Update the build workflow to rename build tasks and add new build dependencies

.github/FUNDING.yml

@@ -1,4 +1,5 @@
+# These are supported funding model platforms
+
 github: tiann
 patreon: weishu
-open_collective: sukisu-ultra
-
+custom: https://vxposed.com/donate.html

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Feature Request
+    url: https://github.com/tiann/KernelSU/issues/1705
+    about: "We do not accept external Feature Requests, see this link for more details."

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,39 +0,0 @@
-name: Feature Request
-description: "Suggest an idea for this project"
-title: "[Feature]"
-labels: "feature"
-body:
-  - type: markdown
-    id: feature-info
-    attributes:
-      value: "## Feature Infomation"
-  - type: textarea
-    id: feature-main
-    validations:
-      required: true
-    attributes:
-      label: "Is your feature request related to a problem? Please describe."
-      description: "A clear and concise description of what the problem is."
-      placeholder: "I'm always frustrated when [...]"
-  - type: textarea
-    id: feature-solution
-    validations:
-      required: true
-    attributes:
-      label: "Describe the solution you'd like."
-      description: "A clear and concise description of what you want to happen."
-  - type: textarea
-    id: feature-describe
-    validations:
-      required: true
-    attributes:
-      label: "Describe alternatives you've considered."
-      description: "A clear and concise description of any alternative solutions or features you've considered."
-  - type: textarea
-    id: feature-extra
-    validations:
-      required: false
-    attributes:
-      label: "Additional context"
-      description: "Add any other context or screenshots about the feature request here."
-

.github/workflows/build-gki-image.yml

@@ -1,20 +0,0 @@
-name: Build Android GKI Image
-on:
-  workflow_call:
-
-jobs:
-  build-a12-kernel:
-    uses: ./.github/workflows/build-kernel-a12.yml
-    secrets: inherit
-  build-a13-kernel:
-    uses: ./.github/workflows/build-kernel-a13.yml
-    secrets: inherit
-  build-a14-kernel:
-    uses: ./.github/workflows/build-kernel-a14.yml
-    secrets: inherit
-  build-a15-kernel:
-    uses: ./.github/workflows/build-kernel-a15.yml
-    secrets: inherit
-  build-a16-kernel:
-    uses: ./.github/workflows/build-kernel-a16.yml
-    secrets: inherit

.github/workflows/build-kernel-a12.yml

@@ -1,111 +0,0 @@
-name: Build Kernel - Android 12
-on:
-  # push:
-  #   branches: ["main", "ci", "checkci"]
-  #   paths:
-  #     - ".github/workflows/deps/gki/build-kernel-a12.yml"
-  #     - ".github/workflows/deps/gki/gki-kernel.yml"
-  #     - ".github/scripts/build_a12.sh"
-  #     - "kernel/**"
-  workflow_call:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-jobs:
-  build-kernel:
-    if: github.event_name != 'pull_request' && github.ref != 'refs/heads/checkci'
-    strategy:
-      matrix:
-        include:
-          - sub_level: 209
-            os_patch_level: 2024-05
-          - sub_level: 218
-            os_patch_level: 2024-08
-          - sub_level: 226
-            os_patch_level: 2024-11
-          - sub_level: 233
-            os_patch_level: 2025-02
-          - sub_level: 236
-            os_patch_level: 2025-05
-    uses: ./.github/workflows/gki-kernel.yml
-    secrets: inherit
-    with:
-      version: android12-5.10
-      version_name: android12-5.10.${{ matrix.sub_level }}
-      tag: android12-5.10-${{ matrix.os_patch_level }}
-      os_patch_level: ${{ matrix.os_patch_level }}
-      patch_path: "5.10"
-      debug: ${{ inputs.debug || false }}
-  
-  upload-artifacts:
-    needs: build-kernel
-    runs-on: ubuntu-latest
-    if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' || github.ref == 'refs/heads/ci' }}
-    env:
-      CHAT_ID: ${{ secrets.CHAT_ID }}
-      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-      MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
-      COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-      COMMIT_URL: ${{ github.event.head_commit.url }}
-      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-
-      - uses: actions/checkout@v4
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: List artifacts
-        run: |
-          tree
-
-      - name: Download prebuilt toolchain
-        run: |
-          AOSP_MIRROR=https://android.googlesource.com
-          BRANCH=main-kernel-build-2024
-          git clone $AOSP_MIRROR/platform/prebuilts/build-tools -b $BRANCH --depth 1 build-tools
-          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
-          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1
-          pip3 install telethon
-
-      - name: Set boot sign key
-        env:
-          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
-        run: |
-          if [ ! -z "$BOOT_SIGN_KEY" ]; then
-            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
-          fi
-
-      - name: Build boot images
-        run: |
-          export AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool
-          export GZIP=$GITHUB_WORKSPACE/build-tools/path/linux-x86/gzip
-          export LZ4=$GITHUB_WORKSPACE/build-tools/path/linux-x86/lz4
-          export MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py
-          export UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py
-          cd $GITHUB_WORKSPACE/KernelSU
-          export VERSION=$(($(git rev-list --count HEAD) + 10200))
-          echo "VERSION: $VERSION"
-          cd -
-          bash $GITHUB_WORKSPACE/KernelSU/.github/scripts/build_a12.sh
-
-      - name: Display structure of boot files
-        run: ls -R
-
-      - name: Upload images artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: boot-images-android12
-          path: Image-android12*/*.img.gz

.github/workflows/build-kernel-a13.yml

@@ -1,146 +0,0 @@
-name: Build Kernel - Android 13
-on:
-  # push:
-  #   branches: ["main", "ci", "checkci"]
-  #   paths:
-  #     - ".github/workflows/deps/gki/build-kernel-a13.yml"
-  #     - ".github/workflows/deps/gki/gki-kernel.yml"
-  #     - ".github/scripts/build_a13.sh"
-  #     - "kernel/**"
-  workflow_call:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-jobs:
-  build-kernel:
-    if: github.event_name != 'pull_request' && github.ref != 'refs/heads/checkci'
-    strategy:
-      matrix:
-        include:
-          - version: "5.10"
-            sub_level: 209
-            os_patch_level: 2024-05
-          - version: "5.10"
-            sub_level: 210
-            os_patch_level: 2024-06
-          - version: "5.10"
-            sub_level: 214
-            os_patch_level: 2024-07
-          - version: "5.10"
-            sub_level: 218
-            os_patch_level: 2024-08
-          - version: "5.10"
-            sub_level: 223
-            os_patch_level: 2024-11
-          - version: "5.10"
-            sub_level: 228
-            os_patch_level: 2025-01
-          - version: "5.10"
-            sub_level: 234
-            os_patch_level: 2025-03
-          - version: "5.15"
-            sub_level: 148
-            os_patch_level: 2024-05
-          - version: "5.15"
-            sub_level: 149
-            os_patch_level: 2024-07
-          - version: "5.15"
-            sub_level: 151
-            os_patch_level: 2024-08
-          - version: "5.15"
-            sub_level: 153
-            os_patch_level: 2024-09
-          - version: "5.15"
-            sub_level: 167
-            os_patch_level: 2024-11
-          - version: "5.15"
-            sub_level: 178
-            os_patch_level: 2024-11
-          - version: "5.15"
-            sub_level: 170
-            os_patch_level: 2025-01
-          - version: "5.15"
-            sub_level: 178
-            os_patch_level: 2025-03
-    uses: ./.github/workflows/gki-kernel.yml
-    secrets: inherit
-    with:
-      version: android13-${{ matrix.version }}
-      version_name: android13-${{ matrix.version }}.${{ matrix.sub_level }}
-      tag: android13-${{ matrix.version }}-${{ matrix.os_patch_level }}
-      os_patch_level: ${{ matrix.os_patch_level }}
-      patch_path: ${{ matrix.version }}
-      debug: ${{ inputs.debug || false }}
-  
-  upload-artifacts:
-    needs: build-kernel
-    runs-on: ubuntu-latest
-    if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' || github.ref == 'refs/heads/ci' }}
-    env:
-      CHAT_ID: ${{ secrets.CHAT_ID }}
-      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-      MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
-      COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-      COMMIT_URL: ${{ github.event.head_commit.url }}
-      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-
-      - uses: actions/checkout@v4
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: List artifacts
-        run: |
-          tree
-
-      - name: Download prebuilt toolchain
-        run: |
-          AOSP_MIRROR=https://android.googlesource.com
-          BRANCH=main-kernel-build-2024
-          git clone $AOSP_MIRROR/platform/prebuilts/build-tools -b $BRANCH --depth 1 build-tools
-          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
-          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1
-          pip3 install telethon
-
-      - name: Set boot sign key
-        env:
-          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
-        run: |
-          if [ ! -z "$BOOT_SIGN_KEY" ]; then
-            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
-          fi
-
-      - name: Build boot images
-        run: |
-          export AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool
-          export GZIP=$GITHUB_WORKSPACE/build-tools/path/linux-x86/gzip
-          export LZ4=$GITHUB_WORKSPACE/build-tools/path/linux-x86/lz4
-          export MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py
-          export UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py
-          cd $GITHUB_WORKSPACE/KernelSU
-          export VERSION=$(($(git rev-list --count HEAD) + 10200))
-          echo "VERSION: $VERSION"
-          cd -
-          bash $GITHUB_WORKSPACE/KernelSU/.github/scripts/build_a13.sh
-
-      - name: Display structure of boot files
-        run: ls -R
-
-      - name: Upload images artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: boot-images-android13
-          path: Image-android13*/*.img.gz

.github/workflows/build-kernel-a14.yml

@@ -1,158 +0,0 @@
-name: Build Kernel - Android 14
-on:
-  # push:
-  #   branches: ["main", "ci", "checkci"]
-  #   paths:
-  #     - ".github/workflows/deps/gki/build-kernel-a14.yml"
-  #     - ".github/workflows/deps/gki/gki-kernel.yml"
-  #     - ".github/scripts/build_a13.sh"
-  #     - "kernel/**"
-  workflow_call:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-jobs:
-  build-kernel:
-    if: github.event_name != 'pull_request' && github.ref != 'refs/heads/checkci'
-    strategy:
-      matrix:
-        include:
-          - version: "5.15"
-            sub_level: 148
-            os_patch_level: 2024-05
-          - version: "5.15"
-            sub_level: 149
-            os_patch_level: 2024-06
-          - version: "5.15"
-            sub_level: 153
-            os_patch_level: 2024-07
-          - version: "5.15"
-            sub_level: 158
-            os_patch_level: 2024-08
-          - version: "5.15"
-            sub_level: 164
-            os_patch_level: 2024-09
-          - version: "5.15"
-            sub_level: 167
-            os_patch_level: 2024-11
-          - version: "5.15"
-            sub_level: 170
-            os_patch_level: 2025-01
-          - version: "5.15"
-            sub_level: 178
-            os_patch_level: 2025-03
-          - version: "6.1"
-            sub_level: 75
-            os_patch_level: 2024-05
-          - version: "6.1"
-            sub_level: 78
-            os_patch_level: 2024-06
-          - version: "6.1"
-            sub_level: 84
-            os_patch_level: 2024-07
-          - version: "6.1"
-            sub_level: 90
-            os_patch_level: 2024-08
-          - version: "6.1"
-            sub_level: 93
-            os_patch_level: 2024-09
-          - version: "6.1"
-            sub_level: 99
-            os_patch_level: 2024-10
-          - version: "6.1"
-            sub_level: 112
-            os_patch_level: 2024-11
-          - version: "6.1"
-            sub_level: 115
-            os_patch_level: 2024-12
-          - version: "6.1"
-            sub_level: 118
-            os_patch_level: 2025-01
-          - version: "6.1"
-            sub_level: 128
-            os_patch_level: 2025-03
-          - version: "6.1"
-            sub_level: 134
-            os_patch_level: 2025-05
-    uses: ./.github/workflows/gki-kernel.yml
-    secrets: inherit
-    with:
-      version: android14-${{ matrix.version }}
-      version_name: android14-${{ matrix.version }}.${{ matrix.sub_level }}
-      tag: android14-${{ matrix.version }}-${{ matrix.os_patch_level }}
-      os_patch_level: ${{ matrix.os_patch_level }}
-      patch_path: ${{ matrix.version }}
-      debug: ${{ inputs.debug || false }}
-  
-  upload-artifacts:
-    needs: build-kernel
-    runs-on: ubuntu-latest
-    if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' || github.ref == 'refs/heads/ci' }}
-    env:
-      CHAT_ID: ${{ secrets.CHAT_ID }}
-      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-      MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
-      COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-      COMMIT_URL: ${{ github.event.head_commit.url }}
-      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-
-      - uses: actions/checkout@v4
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: List artifacts
-        run: |
-          tree
-
-      - name: Download prebuilt toolchain
-        run: |
-          AOSP_MIRROR=https://android.googlesource.com
-          BRANCH=main-kernel-build-2024
-          git clone $AOSP_MIRROR/platform/prebuilts/build-tools -b $BRANCH --depth 1 build-tools
-          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
-          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1
-          pip3 install telethon
-
-      - name: Set boot sign key
-        env:
-          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
-        run: |
-          if [ ! -z "$BOOT_SIGN_KEY" ]; then
-            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
-          fi
-
-      - name: Build boot images
-        run: |
-          export AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool
-          export GZIP=$GITHUB_WORKSPACE/build-tools/path/linux-x86/gzip
-          export LZ4=$GITHUB_WORKSPACE/build-tools/path/linux-x86/lz4
-          export MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py
-          export UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py
-          cd $GITHUB_WORKSPACE/KernelSU
-          export VERSION=$(($(git rev-list --count HEAD) + 10200))
-          echo "VERSION: $VERSION"
-          cd -
-          bash $GITHUB_WORKSPACE/KernelSU/.github/scripts/build_a13.sh
-
-      - name: Display structure of boot files
-        run: ls -R
-
-      - name: Upload images artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: boot-images-android14
-          path: Image-android14*/*.img.gz

