android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

kernel: refine syscall_hook_manager

Browse Source 
- Don't unmark process when setuid if syscall tracepoint is in use
- Remark process when app profile updated
- Ensure zygote is marked on first boot
This commit is contained in:
5ec1cff
2025-11-13 19:50:54 +08:00
committed by ShirkNeko
parent bb8b991110
commit 9f869090d2
7 changed files with 68 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
kernel/syscall_hook_manager.c
View File

@@ -20,9 +20,21 @@
#include "selinux/selinux.h"
// Tracepoint registration count management
// == 1: just us
// > 1: someone else is also using syscall tracepoint e.g. ftrace
static int tracepoint_reg_count = 0;
static DEFINE_SPINLOCK(tracepoint_reg_lock);
void ksu_clear_task_tracepoint_flag_if_needed(struct task_struct *t)
{
unsigned long flags;
spin_lock_irqsave(&tracepoint_reg_lock, flags);
if (tracepoint_reg_count <= 1) {
ksu_clear_task_tracepoint_flag(t);
}
spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
}
// Process marking management
static void handle_process_mark(bool mark)
{
@@ -49,7 +61,7 @@ void ksu_unmark_all_process(void)
pr_info("hook_manager: unmark all user process done!\n");
}
void ksu_mark_running_process(void)
static void ksu_mark_running_process_locked()
{
struct task_struct *p, *t;
read_lock(&tasklist_lock);
@@ -70,12 +82,28 @@ void ksu_mark_running_process(void)
ksu_set_task_tracepoint_flag(t);
pr_info("hook_manager: mark process: pid:%d, uid: %d, comm:%s\n",
t->pid, uid, t->comm);
} else {
ksu_clear_task_tracepoint_flag(t);
pr_info("hook_manager: unmark process: pid:%d, uid: %d, comm:%s\n",
t->pid, uid, t->comm);
}
put_cred(cred);
}
read_unlock(&tasklist_lock);
}
void ksu_mark_running_process()
{
unsigned long flags;
spin_lock_irqsave(&tracepoint_reg_lock, flags);
if (tracepoint_reg_count <= 1) {
ksu_mark_running_process_locked();
} else {
pr_info("hook_manager: not mark running process since syscall tracepoint is in use\n");
}
spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
}
// Get task mark status
// Returns: 1 if marked, 0 if not marked, -ESRCH if task not found
int ksu_get_task_mark(pid_t pid)
@@ -169,10 +197,9 @@ static int syscall_regfunc_handler(struct kretprobe_instance *ri, struct pt_regs
spin_lock_irqsave(&tracepoint_reg_lock, flags);
if (tracepoint_reg_count < 1) {
// while install our tracepoint, mark our processes
ksu_unmark_all_process();
ksu_mark_running_process();
} else {
// while installing other tracepoint, mark all processes
ksu_mark_running_process_locked();
} else if (tracepoint_reg_count == 1) {
// while other tracepoint first added, mark all processes
ksu_mark_all_process();
}
tracepoint_reg_count++;
@@ -184,15 +211,14 @@ static int syscall_unregfunc_handler(struct kretprobe_instance *ri, struct pt_re
{
unsigned long flags;
spin_lock_irqsave(&tracepoint_reg_lock, flags);
if (tracepoint_reg_count <= 1) {
// while uninstall our tracepoint, unmark all processes
ksu_unmark_all_process();
} else {
// while uninstalling other tracepoint, mark our processes
ksu_unmark_all_process();
ksu_mark_running_process();
}
tracepoint_reg_count--;
if (tracepoint_reg_count <= 0) {
// while no tracepoint left, unmark all processes
ksu_unmark_all_process();
} else if (tracepoint_reg_count == 1) {
// while just our tracepoint left, unmark disallowed processes
ksu_mark_running_process_locked();
}
spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
return 0;
}
@@ -216,20 +242,19 @@ static inline bool check_syscall_fastpath(int nr)
}
}
int ksu_handle_init_mark_tracker(const char __user **filename_user,
void *__never_use_argv, void *__never_use_envp,
int *__never_use_flags)
// Unmark init's child that are not zygote or adbd
int ksu_handle_init_mark_tracker(const char __user **filename_user)
{
char path[64];
if (unlikely(!filename_user))
return 0;
memset(path, 0, sizeof(path));
strncpy_from_user_nofault(path, *filename_user, sizeof(path));
if (likely(strstr(path, "adbd") == NULL)){
ksu_clear_task_tracepoint_flag(current);
if (likely(strstr(path, "/app_process") == NULL && strstr(path, "/adbd") == NULL)) {
ksu_clear_task_tracepoint_flag_if_needed(current);
}
return 0;
@@ -273,8 +298,8 @@ static void ksu_sys_enter_handler(void *data, struct pt_regs *regs, long id)
if (id == __NR_execve) {
const char __user **filename_user =
(const char __user **)&PT_REGS_PARM1(regs);
if (current->pid == 1) {
ksu_handle_init_mark_tracker(filename_user, NULL, NULL, NULL);
if (current->pid != 1 && is_init(get_current_cred())) {
ksu_handle_init_mark_tracker(filename_user);
} else {
ksu_handle_execve_sucompat(filename_user, NULL, NULL, NULL);
}
@@ -316,8 +341,7 @@ void ksu_syscall_hook_manager_init(void)
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
ret = register_trace_sys_enter(ksu_sys_enter_handler, NULL);
#ifndef CONFIG_KRETPROBES
ksu_unmark_all_process();
ksu_mark_running_process();
ksu_mark_running_process_locked();
#endif
if (ret) {
pr_err("hook_manager: failed to register sys_enter tracepoint: %d\n", ret);