ksud: check kernel safemode

userspace/ksud/src/ksu.rs

@@ -16,6 +16,7 @@ const CMD_GET_VERSION: u64 = 2;
 // const CMD_GET_DENY_LIST: u64 = 6;
 const CMD_REPORT_EVENT: u64 = 7;
 pub const CMD_SET_SEPOLICY: u64 = 8;
+pub const CMD_CHECK_SAFEMODE: u64 = 9;
 
 const EVENT_POST_FS_DATA: u64 = 1;
 const EVENT_BOOT_COMPLETED: u64 = 2;
@@ -69,6 +70,22 @@ fn report_event(event: u64) {
     }
 }
 
+pub fn check_kernel_safemode() -> bool {
+    let mut result: i32 = 0;
+    #[cfg(any(target_os = "linux", target_os = "android"))]
+    unsafe {
+        #[allow(clippy::cast_possible_wrap)]
+        libc::prctl(
+            KERNEL_SU_OPTION as i32, // supposed to overflow
+            CMD_CHECK_SAFEMODE,
+            0,
+            0,
+            std::ptr::addr_of_mut!(result).cast::<libc::c_void>(),
+        );
+    }
+    result == KERNEL_SU_OPTION as i32
+}
+
 pub fn report_post_fs_data() {
     report_event(EVENT_POST_FS_DATA);
 }

userspace/ksud/src/utils.rs

@@ -74,12 +74,19 @@ pub fn getprop(_prop: &str) -> Option<String> {
 }
 
 pub fn is_safe_mode() -> bool {
-    getprop("persist.sys.safemode")
+    let safemode = getprop("persist.sys.safemode")
         .filter(|prop| prop == "1")
         .is_some()
         || getprop("ro.sys.safemode")
             .filter(|prop| prop == "1")
-            .is_some()
+            .is_some();
+    log::info!("safemode: {}", safemode);
+    if safemode {
+        return true;
+    }
+    let safemode = crate::ksu::check_kernel_safemode();
+    log::info!("kernel_safemode: {}", safemode);
+    safemode
 }
 
 pub fn get_zip_uncompressed_size(zip_path: &str) -> Result<u64> {