.github/workflows/build-kernel-a15.yml

@@ -1,131 +0,0 @@
-name: Build Kernel - Android 15
-on:
-  # push:
-  #   branches: ["main", "ci", "checkci"]
-  #   paths:
-  #     - ".github/workflows/deps/gki/build-kernel-a15.yml"
-  #     - ".github/workflows/deps/gki/gki-kernel.yml"
-  #     - ".github/scripts/build_a13.sh"
-  #     - "kernel/**"
-  workflow_call:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-jobs:
-  build-kernel:
-    if: github.event_name != 'pull_request' && github.ref != 'refs/heads/checkci'
-    strategy:
-      matrix:
-        include:
-          - version: "6.6"
-            sub_level: 30
-            os_patch_level: 2024-08
-          - version: "6.6"
-            sub_level: 46
-            os_patch_level: 2024-09
-          - version: "6.6"
-            sub_level: 50
-            os_patch_level: 2024-10
-          - version: "6.6"
-            sub_level: 56
-            os_patch_level: 2024-11
-          - version: "6.6"
-            sub_level: 57
-            os_patch_level: 2024-12
-          - version: "6.6"
-            sub_level: 58
-            os_patch_level: 2025-01
-          - version: "6.6"
-            sub_level: 66
-            os_patch_level: 2025-02
-          - version: "6.6"
-            sub_level: 77
-            os_patch_level: 2025-03
-          - version: "6.6"
-            sub_level: 82
-            os_patch_level: 2025-04
-          - version: "6.6"
-            sub_level: 87
-            os_patch_level: 2025-05
-    uses: ./.github/workflows/gki-kernel.yml
-    secrets: inherit
-    with:
-      version: android15-${{ matrix.version }}
-      version_name: android15-${{ matrix.version }}.${{ matrix.sub_level }}
-      tag: android15-${{ matrix.version }}-${{ matrix.os_patch_level }}
-      os_patch_level: ${{ matrix.os_patch_level }}
-      patch_path: ${{ matrix.version }}
-      debug: ${{ inputs.debug || false }}
-  
-  upload-artifacts:
-    needs: build-kernel
-    runs-on: ubuntu-latest
-    if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' || github.ref == 'refs/heads/ci' }}
-    env:
-      CHAT_ID: ${{ secrets.CHAT_ID }}
-      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-      MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
-      COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-      COMMIT_URL: ${{ github.event.head_commit.url }}
-      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v4
-
-      - uses: actions/checkout@v4
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: List artifacts
-        run: |
-          tree
-
-      - name: Download prebuilt toolchain
-        run: |
-          AOSP_MIRROR=https://android.googlesource.com
-          BRANCH=main-kernel-build-2024
-          git clone $AOSP_MIRROR/platform/prebuilts/build-tools -b $BRANCH --depth 1 build-tools
-          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
-          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1
-          pip3 install telethon
-
-      - name: Set boot sign key
-        env:
-          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
-        run: |
-          if [ ! -z "$BOOT_SIGN_KEY" ]; then
-            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
-          fi
-          
-      - name: Build boot images
-        run: |
-          export AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool
-          export GZIP=$GITHUB_WORKSPACE/build-tools/path/linux-x86/gzip
-          export LZ4=$GITHUB_WORKSPACE/build-tools/path/linux-x86/lz4
-          export MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py
-          export UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py
-          cd $GITHUB_WORKSPACE/KernelSU
-          export VERSION=$(($(git rev-list --count HEAD) + 10200))
-          echo "VERSION: $VERSION"
-          cd -
-          bash $GITHUB_WORKSPACE/KernelSU/.github/scripts/build_a13.sh
-
-      - name: Display structure of boot files
-        run: ls -R
-
-      - name: Upload images artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: boot-images-android15
-          path: Image-android15*/*.img.gz

.github/workflows/build-kernel-a16.yml

@@ -1,104 +0,0 @@
-name: Build Kernel - Android 16
-on:
-  # push:
-  #   branches: ["main", "ci", "checkci"]
-  #   paths:
-  #     - ".github/workflows/deps/gki/build-kernel-a16.yml"
-  #     - ".github/workflows/deps/gki/gki-kernel.yml"
-  #     - ".github/scripts/build_a13.sh"
-  #     - "kernel/**"
-  workflow_call:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-  workflow_dispatch:
-    inputs:
-      debug:
-        description: 'Build debug kernel'
-        required: false
-        type: boolean
-        default: false
-jobs:
-  build-kernel:
-    if: github.event_name != 'pull_request' && github.ref != 'refs/heads/checkci'
-    strategy:
-      matrix:
-        include:
-          - version: "6.12"
-            sub_level: 38
-            os_patch_level: 2025-08
-    uses: ./.github/workflows/gki-kernel.yml
-    secrets: inherit
-    with:
-      version: android16-${{ matrix.version }}
-      version_name: android16-${{ matrix.version }}.${{ matrix.sub_level }}
-      tag: android16-${{ matrix.version }}-${{ matrix.os_patch_level }}
-      os_patch_level: ${{ matrix.os_patch_level }}
-      patch_path: ${{ matrix.version }}
-      debug: ${{ inputs.debug || false }}
-  
-  upload-artifacts:
-    needs: build-kernel
-    runs-on: ubuntu-latest
-    if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' || github.ref == 'refs/heads/ci' }}
-    env:
-      CHAT_ID: ${{ secrets.CHAT_ID }}
-      BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-      MESSAGE_THREAD_ID: ${{ secrets.MESSAGE_THREAD_ID }}
-      COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
-      COMMIT_URL: ${{ github.event.head_commit.url }}
-      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@v6
-
-      - uses: actions/checkout@v5
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: List artifacts
-        run: |
-          tree
-
-      - name: Download prebuilt toolchain
-        run: |
-          AOSP_MIRROR=https://android.googlesource.com
-          BRANCH=main-kernel-build-2024
-          git clone $AOSP_MIRROR/platform/prebuilts/build-tools -b $BRANCH --depth 1 build-tools
-          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
-          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1
-          pip3 install telethon
-
-      - name: Set boot sign key
-        env:
-          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
-        run: |
-          if [ ! -z "$BOOT_SIGN_KEY" ]; then
-            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
-          fi
-
-      - name: Build boot images
-        run: |
-          export AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool
-          export GZIP=$GITHUB_WORKSPACE/build-tools/path/linux-x86/gzip
-          export LZ4=$GITHUB_WORKSPACE/build-tools/path/linux-x86/lz4
-          export MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py
-          export UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py
-          cd $GITHUB_WORKSPACE/KernelSU
-          export VERSION=$(($(git rev-list --count HEAD) + 10200))
-          echo "VERSION: $VERSION"
-          cd -
-          bash $GITHUB_WORKSPACE/KernelSU/.github/scripts/build_a13.sh
-
-      - name: Display structure of boot files
-        run: ls -R
-
-      - name: Upload images artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: boot-images-android16
-          path: Image-android16*/*.img.gz

.github/workflows/build-lkm.yml

@@ -1,21 +0,0 @@
-name: Build LKM for KernelSU
-on:
-  workflow_call:
-  workflow_dispatch:
-jobs:
-  build-lkm:
-    strategy:
-      fail-fast: false
-      matrix:
-        kmi:
-          - android12-5.10
-          - android13-5.10
-          - android13-5.15
-          - android14-5.15
-          - android14-6.1
-          - android15-6.6
-          - android16-6.12
-    uses: ./.github/workflows/ddk-lkm.yml
-    with:
-      kmi: ${{ matrix.kmi }}
-      ddk_release: '20251104'

.github/workflows/build-manager.yml

@@ -2,43 +2,46 @@ name: Build Manager
 
 on:
   push:
-    branches: [ "main", "dev", "ci", "miuix" ]
+    branches: [ "main", "ci" ]
     paths:
       - '.github/workflows/build-manager.yml'
-      - '.github/workflows/build-lkm.yml'
       - 'manager/**'
       - 'kernel/**'
       - 'userspace/ksud/**'
-      - 'userspace/user_scanner/**'
+      - 'userspace/susfs/**'
+      - 'userspace/kpmmgr/**'
   pull_request:
-    branches: [ "main", "dev", "miuix" ]
+    branches: [ "main" ]
     paths:
-      - '.github/workflows/build-manager.yml'
-      - '.github/workflows/build-lkm.yml'
       - 'manager/**'
-      - 'kernel/**'
-      - 'userspace/ksud/**'
-      - 'userspace/user_scanner/**'
   workflow_call:
-
+  workflow_dispatch:
 jobs:
-  build-lkm:
-    uses: ./.github/workflows/build-lkm.yml
-    secrets: inherit
-  build-user_scanner:
-    needs: build-lkm
+  build-susfs:
     strategy:
       matrix:
         include:
-          - target: All-linux-android
+          - target: aarch64-linux-android
             os: ubuntu-latest
-    uses: ./.github/workflows/user_scanner.yml
+    uses: ./.github/workflows/susfs.yml
+    with:
+      target: ${{ matrix.target }}
+      os: ${{ matrix.os }}
+
+  build-kpmmgr:
+    needs: build-susfs
+    strategy:
+      matrix:
+        include:
+          - target: aarch64-linux-android
+            os: ubuntu-latest
+    uses: ./.github/workflows/kpmmgr.yml
     with:
       target: ${{ matrix.target }}
       os: ${{ matrix.os }}
 
   build-ksud:
-    needs: build-lkm
+    needs: build-kpmmgr
     strategy:
       matrix:
         include:
@@ -46,19 +49,15 @@ jobs:
             os: ubuntu-latest
           - target: x86_64-linux-android
             os: ubuntu-latest
-          - target: armv7-linux-androideabi
-            os: ubuntu-latest
     uses: ./.github/workflows/ksud.yml
     with:
       target: ${{ matrix.target }}
       os: ${{ matrix.os }}
 
   build-manager:
+    if: ${{ always() }}
     needs: build-ksud
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        spoofed: ["true","false"]
     defaults:
       run:
         working-directory: ./manager
@@ -78,34 +77,8 @@ jobs:
             echo "UPLOAD=false" >> $GITHUB_OUTPUT
           fi
 
-
-      - name: Determine manager variant for telegram bot
-        id: determine
-        run: |
-          if [ "${{ github.ref_name }}" == "miuix" ] && [ "${{ matrix.spoofed }}" == "true" ]; then
-            echo "SKIP=true" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          if [ "${{ github.ref_name }}" == "miuix" ]; then
-            echo "title=Manager" >> $GITHUB_OUTPUT
-            echo "topicid=${{ vars.MESSAGE_MIUIX_THREAD_ID }}" >> $GITHUB_OUTPUT
-          elif [ "${{ matrix.spoofed }}" == "true" ]; then
-            echo "title=Spoofed-Manager" >> $GITHUB_OUTPUT
-            # maybe need a new var
-            echo "topicid=${{ vars.MESSAGE_SPOOFED_THREAD_ID }}" >> $GITHUB_OUTPUT
-          else
-            echo "title=Manager" >> $GITHUB_OUTPUT
-            echo "topicid=${{ vars.MESSAGE_THREAD_ID }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Run randomizer
-        if: ${{ matrix.spoofed == 'true' && steps.determine.outputs.SKIP != 'true' }}
-        run: |
-          chmod +x randomizer
-          ./randomizer
-
       - name: Write key
-        if: ${{ ( github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' )) || github.ref_type == 'tag' }}
+        if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref == 'refs/heads/susfs' || github.ref_type == 'tag' }}
         run: |
           if [ ! -z "${{ secrets.KEYSTORE }}" ]; then
             {
@@ -129,10 +102,16 @@ jobs:
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
 
-      - name: Download all userscanner artifacts
+      - name: Download arm64 susfs
         uses: actions/download-artifact@v4
         with:
-          name: userscanner-all-linux-android
+          name: susfs-aarch64-linux-android
+          path: .
+
+      - name: Download arm64 kpmmgr
+        uses: actions/download-artifact@v4
+        with:
+          name: kpmmgr-aarch64-linux-android
           path: .
 
