From 90343583858216f317b38b6a3ba227629b1723a4 Mon Sep 17 00:00:00 2001 From: F-19-F <58457605+F-19-F@users.noreply.github.com> Date: Sun, 8 Jun 2025 07:14:10 +0700 Subject: [PATCH] kernel: provide is_ksu_transition check context: this is known by many as `selinux hook`, `4.9 hook` add is_ksu_transition check which allows ksud execution under nosuid. it also eases up integration on 3.X kernels that does not have check_nnp_nosuid. this also adds a `ksu_execveat_hook` check since this transition is NOT needed anymore once ksud ran. Usage: if (check_ksu_transition(old_tsec, new_tsec)) return 0; on either check_nnp_nosuid or selinux_bprm_set_creds (after execve sid reset) reference: https://github.com/backslashxx/msm8953-kernel/commits/dfe003c9fdfa394a2bffe74668987a19a0d2f546 taken from: `allow init exec ksud under nosuid` - https://github.com/LineageOS/android_kernel_oneplus_msm8998/commit/3df9df42a659f489091445d813b8c0477215ae3a - https://github.com/tiann/KernelSU/pull/166#issue-1565872173 Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com> Signed-off-by: rsuntk --- kernel/ksud.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/kernel/ksud.c b/kernel/ksud.c index 0c325a1a..e27c2763 100644 --- a/kernel/ksud.c +++ b/kernel/ksud.c @@ -632,6 +632,31 @@ static void do_stop_input_hook(struct work_struct *work) } #endif +#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 14, 0) +#include "objsec.h" // task_security_struct +bool is_ksu_transition(const struct task_security_struct *old_tsec, + const struct task_security_struct *new_tsec) +{ + static u32 ksu_sid; + char *secdata; + u32 seclen; + bool allowed = false; + + if (!ksu_execveat_hook) // not needed anymore once ksud ran + return false; + + if (!ksu_sid) + security_secctx_to_secid("u:r:su:s0", strlen("u:r:su:s0"), &ksu_sid); + + if (security_secid_to_secctx(old_tsec->sid, &secdata, &seclen)) + return false; + + allowed = (!strcmp("u:r:init:s0", secdata) && new_tsec->sid == ksu_sid); + security_release_secctx(secdata, seclen); + return allowed; +} +#endif + static void stop_vfs_read_hook() { #ifdef CONFIG_KSU_KPROBES_HOOK