diff --git a/kernel/core_hook.c b/kernel/core_hook.c index 5cd26244..4812af9a 100644 --- a/kernel/core_hook.c +++ b/kernel/core_hook.c @@ -140,8 +140,8 @@ static void disable_seccomp(struct task_struct *tsk) #ifdef CONFIG_SECCOMP tsk->seccomp.mode = 0; if (tsk->seccomp.filter) { - // TODO: Add kernel 6.11+ support - // 5.9+ have filter_count and use seccomp_filter_release + // TODO: Add kernel 6.11+ support + // 5.9+ have filter_count and use seccomp_filter_release #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0) seccomp_filter_release(tsk); atomic_set(&tsk->seccomp.filter_count, 0); @@ -840,25 +840,10 @@ static int ksu_task_fix_setuid(struct cred *new, const struct cred *old, } #ifndef MODULE -extern int __ksu_handle_devpts(struct inode *inode); -static int ksu_inode_permission(struct inode *inode, int mask) -{ - if (unlikely(inode->i_sb && - inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)) { -#ifdef CONFIG_KSU_DEBUG - pr_info("%s: devpts inode accessed with mask: %x\n", __func__, - mask); -#endif - __ksu_handle_devpts(inode); - } - return 0; -} - static struct security_hook_list ksu_hooks[] = { LSM_HOOK_INIT(task_prctl, ksu_task_prctl), LSM_HOOK_INIT(inode_rename, ksu_inode_rename), LSM_HOOK_INIT(task_fix_setuid, ksu_task_fix_setuid), - LSM_HOOK_INIT(inode_permission, ksu_inode_permission), #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0) || \ defined(CONFIG_IS_HW_HISI) || defined(CONFIG_KSU_ALLOWLIST_WORKAROUND) LSM_HOOK_INIT(key_permission, ksu_key_permission) diff --git a/kernel/sucompat.c b/kernel/sucompat.c index daefd43e..a7541425 100644 --- a/kernel/sucompat.c +++ b/kernel/sucompat.c @@ -143,8 +143,13 @@ int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr, return 0; } -static int ksu_inline_handle_devpts(struct inode *inode) +int ksu_handle_devpts(struct inode *inode) { +#ifndef CONFIG_KSU_KPROBES_HOOK + if (!ksu_sucompat_hook_state) + return 0; +#endif + if (!current->mm) { return 0; } @@ -173,21 +178,6 @@ static int ksu_inline_handle_devpts(struct inode *inode) return 0; } -int __ksu_handle_devpts(struct inode *inode) -{ -#ifndef CONFIG_KSU_KPROBES_HOOK - if (!ksu_sucompat_hook_state) - return 0; -#endif - return ksu_inline_handle_devpts(inode); -} - -// dead code, we are phasing out ksu_handle_devpts for LSM hooks. -int __maybe_unused ksu_handle_devpts(struct inode *inode) -{ - return 0; -} - #ifdef CONFIG_KSU_KPROBES_HOOK static int faccessat_handler_pre(struct kprobe *p, struct pt_regs *regs) @@ -234,7 +224,7 @@ static int pts_unix98_lookup_pre(struct kprobe *p, struct pt_regs *regs) inode = (struct inode *)PT_REGS_PARM2(regs); #endif - return ksu_inline_handle_devpts(inode); + return ksu_handle_devpts(inode); } #else static struct kprobe *su_kps[5]; @@ -280,9 +270,7 @@ void ksu_sucompat_init(void) su_kps[2] = init_kprobe(SYS_FACCESSAT_SYMBOL, faccessat_handler_pre); su_kps[3] = init_kprobe(SYS_NEWFSTATAT_SYMBOL, newfstatat_handler_pre); su_kps[4] = init_kprobe(SYS_FSTATAT64_SYMBOL, newfstatat_handler_pre); -#ifdef MODULE su_kps[5] = init_kprobe("pts_unix98_lookup", pts_unix98_lookup_pre); -#endif #else ksu_sucompat_hook_state = true; pr_info("ksu_sucompat init\n");