       - name: Download arm64 ksud
@@ -147,59 +126,65 @@ jobs:
           name: ksud-x86_64-linux-android
           path: .
 
-      - name: Download arm ksud
-        uses: actions/download-artifact@v4
-        with:
-          name: ksud-armv7-linux-androideabi
-          path: .
-  
       - name: Copy ksud to app jniLibs
         run: |
           mkdir -p app/src/main/jniLibs/arm64-v8a
           mkdir -p app/src/main/jniLibs/x86_64
-          mkdir -p app/src/main/jniLibs/armeabi-v7a
-          cp -f ../aarch64-linux-android/release/ksud ../manager/app/src/main/jniLibs/arm64-v8a/libksud.so
-          cp -f ../x86_64-linux-android/release/ksud ../manager/app/src/main/jniLibs/x86_64/libksud.so
-          cp -f ../armv7-linux-androideabi/release/ksud ../manager/app/src/main/jniLibs/armeabi-v7a/libksud.so
+          cp -f ../aarch64-linux-android/release/zakozako ../manager/app/src/main/jniLibs/arm64-v8a/libzakozako.so
+          cp -f ../x86_64-linux-android/release/zakozako ../manager/app/src/main/jniLibs/x86_64/libzakozako.so
 
-      - name: Copy user_scanner to app jniLibs
+      - name: Copy kpmmgr to app jniLibs
         run: |
           mkdir -p app/src/main/jniLibs/arm64-v8a
-          mkdir -p app/src/main/jniLibs/x86_64
-          mkdir -p app/src/main/jniLibs/armeabi-v7a
-          cp -f ../arm64-v8a/uid_scanner ../manager/app/src/main/jniLibs/arm64-v8a/libuid_scanner.so
-          cp -f ../x86_64/uid_scanner ../manager/app/src/main/jniLibs/x86_64/libuid_scanner.so
-          cp -f ../armeabi-v7a/uid_scanner ../manager/app/src/main/jniLibs/armeabi-v7a/libuid_scanner.so
+          cp -f ../arm64-v8a/kpmmgr ../manager/app/src/main/jniLibs/arm64-v8a/libkpmmgr.so
+      
+      - name: Copy susfs to app jniLibs
+        run: |
+          mkdir -p app/src/main/jniLibs/arm64-v8a
+          cp -f ../arm64-v8a/zakozakozako ../manager/app/src/main/jniLibs/arm64-v8a/libzakozakozako.so
 
       - name: Build with Gradle
-        if: ${{ steps.determine.outputs.SKIP != 'true' }}
-        run: ./gradlew clean assembleRelease
-
+        run: |
+          {
+            echo 'org.gradle.parallel=true'
+            echo 'org.gradle.vfs.watch=true'
+            echo 'org.gradle.jvmargs=-Xmx2048m'
+            echo 'android.native.buildOutput=verbose'
+          } >> gradle.properties
+          sed -i 's/org.gradle.configuration-cache=true//g' gradle.properties
+          ./gradlew clean assembleRelease
       - name: Upload build artifact
         uses: actions/upload-artifact@v4
-        if: ${{ ( github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' )) || github.ref_type == 'tag' }}
+        if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' }}
         with:
-          name: ${{ steps.determine.outputs.title }}
+          name: manager
           path: manager/app/build/outputs/apk/release/*.apk
 
       - name: Upload mappings
         uses: actions/upload-artifact@v4
-        if: ${{ ( github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' )) || github.ref_type == 'tag' }}
+        if: ${{ ( github.event_name != 'pull_request' && github.ref == 'refs/heads/main' ) || github.ref_type == 'tag' }}
         with:
-          name: "${{ steps.determine.outputs.title }}-mappings"
+          name: "mappings"
           path: "manager/app/build/outputs/mapping/release/"
       
+      - name: Bot session cache
+        if: github.event_name != 'pull_request' && steps.need_upload.outputs.UPLOAD == 'true'
+        id: bot_session_cache
+        uses: actions/cache@v4
+        with:
+          path: scripts/ksubot.session
+          key: ${{ runner.os }}-bot-session
+
       - name: Upload to telegram
-        if: github.event_name != 'pull_request' && steps.need_upload.outputs.UPLOAD == 'true' && steps.determine.outputs.SKIP != 'true'
+        if: github.event_name != 'pull_request' && steps.need_upload.outputs.UPLOAD == 'true'
         env:
           CHAT_ID: ${{ vars.CHAT_ID }}
           BOT_TOKEN: ${{ secrets.BOT_TOKEN }}
-          MESSAGE_THREAD_ID: ${{ steps.determine.outputs.topicid }}
+          MESSAGE_THREAD_ID: ${{ vars.MESSAGE_THREAD_ID }}
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
           COMMIT_URL: ${{ github.event.head_commit.url }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          TITLE: ${{ steps.determine.outputs.title }}
-          BRANCH: ${{ github.ref_name }}
+          TITLE: Manager
         run: |
           if [ ! -z "${{ secrets.BOT_TOKEN }}" ]; then
             export VERSION=$(git rev-list --count HEAD)

.github/workflows/crowdin.yml

@@ -1,40 +0,0 @@
-name: Crowdin Action
-
-on:
-  push:
-    branches: [ main ]
-    paths:
-      - 'manager/app/src/main/res/values/strings.xml'
-      - 'manager/app/src/main/res/values-*/strings.xml'
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  synchronize-with-crowdin:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-
-    - name: Crowdin Action
-      uses: crowdin/github-action@v2
-      with:
-        upload_sources: true
-        upload_translations: true
-        auto_approve_imported: true
-        download_translations: true
-        skip_untranslated_files: false
-        skip_untranslated_strings: true
-
-        create_pull_request: true
-        localization_branch_name: "Crowdin"
-        pull_request_labels: 'enhancement, translation'
-        pull_request_title: 'opt: sync translation from Crowdin'
-
-        config: 'crowdin.yml'
-        crowdin_branch_name: "main"
-      env:
-        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-        CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
-        CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_TOKEN }}

.github/workflows/ddk-lkm.yml

@@ -1,53 +0,0 @@
-name: Build KernelSU Kernel Module
-
-on:
-  workflow_call:
-    inputs:
-      kmi:
-        description: 'KMI version'
-        required: true
-        type: string
-      ddk_release:
-        description: 'DDK release version'
-        required: false
-        default: '20251104'
-        type: string
-
-jobs:
-  build-kernelsu-ko:
-    name: Build kernelsu.ko for ${{ inputs.kmi }}
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/ylarod/ddk:${{ inputs.kmi }}-${{ inputs.ddk_release }}
-      options: --privileged
-
-    steps:
-    - name: Checkout source code
-      uses: actions/checkout@v4
-
-    - name: Build kernelsu.ko
-      run: |
-        git config --global --add safe.directory /__w/SukiSU-Ultra/SukiSU-Ultra
-        cd kernel
-
-        echo "=== Building kernelsu.ko for KMI: ${{ inputs.kmi }} ==="
-        CONFIG_KSU=m CONFIG_KSU_MANUAL_SU=y make
-        
-        echo "=== Build completed ==="
-        # Create output directory in GitHub workspace
-        mkdir -p /github/workspace/out
-        # Copy with KMI-specific naming
-        OUTPUT_NAME="${{ inputs.kmi }}_kernelsu.ko"
-        cp kernelsu.ko "/github/workspace/out/$OUTPUT_NAME"
-        
-        echo "Copied to: /github/workspace/out/$OUTPUT_NAME"
-        ls -la "/github/workspace/out/$OUTPUT_NAME"
-        echo "Size: $(du -h "/github/workspace/out/$OUTPUT_NAME" | cut -f1)"
-        llvm-strip -d "/github/workspace/out/$OUTPUT_NAME"
-        echo "Size after stripping: $(du -h "/github/workspace/out/$OUTPUT_NAME" | cut -f1)"
-        
-    - name: Upload kernelsu.ko artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: ${{ inputs.kmi }}-lkm
-        path: /github/workspace/out/${{ inputs.kmi }}_kernelsu.ko

