
         warn!("safe mode, skip post-fs-data scripts and disable all modules!");
         if let Err(e) = crate::module::disable_all_modules() {
             warn!("disable all modules failed: {}", e);
@@ -153,11 +165,6 @@ pub fn on_post_data_fs() -> Result<()> {
         warn!("prune modules failed: {}", e);
     }
 
-    // Then exec common post-fs-data scripts
-    if let Err(e) = crate::module::exec_common_scripts("post-fs-data.d", true) {
-        warn!("exec common post-fs-data scripts failed: {}", e);
-    }
-
     // load sepolicy.rule
     if crate::module::load_sepolicy_rule().is_err() {
         warn!("load sepolicy.rule failed");
@@ -197,7 +204,7 @@ pub fn on_services() -> Result<()> {
     }
 
     if crate::utils::is_safe_mode() {
-        warn!("safe mode, skip module service scripts");
+        warn!("safe mode, skip service.d scripts");
         return Ok(());
     }