android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

kernel: core_hook: intercept devpts via security_inode_permission LSM

Browse Source 
`ksu handles devpts with selinux lsm hook` - aviraxp

- no, not yet, but yes we can, thats a good idea.

This change tries to do that, so instead of hooking pts_unix98_lookup or
devpts_get_priv, we just watch security_inode_permission, if its devpts,
pass it along to the original handler.

EDIT: define devpts super magic if its undefined
- yeah I aint gonna include a conditional include of a header just for this
- while we can just fully remove the macro and inline, readability loss is bad

Co-authored-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
This commit is contained in:
ShirkNeko
2025-09-22 23:54:51 +08:00
parent de92cc4bad
commit b4bdd17e4e
2 changed files with 29 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
kernel/core_hook.c
View File

@@ -826,6 +826,22 @@ int ksu_key_permission(key_ref_t key_ref, const struct cred *cred,
} }
#endif #endif
#ifndef DEVPTS_SUPER_MAGIC
#define DEVPTS_SUPER_MAGIC 0x1cd1
#endif
extern int __ksu_handle_devpts(struct inode *inode); // sucompat.c
int ksu_inode_permission(struct inode *inode, int mask)
{
if (inode && inode->i_sb
&& unlikely(inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)) {
//pr_info("%s: handling devpts for: %s \n", __func__, current->comm);
__ksu_handle_devpts(inode);
}
return 0;
}
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
bool ksu_is_compat __read_mostly = false; bool ksu_is_compat __read_mostly = false;
#endif #endif
@@ -880,12 +896,13 @@ static struct security_hook_list ksu_hooks[] = {
LSM_HOOK_INIT(task_prctl, ksu_task_prctl), LSM_HOOK_INIT(task_prctl, ksu_task_prctl),
LSM_HOOK_INIT(inode_rename, ksu_inode_rename), LSM_HOOK_INIT(inode_rename, ksu_inode_rename),
LSM_HOOK_INIT(task_fix_setuid, ksu_task_fix_setuid), LSM_HOOK_INIT(task_fix_setuid, ksu_task_fix_setuid),
#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0) || \ LSM_HOOK_INIT(inode_permission, ksu_inode_permission),
defined(CONFIG_IS_HW_HISI) || defined(CONFIG_KSU_ALLOWLIST_WORKAROUND)
LSM_HOOK_INIT(key_permission, ksu_key_permission)
#ifndef CONFIG_KSU_KPROBES_HOOK #ifndef CONFIG_KSU_KPROBES_HOOK
LSM_HOOK_INIT(bprm_check_security, ksu_bprm_check), LSM_HOOK_INIT(bprm_check_security, ksu_bprm_check),
#endif #endif
#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0) || \
defined(CONFIG_IS_HW_HISI) || defined(CONFIG_KSU_ALLOWLIST_WORKAROUND)
LSM_HOOK_INIT(key_permission, ksu_key_permission)
}; };
void __init ksu_lsm_hook_init(void) void __init ksu_lsm_hook_init(void)

15
kernel/sucompat.c
View File

@@ -143,7 +143,13 @@ int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr,
return 0; return 0;
} }
// dummified
int ksu_handle_devpts(struct inode *inode) int ksu_handle_devpts(struct inode *inode)
{
return 0;
}
int __ksu_handle_devpts(struct inode *inode)
{ {
#ifndef CONFIG_KSU_KPROBES_HOOK #ifndef CONFIG_KSU_KPROBES_HOOK
if (!ksu_sucompat_hook_state) if (!ksu_sucompat_hook_state)
@@ -160,20 +166,17 @@ int ksu_handle_devpts(struct inode *inode)
return 0; return 0;
} }
if (!ksu_is_allow_uid(uid)) if (likely(!ksu_is_allow_uid(uid)))
return 0; return 0;
if (ksu_devpts_sid) {
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0) || defined(KSU_OPTIONAL_SELINUX_INODE) #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0) || defined(KSU_OPTIONAL_SELINUX_INODE)
struct inode_security_struct *sec = selinux_inode(inode); struct inode_security_struct *sec = selinux_inode(inode);
#else #else
struct inode_security_struct *sec = struct inode_security_struct *sec =
(struct inode_security_struct *)inode->i_security; (struct inode_security_struct *)inode->i_security;
#endif #endif
if (sec) { if (ksu_devpts_sid && sec)
sec->sid = ksu_devpts_sid; sec->sid = ksu_devpts_sid;
}
}
return 0; return 0;
} }