.github/workflows/gki-kernel.yml

@@ -1,288 +0,0 @@
-name: GKI Kernel Build
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        required: true
-        type: string
-        description: >
-          Output directory of gki,
-          for example: android12-5.10
-      version_name:
-        required: true
-        type: string
-        description: >
-          With SUBLEVEL of kernel,
-          for example: android12-5.10.66
-      tag:
-        required: true
-        type: string
-        description: >
-          Part of branch name of common kernel manifest,
-          for example: android12-5.10-2021-11
-      os_patch_level:
-        required: false
-        type: string
-        description: >
-          Patch level of common kernel manifest,
-          for example: 2021-11
-        default: 2022-05
-      patch_path:
-        required: false
-        type: string
-        description: >
-          Directory name of .github/patches/<patch_path>
-          for example: 5.10
-      use_cache:
-        required: false
-        type: boolean
-        default: true
-      embed_ksud:
-        required: false
-        type: string
-        default: ksud-aarch64-linux-android
-        description: >
-          Artifact name of prebuilt ksud to be embedded
-          for example: ksud-aarch64-linux-android
-      debug:
-        required: false
-        type: boolean
-        default: false
-      build_lkm:
-        required: false
-        type: boolean
-        default: false
-    secrets:
-      BOOT_SIGN_KEY:
-        required: false
-      CHAT_ID:
-        required: false
-      BOT_TOKEN:
-        required: false
-      MESSAGE_THREAD_ID:
-        required: false
-
-jobs:
-  build:
-    name: Build ${{ inputs.version_name }}
-    runs-on: ubuntu-latest
-    env:
-      CCACHE_COMPILERCHECK: "%compiler% -dumpmachine; %compiler% -dumpversion"
-      CCACHE_NOHASHDIR: "true"
-      CCACHE_HARDLINK: "true"
-    steps:
-      - name: Maximize build space
-        uses: easimon/maximize-build-space@master
-        with:
-          root-reserve-mb: 8192
-          temp-reserve-mb: 2048
-          remove-dotnet: "true"
-          remove-android: "true"
-          remove-haskell: "true"
-          remove-codeql: "true"
-
-      - uses: actions/checkout@v4
-        with:
-          path: KernelSU
-          fetch-depth: 0
-
-      - name: Setup need_upload
-        id: need_upload
-        run: |
-          if [ ! -z "${{ secrets.BOT_TOKEN }}" ]; then
-            echo "UPLOAD=true" >> $GITHUB_OUTPUT
-          else
-            echo "UPLOAD=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Setup kernel source
-        run: |
-          echo "Free space:"
-          df -h
-          cd $GITHUB_WORKSPACE
-          sudo apt-get install repo -y
-          mkdir android-kernel && cd android-kernel
-          repo init --depth=1 --u https://android.googlesource.com/kernel/manifest -b common-${{ inputs.tag }} --repo-rev=v2.16
-          REMOTE_BRANCH=$(git ls-remote https://android.googlesource.com/kernel/common ${{ inputs.tag }})
-          DEFAULT_MANIFEST_PATH=.repo/manifests/default.xml
-          if grep -q deprecated <<< $REMOTE_BRANCH; then
-            echo "Found deprecated branch: ${{ inputs.tag }}"
-            sed -i 's/"${{ inputs.tag }}"/"deprecated\/${{ inputs.tag }}"/g' $DEFAULT_MANIFEST_PATH
-            cat $DEFAULT_MANIFEST_PATH
-          fi
-          repo --version
-          repo --trace sync -c -j$(nproc --all) --no-tags
-          df -h
-
-      - name: Setup KernelSU
-        env:
-          PATCH_PATH: ${{ inputs.patch_path }}
-          IS_DEBUG_KERNEL: ${{ inputs.debug }}
-        run: |
-          cd $GITHUB_WORKSPACE/android-kernel
-          echo "[+] KernelSU setup"
-          GKI_ROOT=$(pwd)
-          echo "[+] GKI_ROOT: $GKI_ROOT"
-          echo "[+] Copy KernelSU driver to $GKI_ROOT/common/drivers"
-          ln -sf $GITHUB_WORKSPACE/KernelSU/kernel $GKI_ROOT/common/drivers/kernelsu
-          echo "[+] Add KernelSU driver to Makefile"
-          DRIVER_MAKEFILE=$GKI_ROOT/common/drivers/Makefile
-          DRIVER_KCONFIG=$GKI_ROOT/common/drivers/Kconfig
-          grep -q "kernelsu" "$DRIVER_MAKEFILE" || printf "\nobj-\$(CONFIG_KSU) += kernelsu/\n" >> "$DRIVER_MAKEFILE"
-          grep -q "kernelsu" "$DRIVER_KCONFIG" || sed -i "/endmenu/i\\source \"drivers/kernelsu/Kconfig\"" "$DRIVER_KCONFIG"
-          echo "[+] Apply Compilation Patches"
-          if [ ! -e build/build.sh ]; then
-            GLIBC_VERSION=$(ldd --version 2>/dev/null | head -n 1 | awk '{print $NF}')
-            echo "GLIBC_VERSION: $GLIBC_VERSION"
-            if [ "$(printf '%s\n' "2.38" "$GLIBC_VERSION" | sort -V | head -n1)" = "2.38" ]; then
-              echo "Patching resolve_btfids/Makefile"
-              cd $GKI_ROOT/common/ && sed -i '/\$(Q)\$(MAKE) -C \$(SUBCMD_SRC) OUTPUT=\$(abspath \$(dir \$@))\/ \$(abspath \$@)/s//$(Q)$(MAKE) -C $(SUBCMD_SRC) EXTRA_CFLAGS="$(CFLAGS)" OUTPUT=$(abspath $(dir $@))\/ $(abspath $@)/' tools/bpf/resolve_btfids/Makefile || echo "No patch needed."
-            fi
-          fi
-
-          if [ "$IS_DEBUG_KERNEL" = "true" ]; then
-            echo "[+] Enable debug features for kernel"
-            printf "\nccflags-y += -DCONFIG_KSU_DEBUG\n" >> $GITHUB_WORKSPACE/KernelSU/kernel/Makefile
-          fi
-          repo status
-          echo "[+] KernelSU setup done."
-
-      - name: Symbol magic
-        run: |
-          echo "[+] Export all symbol from abi_gki_aarch64.xml"
-          COMMON_ROOT=$GITHUB_WORKSPACE/android-kernel/common
-          KSU_ROOT=$GITHUB_WORKSPACE/KernelSU
-          ABI_XML=$COMMON_ROOT/android/abi_gki_aarch64.xml
-          SYMBOL_LIST=$COMMON_ROOT/android/abi_gki_aarch64
-          # python3 $KSU_ROOT/scripts/abi_gki_all.py $ABI_XML > $SYMBOL_LIST
-          echo "[+] Add KernelSU symbols"
-          cat $KSU_ROOT/kernel/export_symbol.txt | awk '{sub("[ \t]+","");print "  "$0}' >> $SYMBOL_LIST
-
-      - name: Setup ccache
-        if: inputs.use_cache == true
-        uses: hendrikmuhs/ccache-action@v1
-        with:
-          key: gki-kernel-aarch64-${{ inputs.version_name }}
-          max-size: 2G
-          save: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-
-      - name: Setup for LKM
-        if: ${{ inputs.build_lkm == true }}
-        working-directory: android-kernel
-        run: |
-          pip install ast-grep-cli
-          sudo apt-get install llvm-15 -y
-          ast-grep -U -p '$$$ check_exports($$$) {$$$}' -r '' common/scripts/mod/modpost.c
-          ast-grep -U -p 'check_exports($$$);' -r '' common/scripts/mod/modpost.c
-          sed -i '/config KSU/,/help/{s/default y/default m/}' common/drivers/kernelsu/Kconfig
-          echo "drivers/kernelsu/kernelsu.ko" >> common/android/gki_aarch64_modules
-
-          # bazel build, android14-5.15, android14-6.1 use bazel
-          if [ ! -e build/build.sh ]; then
-            sed -i 's/needs unknown symbol/Dont abort when unknown symbol/g' build/kernel/*.sh || echo "No unknown symbol scripts found"
-            if [ -e common/modules.bzl ]; then
-              sed -i 's/_COMMON_GKI_MODULES_LIST = \[/_COMMON_GKI_MODULES_LIST = \[ "drivers\/kernelsu\/kernelsu.ko",/g' common/modules.bzl
-            fi
-          else
-            TARGET_FILE="build/kernel/build.sh"
-            if [ ! -e "$TARGET_FILE" ]; then
-              TARGET_FILE="build/build.sh"
-            fi
-            sed -i 's/needs unknown symbol/Dont abort when unknown symbol/g' $TARGET_FILE || echo "No unknown symbol in $TARGET_FILE"
-            sed -i 's/if ! diff -u "\${KERNEL_DIR}\/\${MODULES_ORDER}" "\${OUT_DIR}\/modules\.order"; then/if false; then/g' $TARGET_FILE
-            sed -i 's@${ROOT_DIR}/build/abi/compare_to_symbol_list@echo@g' $TARGET_FILE
-            sed -i 's/needs unknown symbol/Dont abort when unknown symbol/g' build/kernel/*.sh || echo "No unknown symbol scripts found"
-          fi
-
-      - name: Append ashmem exports if missing
-        if: startsWith(inputs.version, 'android16-6.12')
-        working-directory: android-kernel
-        run: |
-          FILE=common/drivers/staging/android/ashmem.c
-          if [[ -f "$FILE" ]] && ! grep -q 'is_ashmem_file' "$FILE"; then
-          cat >>"$FILE" <<'EOF'
-
-          bool is_ashmem_file(struct file *file) { return false; }
-          int ashmem_area_name(struct file *file, char *name) { return 0; }
-          long ashmem_area_size(struct file *file) { return 0; }
-          struct file *ashmem_area_vmfile(struct file *file) { return NULL; }
-          EXPORT_SYMBOL_GPL(is_ashmem_file);
-          EXPORT_SYMBOL_GPL(ashmem_area_name);
-          EXPORT_SYMBOL_GPL(ashmem_area_size);
-          EXPORT_SYMBOL_GPL(ashmem_area_vmfile);
-          EOF
-          fi
-
-          sed -i -E 's/\$\(CONFIG_ANDROID_BINDER_IPC_RUST\)/m/g' common/drivers/android/Makefile
-
-      - name: Make working directory clean to avoid dirty
-        working-directory: android-kernel
-        run: |
-          # Fix bazel build error
-          if [ -f common/BUILD.bazel ]; then
-            [ -f android/abi_gki_protected_exports_aarch64 ] || sed -i '/^[[:space:]]*"protected_exports_list"[[:space:]]*:[[:space:]]*"android\/abi_gki_protected_exports_aarch64",$/d' common/BUILD.bazel
-          fi
-
-          rm common/android/abi_gki_protected_exports_* || echo "No protected exports!"
-          git config --global user.email "bot@kernelsu.org"
-          git config --global user.name "KernelSUBot"
-          cd common/ && git add -A && git commit -a -m "Add KernelSU"
-          repo status
-
-      - name: Build Kernel/LKM
-        working-directory: android-kernel
-        run: |
-          if [ ! -z ${{ vars.EXPECTED_SIZE }} ] && [ ! -z ${{ vars.EXPECTED_HASH }} ]; then
-            export KSU_EXPECTED_SIZE=${{ vars.EXPECTED_SIZE }}
-            export KSU_EXPECTED_HASH=${{ vars.EXPECTED_HASH }}
-          fi
-          if [ -e build/build.sh ]; then
-            LTO=thin BUILD_CONFIG=common/build.config.gki.aarch64 build/build.sh CC="/usr/bin/ccache clang"
-          else
-            if [ "${{ inputs.version }}" == "android16-6.12" ]; then
-              tools/bazel run --disk_cache=/home/runner/.cache/bazel --config=fast --config=stamp --lto=thin //common:kernel_aarch64_dist -- --destdir=dist
-            else
-              tools/bazel run --disk_cache=/home/runner/.cache/bazel --config=fast --config=stamp --lto=thin //common:kernel_aarch64_dist -- --dist_dir=dist
-            fi
-          fi
-
-      - name: Prepare artifacts
-        id: prepareArtifacts
-        run: |
-          OUTDIR=android-kernel/out/${{ inputs.version }}/dist
-          if [ ! -e $OUTDIR ]; then
-            OUTDIR=android-kernel/dist
-          fi
-          mkdir output
-          if [ "${{ inputs.build_lkm}}" = "true" ]; then
-            llvm-strip-15 -d $OUTDIR/kernelsu.ko
-            mv $OUTDIR/kernelsu.ko ./output/${{ inputs.version }}_kernelsu.ko
-          else
-            cp $OUTDIR/Image ./output/
-            cp $OUTDIR/Image.lz4 ./output/
-            git clone https://github.com/Kernel-SU/AnyKernel3
-            rm -rf ./AnyKernel3/.git
-            cp $OUTDIR/Image ./AnyKernel3/
-          fi
-
-      - name: Upload Image and Image.gz
-        uses: actions/upload-artifact@v4
-        if: ${{ inputs.build_lkm == false }}
-        with:
-          name: Image-${{ inputs.version_name }}_${{ inputs.os_patch_level }}
-          path: ./output/*
-
-      - name: Upload AnyKernel3
-        if: ${{ inputs.build_lkm == false }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: AnyKernel3-${{ inputs.version_name }}_${{ inputs.os_patch_level }}
-          path: ./AnyKernel3/*
-
-      - name: Upload LKM
-        uses: actions/upload-artifact@v4
-        if: ${{ inputs.build_lkm == true }}
-        with:
-          name: ${{ inputs.version }}-lkm
-          path: ./output/*_kernelsu.ko

.github/workflows/kpmmgr.yml

@@ -1,11 +1,11 @@
-name: Build user_scanner
+name: Build kpmmgr
 
 on:
   push:
     branches: [ "mian" ]
     paths:
-      - '.github/workflows/user_scanner.yml'
-      - 'userspace/user_scanner/**'
+      - '.github/workflows/kpmmgr.yml'
+      - 'userspace/kpmmgr/**'
   workflow_dispatch:
   workflow_call:
     inputs:
@@ -18,8 +18,8 @@ on:
         default: self-hosted
 
 jobs:
-  build-user_scanner:
-    name: Build userspace user_scanner
+  build-susfs:
+    name: Build userspace kpmmgr
     runs-on: ubuntu-latest
 
     steps:
@@ -28,13 +28,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build user_scanner
-        working-directory: ./userspace/user_scanner
+      - name: Build kpmmgr
+        working-directory: ./userspace/kpmmgr
         run: |
           $ANDROID_NDK_HOME/ndk-build
 
       - name: Upload a Build Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: userscanner-all-linux-android
-          path: ./userspace/user_scanner/libs
+          name: kpmmgr-aarch64-linux-android
+          path: ./userspace/kpmmgr/libs

.github/workflows/ksud.yml

@@ -9,6 +9,10 @@ on:
         required: false
         type: string
         default: ubuntu-latest
+      pull_lkm:
+        required: false
+        type: boolean
+        default: true
       pack_lkm:
         required: false
         type: boolean
@@ -17,8 +21,6 @@ on:
         required: false
         type: boolean
         default: true
-env:
-  CARGO_TERM_COLOR: always
 jobs:
   build:
     runs-on: ${{ inputs.os }}
@@ -27,11 +29,24 @@ jobs:
       with:
         fetch-depth: 0
 
