diff --git a/kernel/core_hook.c b/kernel/core_hook.c index 37795747..53185d59 100644 --- a/kernel/core_hook.c +++ b/kernel/core_hook.c @@ -471,6 +471,9 @@ int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3, u32 *result = (u32 *)arg5; u32 reply_ok = KERNEL_SU_OPTION; uid_t current_uid_val = current_uid().val; +if (likely(ksu_is_current_proc_umounted())) { // prevent side channel attack in ksu side + return 0; + } #ifdef CONFIG_KSU_MANUAL_SU is_manual_su_cmd = (arg2 == CMD_SU_ESCALATION_REQUEST || @@ -1082,6 +1085,10 @@ int ksu_handle_setuid(struct cred *new, const struct cred *old) // try umount ksu temp path try_umount("/debug_ramdisk", false, MNT_DETACH); + get_task_struct(current); // delay fix + ksu_set_current_proc_umounted(); + put_task_struct(current); + return 0; } diff --git a/kernel/core_hook.h b/kernel/core_hook.h index 6ed328a0..5f121ae3 100644 --- a/kernel/core_hook.h +++ b/kernel/core_hook.h @@ -3,8 +3,19 @@ #include #include "apk_sign.h" +#include void __init ksu_core_init(void); void ksu_core_exit(void); +#define KSU_PROC_UMOUNT 50 + +static inline bool ksu_is_current_proc_umounted(void) { + return test_ti_thread_flag(¤t->thread_info, KSU_PROC_UMOUNT); +} + +static inline void ksu_set_current_proc_umounted(void) { + set_ti_thread_flag(¤t->thread_info, KSU_PROC_UMOUNT); +} + #endif