-    - name: Download artifacts
+    - name: Pull lkms from branch
+      if: ${{ inputs.pack_lkm && inputs.pull_lkm }}
+      uses: actions/checkout@v4
+      with:
+        ref: lkm
+        path: lkm
+
+    - name: Download lkms from artifacts
+      if: ${{ inputs.pack_lkm && !inputs.pull_lkm }}
       uses: actions/download-artifact@v4
 
-    - name: Prepare LKM fies
-      if: ${{ inputs.pack_lkm }}
+    - name: Prepare LKM files
+      if: ${{ inputs.pack_lkm && inputs.pull_lkm }}
+      run: |
+        cp lkm/*_kernelsu.ko ./userspace/ksud/bin/aarch64/
+
+    - name: Prepare LKM files
+      if: ${{ inputs.pack_lkm && !inputs.pull_lkm }}
       run: |
         cp android*-lkm/*_kernelsu.ko ./userspace/ksud/bin/aarch64/
 
@@ -40,6 +55,10 @@ jobs:
         rustup update stable
         rustup target add x86_64-apple-darwin
         rustup target add aarch64-apple-darwin
+    - uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: userspace/ksud
+        cache-targets: false
 
     - name: Install cross
       run: |
@@ -52,4 +71,4 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: ksud-${{ inputs.target }}
-        path: userspace/ksud/target/**/release/ksud*
+        path: userspace/ksud/target/**/release/zakozako*

.github/workflows/notify.yml

@@ -1,65 +0,0 @@
-name: Notify
-
-on:
-  push:
-    branches:
-      - main
-      - 'release/**'
-    paths-ignore:
-      - 'docs/**'
-      - '*.md'
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-    branches:
-      - main
-
-defaults:
-  run:
-    working-directory: ts
-
-jobs:
-  notify:
-    runs-on: ubuntu-latest
-    concurrency:
-      group: notify-telegram-${{ github.ref }}
-      cancel-in-progress: true
-
-    steps:
-      - name: Checkout repository with sparse-checkout
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 1
-          sparse-checkout: |
-            ts/**
-          sparse-checkout-cone-mode: false
-
-      - name: Setup Bun runtime
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Cache Bun modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.bun
-            ts/.node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('ts/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --cache
-
-      - name: Run telegram bot script
-        env:
-          BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
-          TELEGRAM_GROUP_ID: ${{ secrets.TELEGRAM_GROUP_ID }}
-          TELEGRAM_TOPIC_COMMITS: ${{ secrets.TELEGRAM_TOPIC_COMMITS }}
-          TELEGRAM_TOPIC_PRS: ${{ secrets.TELEGRAM_TOPIC_PRS }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_EVENT_PATH: ${{ github.event_path }}
-        run: bun run send.ts

.github/workflows/shellcheck.yml

@@ -16,7 +16,7 @@ on:
 
 jobs:
   shellcheck:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/susfs.yml

@@ -0,0 +1,40 @@
+name: Build susfs
+
+on:
+  push:
+    branches: [ "mian" ]
+    paths:
+      - '.github/workflows/susfs.yml'
+      - 'userspace/susfs/**'
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      os:
+        required: false
+        type: string
+        default: self-hosted
+
+jobs:
+  build-susfs:
+    name: Build userspace susfs
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build susfs
+        working-directory: ./userspace/susfs
+        run: |
+          $ANDROID_NDK_HOME/ndk-build
+
+      - name: Upload a Build Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: susfs-aarch64-linux-android
+          path: ./userspace/susfs/libs

.gitignore

@@ -1,3 +1,2 @@
 .idea
-CLAUDE.md
-.DS_Store
+.vscode

crowdin.yml

@@ -1,6 +0,0 @@
-project_id_env: CROWDIN_PROJECT_ID
-api_token_env: CROWDIN_API_TOKEN
-preserve_hierarchy: 1
-files:
-  - source: /manager/app/src/main/res/values/strings.xml
-    translation: /manager/app/src/main/res/values-%two_letters_code%/strings.xml

docs/README-en.md

@@ -0,0 +1,119 @@
+# SukiSU
+
+**English** | [简体中文](README.md) | [日本語](README-ja.md)
+
+
+Android device root solution based on [KernelSU](https://github.com/tiann/KernelSU)
+
+**Experimental! Use at your own risk!** This solution is based on [KernelSU](https://github.com/tiann/KernelSU) and is experimental!
+
+>
+> This is an unofficial fork. All rights are reserved to [@tiann](https://github.com/tiann)
+> However, we will be a separately maintained branch of KSU in the future
+>
+
+- Fully adapted for non-GKI devices (susfs-dev and unsusfs-patched dev branches only)
+
+## How to add
+
+Use the susfs-stable or susfs-dev branch (integrated susfs with support for non-GKI devices)
+
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-dev
+```
+
+Use the main branch
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/KernelSU/main/kernel/setup.sh" | bash -s main
+```
+
+## How to use integrated susfs
+
+1. Use the susfs-dev branch directly without any patching
+
+
+
+## KPM support
+
+- We have removed duplicate KSU functions based on KernelPatch and retained KPM support.
+- We will introduce more APatch-compatible functions to ensure the integrity of KPM functionality.
+
+
+Open source address: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch
+
+
+KPM template address: https://github.com/udochina/KPM-Build-Anywhere
+
+## More links
+Projects compiled based on Sukisu and susfs
+- [GKI](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS) 
+- [OnePlus](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)
+
+## Hook method
+- This method references the hook method from (https://github.com/rsuntk/KernelSU)
+
+1. **KPROBES hook:**
+    - This method only supports GKI (5.10 - 6.x) kernels, and all non-GKI kernels must use manual hooks.
+    - For Loadable Kernel Modules (LKM)
+    - Default hooking method for GKI kernels
+    - Requires `CONFIG_KPROBES=y`.
+2. **Manual hooks:**
+    - For GKI (5.10 - 6.x) kernels, add `CONFIG_KSU_MANUAL_HOOK=y` to the kernel defconfig and make sure to protect KernelSU hooks by using `#ifdef CONFIG_KSU_MANUAL_HOOK` instead of `#ifdef CONFIG_KSU`.
+    - Standard KernelSU hooks: https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source
+    - backslashxx syscall hooks: https://github.com/backslashxx/KernelSU/issues/5
+    - Some non-GKI devices that manually integrate KPROBES do not require the manual VFS hook `new_hook.patch` patch
+
+
+## Usage
+### GKI
+1. such as Xiaomi, Redmi, Samsung, and other devices (does not include manufacturers that modified the kernel like Meizu, OnePlus, RealMe, and OPPO)
+2. Use the prebuilt GKI kernel, the ones with their name ending with AnyKernel3, mentioned in the 'More Links' section, and then flash it with recoveries like TWRP
+3. Generally, packages with a plain .zip suffix are universal. However, if your device has a MediaTek processor, you should use the ones with .gz suffix, and packages with .lz4 suffix are dedicated to Google devices.
+
+### OnePlus
+1. Use the link mentioned in the 'More Links' section to create a customized build with your device information, and then flash the zip file with the AnyKernel3 suffix.
+> [!Note]
+> - You only need to fill in the first two parts of kernel versions, such as 5.10, 5.15, 6.1, or 6.6.
+> - Please search for the processor codename by yourself, usually it is all English without numbers.
+> - You can find the branch and configuration files from the OnePlus open-source kernel repository.
+
+
+
+## Features
+
+1. Kernel-based `su` and root access management.
+2. Not based on [OverlayFS](https://en.wikipedia.org/wiki/OverlayFS) module system, but based on [Magic Mount](https://github.com/5ec1cff/KernelSU) from 5ec1cff
+3. [App Profile](https://kernelsu.org/guide/app-profile.html): Lock root privileges in a cage. 
+4. Bringing back non-GKI/GKI 1.0 support
+5. More customization
+6. Support for KPM kernel modules
+
+
+
+## License
+
+- The file in the “kernel” directory is under [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) license.
+- All other parts except the “kernel” directory are under [GPL-3.0 or later](https://www.gnu.org/licenses/gpl-3.0.html) license.
+
+## Sponsorship list
+- [Ktouls](https://github.com/Ktouls) Thanks so much for bringing me support
+- [zaoqi123](https://github.com/zaoqi123) It's not a bad idea to buy me a milk tea
+- [wswzgdg](https://github.com/wswzgdg) Many thanks for supporting this project
+- [yspbwx2010](https://github.com/yspbwx2010) Many thanks
+
+
+
+
+If the above list does not have your name, I will update it as soon as possible, and thanks again for your support!
+
+## Contributions
+
+- [KernelSU](https://github.com/tiann/KernelSU): original project
+- [MKSU](https://github.com/5ec1cff/KernelSU): Used project
+- [RKSU](https://github.com/rsuntk/KernelsU): Reintroduced the support of non-GKI devices using the kernel of this project
+- [susfs](https://gitlab.com/simonpunk/susfs4ksu)：Used susfs file system
+- [KernelSU](https://git.zx2c4.com/kernel-assisted-superuser/about/): KernelSU conceptualization
+- [Magisk](https://github.com/topjohnwu/Magisk): Powerful root utility
+- [genuine](https://github.com/brevent/genuine/): APK v2 Signature Verification
+- [Diamorphine](https://github.com/m0nad/Diamorphine): Some rootkit utilities.
+- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch is a key part of the APatch implementation of the kernel module

docs/README-ja.md

@@ -0,0 +1,112 @@
+# SukiSU
+
+**日本語** | [简体中文](README.md) | [English](README-en.md)
+
+[KernelSU](https://github.com/tiann/KernelSU) をベースとした Android デバイスの root ソリューション
+
+**試験中なビルドです！自己責任で使用してください！**<br>
+このソリューションは [KernelSU](https://github.com/tiann/KernelSU) に基づいていますが、試験中なビルドです。
+
+>
+> これは非公式なフォークです。すべての権利は [@tiann](https://github.com/tiann) に帰属します。
+>
+>ただし、将来的には KSU とは別に管理されるブランチとなる予定です。
+
+- GKI 非対応なデバイスに完全に適応 (susfs-dev と unsusfs-patched dev ブランチのみ)
+
+## 追加方法
+susfs-stable または susfs-dev ブランチ (GKI 非対応デバイスに対応する統合された susfs) 使用してください。
+
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-dev
+```
+
+メインブランチを使用する場合
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/KernelSU/main/kernel/setup.sh" | bash -s main
+```
+## 統合された susfs の使い方
+1. パッチを当てずに susfs-dev ブランチを直接使用してください。
+
+## KPM に対応
+- KernelPatch に基づいて重複した KSU の機能を削除、KPM の対応を維持させています。
+- KPM 機能の整合性を確保するために、APatch の互換機能を更に向上させる予定です。
+
+
+オープンソースアドレス: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch
+
+
+KPM テンプレートのアドレス: https://github.com/udochina/KPM-Build-Anywhere
+
+## その他のリンク
+SukiSU と susfs をベースにコンパイルされたプロジェクトです。
+- [GKI](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS) 
+- [OnePlus](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)
+
+## フックの方式
+- この方式は (https://github.com/rsuntk/KernelSU) のフック方式を参照してください。
+
+1. **KPROBES フック:**
+    - この方式は GKI (5.10 - 6.x) のカーネルのみに対応しています。GKI 以外のカーネルは手動でフックを使用する必要があります。
+    - 読み込み可能なカーネルモジュールの場合 (LKM)
+    - GKI カーネルのデフォルトとなるフック方式
+    - `CONFIG_KPROBES=y` が必要です。
+2. **手動でフック:**
+    - GKI (5.10 - 6.x) のカーネルの場合、カーネルの defconfig に `CONFIG_KSU_MANUAL_HOOK=y` を追加して `#ifdef CONFIG_KSU` ではなく `#ifdef CONFIG_KSU_MANUAL_HOOK` を使用して KernelSU フックを保護するようにしてください。
+    - 標準の KernelSU フック: https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source
+    - backslashxx syscall フック: https://github.com/backslashxx/KernelSU/issues/5
+    - KPROBES を手動で統合する一部の非 GKI デバイスでは手動の VFS フック `new_hook.patch` パッチは不要です。
+
+
+## 使い方
+### GKI
+1. Xiaomi、Redmi、Samsung などのデバイス (Meizu、OnePlus、Realme、OPPO などのカーネルを変更したメーカー以外)
+2. `その他のリンク`の項目で言及されているカーネル名が、AnyKernel3 で終わるビルド済みの GKI カーネルを TWRP などのリカバリーでフラッシュします。
+3. 一般的な .zip の接頭辞を持つパッケージは汎用的になります。ただし、デバイスに MediaTek 製の SoC が搭載されている場合は、.gz の接頭辞を持つパッケージを使用する必要があります。その他に .lz4 の接頭辞を持つパッケージは Google 製デバイス専用です。
+
+### OnePlus
+1. `その他のリンク`の項目に記載されているリンクを開き、デバイス情報を使用してカスタマイズされたカーネルをビルドし、AnyKernel3 の接頭辞を持つ .zip ファイルをフラッシュします。
+> [!Note]
+> - 5.10、5.15、6.1、6.6 などのカーネルバージョンの最初の 2 文字のみを入力する必要があります。
+> - SoC のコードネームは自分で検索してください。通常は、数字がなく英語表記のみです。
+> - ブランチと構成ファイルは、OnePlus オープンソースカーネルリポジトリから見つけることができます。
+
+
+## 機能
+
+1. カーネルベースな `su` および root アクセスの管理。
+2. [OverlayFS](https://en.wikipedia.org/wiki/OverlayFS) モジュールシステムではなく、 5ec1cff 氏の [Magic Mount](https://github.com/5ec1cff/KernelSU) に基づいています。
+3. [アプリプロファイル](https://kernelsu.org/guide/app-profile.html): root 権限をケージ内にロックします。 
+4. 非 GKI / GKI 1.0 の対応を復活
+5. その他のカスタマイズ
+6. KPM カーネルモジュールに対応
+
+
+
+## ライセンス
+
+- “kernel” ディレクトリ内のファイルは [GPL-2.0](https://www.gnu.org/licenses/old-licenses/gpl-2.0.ja.html) のみライセンス下にあります。
+- “kernel” ディレクトリを除くその他すべての部分は [GPL-3.0 またはそれ以降](https://www.gnu.org/licenses/gpl-3.0.html) のライセンス下にあります。
+
+## スポンサーシップの一覧
+- [Ktouls](https://github.com/Ktouls) 応援をしてくれたことに感謝。
+- [zaoqi123](https://github.com/zaoqi123) ミルクティーを買ってあげるのも良い考えですね。
+- [wswzgdg](https://github.com/wswzgdg) このプロジェクトを支援していただき、ありがとうございます。
+- [yspbwx2010](https://github.com/yspbwx2010) どうもありがとう。
+
+
+
+
+上記の一覧にあなたの名前がない場合は、できるだけ早急に更新しますので再度ご支援をお願いします。
+
+## 貢献者
+
+- [KernelSU](https://github.com/tiann/KernelSU): オリジナルのプロジェクトです。
+- [MKSU](https://github.com/5ec1cff/KernelSU): 使用しているプロジェクトです。
+- [RKSU](https://github.com/rsuntk/KernelsU): このプロジェクトのカーネルを使用して非 GKI デバイスのサポートを追加しています。
+- [susfs](https://gitlab.com/simonpunk/susfs4ksu)：使用している susfs ファイルシステムです。
+- [KernelSU](https://git.zx2c4.com/kernel-assisted-superuser/about/): KernelSU について。
+- [Magisk](https://github.com/topjohnwu/Magisk): パワフルな root ユーティリティです。
+- [genuine](https://github.com/brevent/genuine/): APK v2 署名認証で使用しています。
+- [Diamorphine](https://github.com/m0nad/Diamorphine): いくつかの rootkit ユーティリティを使用しています。
+- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch はカーネルモジュールの APatch 実装での重要な部分となります。

docs/README.md

@@ -1,102 +1,120 @@
 # SukiSU Ultra
-<img align='right' src='SukiSU-mini.svg' width='220px' alt="sukisu logo">
+
+**简体中文** | [English](README-en.md) | [日本語](README-ja.md)
+
+基于 [KernelSU](https://github.com/tiann/KernelSU) 的安卓设备 root 解决方案
+
+**实验性! 使用风险自负!**
 
 
-**English** | [简体中文](./zh/README.md) | [日本語](./ja/README.md) | [Türkçe](./tr/README.md)
+>
+> 这是非官方分支，保留所有权利 [@tiann](https://github.com/tiann)
+> 但是，我们将会在未来成为一个单独维护的KSU分支
+>
 
-A kernel-based root solution for Android devices, forked from [`tiann/KernelSU`](https://github.com/tiann/KernelSU), and added some interesting changes.
 
-[![Latest release](https://img.shields.io/github/v/release/SukiSU-Ultra/SukiSU-Ultra?label=Release&logo=github)](https://github.com/tiann/KernelSU/releases/latest)
-[![Channel](https://img.shields.io/badge/Follow-Telegram-blue.svg?logo=telegram)](https://t.me/Sukiksu)
-[![License: GPL v2](https://img.shields.io/badge/License-GPL%20v2-orange.svg?logo=gnu)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)
-[![GitHub License](https://img.shields.io/github/license/tiann/KernelSU?logo=gnu)](/LICENSE)
+## 如何添加
+在内核源码的根目录下执行以下命令：
 
-## Features
+使用 susfs-dev 分支（已集成susfs，带非GKI设备的支持）
 
-1. Kernel-based `su` and root access management
-2. Module system based on [Magic Mount](https://github.com/5ec1cff/KernelSU)
-   > **Note:** SukiSU now delegates all module mounting to the installed *metamodule*; the core no longer handles mount operations.
-3. [App Profile](https://kernelsu.org/guide/app-profile.html): Lock up the root power in a cage
-4. Support non-GKI and GKI 1.0
-5. KPM Support
-6. Tweaks to the manager theme and the built-in susfs management tool.
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-dev
+```
 
-## Compatibility Status
 
-- KernelSU (before v1.0.0) officially supports Android GKI 2.0 devices (kernel 5.10+).
+使用 main 分支
+```
+curl -LSs "https://raw.githubusercontent.com/ShirkNeko/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
+```
 
-- Older kernels (4.4+) are also compatible, but the kernel will have to be built manually.
+## 如何集成 susfs
 
-- With more backports, KernelSU can supports 3.x kernel (3.4-3.18).
+1. 直接使用 susfs-stable 或者 susfs-dev 分支，不需要再集成 susfs
 
-- Currently, only `arm64-v8a`, `armeabi-v7a (bare)` and `X86_64`(some) are supported.
+## 钩子方法
+- 此部分引用自 [rsuntk 的钩子方法](https://github.com/rsuntk/KernelSU)
 
-## Installation
+1. **KPROBES 钩子：**
+    - 此方法仅支持 GKI 2.0 (5.10 - 6.x) 内核, 所有非 GKI 2.0 内核都必须使用手动钩子
+    - 用于可加载内核模块 (LKM)
+    - GKI 2.0 内核的默认钩子方法
+    - 需要 `CONFIG_KPROBES=y`
+2. **手动钩子：**
+    - 对于 GKI 2.0 (5.10 - 6.x) 内核，需要在对应设备的 defconfig 文件中添加 `CONFIG_KSU_MANUAL_HOOK=y` 并确保使用 `#ifdef CONFIG_KSU_MANUAL_HOOK` 而不是 `#ifdef CONFIG_KSU` 来保护 KernelSU 钩子
+    - 标准的 KernelSU 钩子：https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source
+    - backslashxx 的 syscall 手动钩子：https://github.com/backslashxx/KernelSU/issues/5
+    - 部分手动集成 KPROBES 的非 GKI 2.0 设备不需要手动 VFS 钩子 `new_hook.patch` 补丁
 
-See [`guide/installation.md`](guide/installation.md)
 
-## Integration
+## KPM支持
 
-See [`guide/how-to-integrate.md`](guide/how-to-integrate.md)
+- 我们基于KernelPatch去掉了和KSU重复的功能，保留了KPM支持
+- 我们将会引入更多的兼容APatch的函数来确保KPM功能的完整性
 
-## Translation
 
-If you need to submit a translation for the manager, please go to [Crowdin](https://crowdin.com/project/SukiSU-Ultra).
+开源地址: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch
 
-## KPM Support
 
-- Based on KernelPatch, we removed features redundant with KSU and retained only KPM support.
-- Work in Progress: Expanding APatch compatibility by integrating additional functions to ensure compatibility across different implementations.
+KPM模板地址: https://github.com/udochina/KPM-Build-Anywhere
 
-**Open-source repository**: [https://github.com/ShirkNeko/SukiSU_KernelPatch_patch](https://github.com/ShirkNeko/SukiSU_KernelPatch_patch)
 
-**KPM template**: [https://github.com/udochina/KPM-Build-Anywhere](https://github.com/udochina/KPM-Build-Anywhere)
+## 更多链接
+基于 SukiSU 和 susfs 编译的项目
+- [GKI](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS) 
+- [一加](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)
+
+
+## 使用方法
+
+### GKI
+1. 适用于如小米红米三星等的 GKI 2.0 的设备 (不包含魔改内核的厂商如魅族、一加、真我和 oppo)
+2. 找到更多链接里的 GKI 构建的项目找到设备内核版本直接下载用TWRP或者内核刷写工具刷入带 AnyKernel3 后缀的压缩包即可
+3. 一般不带后缀的 .zip 压缩包是通用，gz 后缀的为天玑机型专用，lz4 后缀的为谷歌系机型专用，一般刷不带后缀的即可
+
+### 一加
+1.找到更多链接里的一加项目进行自行填写，然后云编译构建，最后刷入带 AnyKernel3 后缀的压缩包即可
 
 > [!Note]
->
-> 1. Requires `CONFIG_KPM=y`
-> 2. Non-GKI devices requires `CONFIG_KALLSYMS=y` and `CONFIG_KALLSYMS_ALL=y`
-> 3. For kernels below `4.19`, backporting from `set_memory.h` from `4.19` is required.
+> - 内核版本只需要填写前两位即可，如 5.10，5.15，6.1，6.6
+> - 处理器代号请自行搜索，一般为全英文不带数字的代号
+> - 分支和配置文件请自行到一加内核开源地址进行填写
 
-## Troubleshooting
 
-1. Device stuck upon manager app uninstallation?
-   Uninstall _com.sony.playmemories.mobile_
+## 特点
 
-## Sponsor
+1. 基于内核的 `su` 和 root 访问管理
+2. 基于 5ec1cff 的 [Magic Mount](https://github.com/5ec1cff/KernelSU) 的模块系统
+3. [App Profile](https://kernelsu.org/guide/app-profile.html)：将 root 权限锁在笼子里
+4. 恢复对非 GKI 2.0 内核的支持
+5. 更多自定义功能
+6. 对KPM内核模块的支持
 
-- [ShirkNeko](https://afdian.com/a/shirkneko) (maintainer of SukiSU)
-- [weishu](https://github.com/sponsors/tiann) (author of KernelSU)
 
-## ShirkNeko's sponsorship list
+## 许可证
 
-- [Ktouls](https://github.com/Ktouls) Thanks so much for bringing me support.
-- [zaoqi123](https://github.com/zaoqi123) Thanks for the milk tea.
-- [wswzgdg](https://github.com/wswzgdg) Many thanks for supporting this project.
-- [yspbwx2010](https://github.com/yspbwx2010) Many thanks.
-- [DARKWWEE](https://github.com/DARKWWEE) 100 USDT
-- [Saksham Singla](https://github.com/TypeFlu) Provide and maintain the website
-- [OukaroMF](https://github.com/OukaroMF) Donation of website domain name
+- `kernel` 目录下的文件是 [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)。
+- 除 `kernel` 目录外，所有其他部分均为 [GPL-3.0 或更高版本](https://www.gnu.org/licenses/gpl-3.0.html)。
 
-## License
+## 赞助名单
+- [Ktouls](https://github.com/Ktouls) 非常感谢你给我带来的支持
+- [zaoqi123](https://github.com/zaoqi123) 请我喝奶茶也不错
+- [wswzgdg](https://github.com/wswzgdg) 非常感谢对此项目的支持
+- [yspbwx2010](https://github.com/yspbwx2010) 非常感谢
 
-- The file in the “kernel” directory is under [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) license.
-- The images of the files `ic_launcher(?!.*alt.*).*` with anime character sticker are copyrighted by [怡子曰曰](https://space.bilibili.com/10545509), the Brand Intellectual Property in the images is owned by [明风 OuO](https://space.bilibili.com/274939213), and the vectorization is done by @MiRinChan. Before using these files, in addition to complying with [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt), you also need to comply with the authorization of the two authors to use these artistic contents.
-- Except for the files or directories mentioned above, all other parts are under [GPL-3.0 or later](https://www.gnu.org/licenses/gpl-3.0.html) license.
 
-## Credit
 
-- [KernelSU](https://github.com/tiann/KernelSU): upstream
-- [MKSU](https://github.com/5ec1cff/KernelSU): Magic Mount
-- [RKSU](https://github.com/rsuntk/KernelsU): support non-GKI
-- [susfs](https://gitlab.com/simonpunk/susfs4ksu): An addon root hiding kernel patches and userspace module for KernelSU.
-- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch is a key part of the APatch implementation of the kernel module
 
-<details>
-<summary>KernelSU's credit</summary>
+如果以上名单没有你的名称，我会及时更新，再次感谢大家的支持
 
-- [Kernel-Assisted Superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/): The KernelSU idea.
-- [Magisk](https://github.com/topjohnwu/Magisk): The powerful root tool.
-- [genuine](https://github.com/brevent/genuine/): APK v2 signature validation.
-- [Diamorphine](https://github.com/m0nad/Diamorphine): Some rootkit skills.
-</details>
+## 贡献
+
+- [KernelSU](https://github.com/tiann/KernelSU)：原始项目
+- [MKSU](https://github.com/5ec1cff/KernelSU)：使用的项目
+- [RKSU](https://github.com/rsuntk/KernelsU)：使用该项目的 kernel 对非GKI设备重新进行支持
+- [susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu)：使用的 susfs 文件系统
+- [kernel-assisted-superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/)：KernelSU 的构想
+- [Magisk](https://github.com/topjohnwu/Magisk)：强大的 root 工具
+- [genuine](https://github.com/brevent/genuine/)：APK v2 签名验证
+- [Diamorphine](https://github.com/m0nad/Diamorphine)：一些 rootkit 技能
+- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch是APatch实现内核模块的关键部分

docs/guide/how-to-integrate.md

@@ -1,97 +0,0 @@
-# Integrate
-
-SukiSU can be integrated into both _GKI_ and _non-GKI_ kernels and has been backported to _4.14_.
-
-<!-- It should be 3.4, but backslashxx's syscall manual hook cannot use in SukiSU-->
-
-Some OEMs' customization could result in as much as 50% of kernel code being out-of-tree code and not from upstream Linux kernels or ACKs. Due to this, the custom nature of _non-GKI_ kernels resulted in significant kernel fragmentation, and we lacked a universal method for building them. Therefore, we cannot provide boot images of _non-GKI_ kernels.
-
-Prerequisites: open source bootable kernel.
-
-### Hook method
-
-1. **KPROBES hook:**
-
-   - Default hook method on GKI kernels.
-   - Requires `# CONFIG_KSU_MANUAL_HOOK is not set` & `CONFIG_KPROBES=y`
-   - Used for Loadable Kernel Module (LKM).
-
-2. **Manual hook:**
-
-   <!-- - backslashxx's syscall manual hook: https://github.com/backslashxx/KernelSU/issues/5 (v1.5 version is not available at the moment, if you want to use it, please use v1.4 version, or standard KernelSU hooks)-->
-
-   - Requires `CONFIG_KSU_MANUAL_HOOK=y`
-   - Requires [`guide/how-to-integrate.md`](guide/how-to-integrate.md)
-   - Requires [https://github.com/~](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#manually-modify-the-kernel-source)
-
-3. **Tracepoint Hook:**
-
-   - Hook method introduced since SukiSU commit [49b01aad](https://github.com/SukiSU-Ultra/SukiSU-Ultra/commit/49b01aad74bcca6dba5a8a2e053bb54b648eb124)
-   - Requires `CONFIG_KSU_TRACEPOINT_HOOK=y`
-   - Requires [`guide/tracepoint-hook.md`](tracepoint-hook.md)
-
-<!-- This part refer to [rsuntk/KernelSU](https://github.com/rsuntk/KernelSU). -->
-
-If you're able to build a bootable kernel, there are two ways to integrate KernelSU into the kernel source code:
-
-1. Automatically with `kprobe`
-2. Manually
-
-## Integrate with kprobe
-
-Applicable:
-
-- _GKI_ kernel
-
-Not applicable:
-
-- _non-GKI_ kernel
-
-KernelSU uses kprobe to do kernel hooks. If kprobe runs well in your kernel, it's recommended to use it this way.
-
-Please refer to this document [https://github.com/~](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#integrate-with-kprobe). Although it is titled “for _non-GKI_,” it only applies to _GKI_.
-
-The execution command for the step that adds KernelSU to your kernel source tree is replaced with:
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-## Manually modify the kernel source
-
-Applicable:
-
-- GKI kernel
-- non-GKI kernel
-
-Please refer to this document [https://github.com/~ (Integrate for non-GKI)](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#manually-modify-the-kernel-source) and [https://github.com/~ (Build for GKI)](https://kernelsu.org/zh_CN/guide/how-to-build.html) to integrate manually, although first link is titled “for non-GKI,” it also applies to GKI. It can work on them both.
-
-There is another way to integrate but still work in the process.
-
-<!-- It is backslashxx's syscall manual hook, but it cannot be used now. -->
-
-Run command for the step that adds KernelSU(SukiSU) to your kernel source tree is replaced with:
-
-### GKI kernel
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-### non-GKI kernel
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s nongki
-```
-
-### GKI / non-GKI kernel with susfs (experiment)
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-{{branch}}
-```
-
-Branch:
-
-- `main` (susfs-main)
-- `test` (susfs-test)
-- version (for example: susfs-1.5.7, you should check the [branches](https://github.com/SukiSU-Ultra/SukiSU-Ultra/branches))

docs/guide/installation.md

@@ -1,34 +0,0 @@
-# Installation
-
-You can go to [KernelSU Documentation - Installation](https://kernelsu.org/guide/installation.html) for a reference on how to install it, here are just additional instructions.
-
-## Installation by loading the Loadable Kernel Module(LKM)
-
-See [KernelSU Documentation - LKM Installation](https://kernelsu.org/guide/installation.html#lkm-installation)
-
-Beginning with **Android™** (trademark meaning licensed Google Mobile Services) 12, devices shipping with kernel version 5.10 or higher must ship with the GKI kernel. You may be able to use LKM mode.
-
-## Installation by installing the kernel
-
-See [KernelSU Documentation - GKI mode Installation](https://kernelsu.org/guide/installation.html#gki-mode-installation)
-
-We provide pre-built kernels for you to use:
-
-- [ShirkNeko flavor kernel](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS) (add ZRAM compression algorithm patch, susfs, KPM. Works on many devices.)
-- [MiRinFork flavored kernel](https://github.com/MiRinFork/GKI_SukiSU_SUSFS) (adds susfs, KPM. Closest kernel to GKI, works on most devices.)
-
-Although some devices can be installed using LKM mode, they cannot be installed on the device by using the GKI kernel; therefore, the kernel needs to be modified manually to compile it. For example:
-
-- OPPO(OnePlus, REALME)
-- Meizu
-
-Also, we provide pre-built kernels for your OnePlus device to use:
-
-- [ShirkNeko/Action_OnePlus_MKSU_SUSFS](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS) (add ZRAM compression algorithm patch, susfs, KPM.)
-
-Using the link above, Fork into GitHub Action, fill in the build parameters, compile, and finally flush in the zip with the AnyKernel3 suffix.
-
-> [!Note]
->
-> - You only need to fill in the first two parts of the version number, e.g. `5.10`, `6.1`...
-> - Make sure you know the processor designation, kernel version, etc. before you use it.

docs/guide/tracepoint-hook.md

@@ -1,239 +0,0 @@
-# Tracepoint Hook Integration
-
-## Introduction
-
-Since commit [49b01aad](https://github.com/SukiSU-Ultra/SukiSU-Ultra/commit/49b01aad74bcca6dba5a8a2e053bb54b648eb124), SukiSU has introduced Tracepoint Hook
-
-This Hook theoretically has lower performance overhead compared to Kprobes Hook, but is inferior to Manual Hook / Syscall Hook
-
-> [!NOTE]
-> This tutorial references the syscall hook v1.4 version from [backslashxx/KernelSU#5](https://github.com/backslashxx/KernelSU/issues/5), as well as the original KernelSU's [Manual Hook](https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source)
-
-## Guide
-
-### execve Hook (`exec.c`)
-
-Generally need to modify the `do_execve` and `compat_do_execve` methods in `fs/exec.c`
-
-```patch
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -78,6 +78,10 @@
- #include <trace/hooks/sched.h>
- #endif
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- EXPORT_TRACEPOINT_SYMBOL_GPL(task_rename);
- 
- static int bprm_creds_from_file(struct linux_binprm *bprm);
-@@ -2037,6 +2041,9 @@ static int do_execve(struct filename *filename,
- {
- 	struct user_arg_ptr argv = { .ptr.native = __argv };
- 	struct user_arg_ptr envp = { .ptr.native = __envp };
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_execveat_hook((int *)AT_FDCWD, &filename, &argv, &envp, 0);
-+#endif
- 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
- }
- 
-@@ -2064,6 +2071,9 @@ static int compat_do_execve(struct filename *filename,
- 		.is_compat = true,
- 		.ptr.compat = __envp,
- 	};
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_execveat_hook((int *)AT_FDCWD, &filename, &argv, &envp, 0); // 32-bit su and 32-on-64 support
-+#endif
- 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
- }
-```
-
-### faccessat Hook (`open.c`)
-
-Generally need to modify the `do_faccessat` method in `/fs/open.c` 
-
-```patch
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -37,6 +37,10 @@
- #include "internal.h"
- #include <trace/hooks/syscall_check.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- int do_truncate(struct user_namespace *mnt_userns, struct dentry *dentry,
- 		loff_t length, unsigned int time_attrs, struct file *filp)
- {
-@@ -468,6 +472,9 @@ static long do_faccessat(int dfd, const char __user *filename, int mode, int fla
- 
- SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- {
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_faccessat_hook(&dfd, &filename, &mode, NULL);
-+#endif
- 	return do_faccessat(dfd, filename, mode, 0);
- }
-```
-
-If there's no `do_faccessat` method, you can find the `faccessat` SYSCALL definition (for kernels earlier than 4.17)
-
-```patch
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -31,6 +31,9 @@
- #include <linux/ima.h>
- #include <linux/dnotify.h>
- #include <linux/compat.h>
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
- 
- #include "internal.h"
- 
-@@ -369,6 +372,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- 	int res;
- 	unsigned int lookup_flags = LOOKUP_FOLLOW;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_faccessat_hook(&dfd, &filename, &mode, NULL);
-+#endif
- 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
- 		return -EINVAL;
-```
-
-### sys_read Hook (`read_write.c`)
-
-Need to modify the `sys_read` method in `fs/read_write.c` (4.19 and above)
-
-```patch
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -25,6 +25,10 @@
- #include <linux/uaccess.h>
- #include <asm/unistd.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- const struct file_operations generic_ro_fops = {
- 	.llseek		= generic_file_llseek,
- 	.read_iter	= generic_file_read_iter,
-@@ -630,6 +634,9 @@ ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
- 
- SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
- {
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_sys_read_hook(fd, &buf, &count);
-+#endif
- 	return ksys_read(fd, buf, count);
- }
-```
-
-Or the `read` SYSCALL definition (4.14 and below)
-
-```patch
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -25,6 +25,11 @@
- #include <linux/uaccess.h>
- #include <asm/unistd.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
-+
- const struct file_operations generic_ro_fops = {
- 	.llseek		= generic_file_llseek,
- 	.read_iter	= generic_file_read_iter,
-@@ -575,6 +580,9 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
- 
- 	if (f.file) {
- 		loff_t pos = file_pos_read(f.file);
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+		trace_ksu_trace_sys_read_hook(fd, &buf, &count);
-+#endif
- 		ret = vfs_read(f.file, buf, count, &pos);
- 		if (ret >= 0)
- 			file_pos_write(f.file, pos);
-```
-
-### fstatat Hook (`stat.c`)
-
-Need to modify the `newfstatat` SYSCALL definition in `stat.c`
-
-If 32-bit support is needed, also need to modify the `statat64` SYSCALL definition
-
-```patch
---- a/fs/stat.c
-+++ b/fs/stat.c
-@@ -24,6 +24,10 @@
- #include "internal.h"
- #include "mount.h"
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- /**
-  * generic_fillattr - Fill in the basic attributes from the inode struct
-  * @mnt_userns:	user namespace of the mount the inode was found from
-@@ -408,6 +412,10 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, const char __user *, filename,
- 	struct kstat stat;
- 	int error;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_stat_hook(&dfd, &filename, &flag);
-+#endif
-+
- 	error = vfs_fstatat(dfd, filename, &stat, flag);
- 	if (error)
- 		return error;
-@@ -559,6 +567,10 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, const char __user *, filename,
- 	struct kstat stat;
- 	int error;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_stat_hook(&dfd, &filename, &flag); /* 32-bit su support */
-+#endif
-+
- 	error = vfs_fstatat(dfd, filename, &stat, flag);
- 	if (error)
- 		return error;
-```
-
-### input Hook (`input.c`, for entering KSU built-in security mode)
-
-Need to modify the `input_event` method in `drivers/input/input.c`, not `input_handle_event`
-
-```patch
---- a/drivers/input/input.c
-+++ b/drivers/input/input.c
-@@ -26,6 +26,10 @@
- #include "input-compat.h"
- #include "input-poller.h"
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
- MODULE_DESCRIPTION("Input core");
- MODULE_LICENSE("GPL");
-@@ -451,6 +455,10 @@ void input_event(struct input_dev *dev,
- {
- 	unsigned long flags;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_input_hook(&type, &code, &value);
-+#endif
-+
- 	if (is_event_supported(type, dev->evbit, EV_MAX)) {
- 
- 		spin_lock_irqsave(&dev->event_lock, flags);
-```

docs/ja/README.md

@@ -1,153 +0,0 @@
-# SukiSU Ultra
-<img align='right' src='SukiSU-mini.svg' width='220px' alt="sukisu logo">
-
-
-[English](../README.md) | [简体中文](../zh/README.md) | **日本語** | [Türkçe](../tr/README.md)
-
-[KernelSU](https://github.com/tiann/KernelSU) をベースとした Android デバイスの root ソリューション
-
-**試験中なビルドです！自己責任で使用してください！**<br>
-このソリューションは [KernelSU](https://github.com/tiann/KernelSU) に基づいていますが、試験中なビルドです。
-
-> これは非公式なフォークです。すべての権利は [@tiann](https://github.com/tiann) に帰属します。
->
-> ただし、将来的には KSU とは別に管理されるブランチとなる予定です。
-
-## 追加する方法
-
-メインブランチを使用 (非 GKI のデバイスのビルドは非対応) (susfs を手動で統合が必要)
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-非 GKI のデバイスに対応するブランチを使用 (susfs を手動で統合が必要)
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s nongki
-```
-
-## 統合された susfs の使い方
-
-1. susfs-main または他の susfs-\* ブランチを直接で使用、susfs の統合は不要 (非 GKI デバイスのビルドに対応)
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-main
-```
-
-## フックの方式
-
-- この方式は (https://github.com/rsuntk/KernelSU) のフック方式を参照してください。
-
-1. **KPROBES でフック:**
-
-   - 読み込み可能なカーネルモジュールの場合 (LKM)
-   - GKI カーネルのデフォルトとなるフック方式
-   - `CONFIG_KPROBES=y` が必要です
-
-2. **手動でフック:**
-   - 標準の KernelSU フック: https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source
-   - backslashxx syscall フック: https://github.com/backslashxx/KernelSU/issues/5
-   - 非 GKI カーネル用のデフォルトフック方式
-   - `CONFIG_KSU_MANUAL_HOOK=y` が必要です
-
-## KPM に対応
-
-- KernelPatch に基づいて重複した KSU の機能を削除、KPM の対応を維持させています。
-- KPM 機能の整合性を確保するために、APatch の互換機能を更に向上させる予定です。
-
-オープンソースアドレス: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch
-
-KPM テンプレートのアドレス: https://github.com/udochina/KPM-Build-Anywhere
-
-> [!Note]
->
-> 1. `CONFIG_KPM=y` が必要です。
-> 2. 非 GKI デバイスには `CONFIG_KALLSYMS=y` と `CONFIG_KALLSYMS_ALL=y` も必要です。
-> 3. いくつかのカーネル `4.19` およびそれ以降のソースコードでは、 `4.19` からバックポートされた `set_memory.h` ヘッダーファイルも必要です。
-
-## ROOT を保持した状態でのシステムアップデートの方法
-
-- 始めに OTA 後すぐに再起動せずにマネージャーのカーネルのフラッシュ、パッチのインターフェースを開いて`GKI/非 GKI のインストール`を見つけます。フラッシュする AnyKernel3 の zip ファイルを選択し、フラッシュする実行中のスロットと逆のスロットを選択後に再起動をして GKI モードの更新が保持できます (この方法はすべての非 GKI のデバイスが対応している訳ではないので、自分でお試しください。これは非 GKI のデバイスで TWRP を使用する最も安全な方法です)。
-- または LKM モードを使用して未使用のスロットにインストールします (OTA 後)。
-
-## 互換性の状態
-
-- KernelSU (v1.0.0 より前) は Android GKI 2.0 のデバイス (カーネル 5.10 以降) を公式に対応しています。
-
-- 古いカーネル (4.4 以降) も互換性がありますが、カーネルを手動で再ビルドする必要があります。
-
-- KernelSU は追加のリバースポートを通じて 3.x カーネル (3.4-3.18) で対応可能です。
-
-- 現在 `arm64-v8a`, `armeabi-v7a (bare)` および一部の `X86_64` に対応しています。
-
-## その他のリンク
-
-**マネージャーの翻訳を行う場合** https://crowdin.com/project/SukiSU-Ultra
-
-- [その他パッチ済み GKI](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS) ZRAM パッチ、KPM、susfs が含まれています...
-- [パッチの少ない GKI](https://github.com/MiRinFork/GKI_SukiSU_SUSFS/releases) susfs のみ
-- [OnePlus](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)
-
-## 使い方
-
-### Universal GKI
-
-**すべて**参照してください https://kernelsu.org/ja_JP/guide/installation.html
-
-> [!Note]
->
-> 1. Xiaomi、Redmi、Samsung などの GKI 2.0 を搭載したデバイス向け (Meizu、OnePlus、Zenith、Oppo などカーネルが変更されているメーカーを除く)
-> 2. GKI のビルドは[その他のリンク](#その他のリンク)から入手できます。デバイスのカーネルバージョンを確認してください。ダウンロード後に TWRP またはカーネルフラッシュツールを使用して AnyKernel3 の接頭辞を持つ zip ファイルをフラッシュしてください。Pixel のユーザーは、パッチの少ない GKI を使用する必要があります。
-> 3. 接頭辞のない .zip アーカイブは圧縮されていません。.gz の接頭辞は Tenguet モデルで使用される圧縮になります。
-
-### OnePlus
-
-1. `その他のリンク`の項目に記載されているリンクを開き、デバイス情報を使用してカスタマイズされたカーネルをビルドし、AnyKernel3 の接頭辞を持つ .zip ファイルをフラッシュします。
-
-> [!Note]
->
-> - 5.10、5.15、6.1、6.6 などのカーネルバージョンの最初の 2 文字のみを入力する必要があります。
-> - SoC のコードネームは自分で検索してください。通常は、数字がなく英語表記のみです。
-> - ブランチと構成ファイルは、OnePlus オープンソースカーネルリポジトリから見つけることができます。
-
-## 機能
-
-1. カーネルベースな `su` および root アクセスの管理。
-2. [OverlayFS](https://en.wikipedia.org/wiki/OverlayFS) モジュールシステムではなく、 5ec1cff 氏の [Magic Mount](https://github.com/5ec1cff/KernelSU) に基づいています。
-3. [アプリプロファイル](https://kernelsu.org/guide/app-profile.html): root 権限をケージ内にロックします。
-4. 非 GKI / GKI 1.0 の対応を復活
-5. その他のカスタマイズ
-6. KPM カーネルモジュールに対応
-
-## トラブルシューティング
-
-1. KernelSU Manager のアンインストールが停止してしまう → com.sony.playmemories.mobile のアプリをアンインストールしてください。
-
-## ライセンス
-
-- 「kernel」のディレクトリ内のファイルは [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) のライセンスに基づいています。
-- アニメキャラクター画像とスタンプを含むこれらのファイルの `ic_launcher(?!.*alt.*).*` は[怡子曰曰](https://space.bilibili.com/10545509)によって著作権保護されており、画像の Brand Intellectual Property は[明风 OuO](https://space.bilibili.com/274939213)によって所有され、ベクター化は @MiRinChan によって行われています。 これらのファイルを使用する前に、[Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt)を遵守することに加えて、アートコンテンツを使用するために前の 2 人の作者から許可を得る必要があります。
-- 上記のファイルまたはディレクトリを除き、その他のすべての部分は[GPL-3.0 以降](https://www.gnu.org/licenses/gpl-3.0.html)です。
-
-## スポンサーシップの一覧
-
-- [Ktouls](https://github.com/Ktouls) 応援してくれてありがとう
-- [zaoqi123](https://github.com/zaoqi123) ミルクティーを買ってあげるのも良い考えですね
-- [wswzgdg](https://github.com/wswzgdg) このプロジェクトにご支援いただき、ありがとうございます
-- [yspbwx2010](https://github.com/yspbwx2010) ありがとうございます
-- [DARKWWEE](https://github.com/DARKWWEE) ラオスから 100 USDT の支援に感謝します
-- [Saksham Singla](https://github.com/TypeFlu) ウェブサイトの提供とメンテナンス
-- [OukaroMF](https://github.com/OukaroMF) ウェブサイトのドメインと寄付
-
-## 貢献者
-
-- [KernelSU](https://github.com/tiann/KernelSU): オリジナルのプロジェクト
-- [MKSU](https://github.com/5ec1cff/KernelSU): 使用しているプロジェクト
-- [RKSU](https://github.com/rsuntk/KernelsU): このプロジェクトのカーネルを使用した非 GKI デバイスのサポートの再導入
-- [susfs](https://gitlab.com/simonpunk/susfs4ksu): susfs ファイルシステムの使用
-- [KernelSU](https://git.zx2c4.com/kernel-assisted-superuser/about/): KernelSU の概念化
-- [Magisk](https://github.com/topjohnwu/Magisk): パワフルな root ユーティリティ
-- [genuine](https://github.com/brevent/genuine/): APK v2 署名認証
-- [Diamorphine](https://github.com/m0nad/Diamorphine): いくつかの root キットユーティリティ
-- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch はカーネルモジュールの APatch 実装の重要な部分での活用

docs/tr/README.md

@@ -1,151 +0,0 @@
-# SukiSU Ultra
-<img align='right' src='SukiSU-mini.svg' width='250px' alt="sukisu logo">
-
-
-[English](../README.md) | [简体中文](../zh/README.md) | [日本語](../ja/README.md) | **Türkçe**
-
-[KernelSU](https://github.com/tiann/KernelSU) tabanlı Android cihaz root çözümü
-
-**Deneysel! Kullanım riski size aittir!**
-
-> Bu resmi olmayan bir daldır, tüm hakları saklıdır [@tiann](https://github.com/tiann)
->
-> Ancak, gelecekte ayrı bir KSU dalı olarak devam edeceğiz
-
-## Nasıl Eklenir
-
-Çekirdek kaynak kodunun kök dizininde aşağıdaki komutları çalıştırın:
-
-Ana dalı kullanın (GKI olmayan cihazlar için desteklenmez)
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-GKI olmayan cihazları destekleyen dalı kullanın
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s nongki
-```
-
-## susfs Nasıl Entegre Edilir
-
-1. Doğrudan susfs-main veya susfs-\* dalını kullanın, susfs entegrasyonuna gerek yok
-
-```
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-main
-```
-
-## Kanca Yöntemleri
-
-- Bu bölüm [rsuntk\'nin kanca yöntemlerinden](https://github.com/rsuntk/KernelSU) alıntılanmıştır
-
-1. **KPROBES Kancası:**
-
-   - Yüklenebilir çekirdek modülleri (LKM) için kullanılır
-   - GKI 2.0 çekirdeğinin varsayılan kanca yöntemi
-   - `CONFIG_KPROBES=y` gerektirir
-
-2. **Manuel Kanca:**
-   - Standart KernelSU kancası: https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source
-   - backslashxx\'nin syscall manuel kancası: https://github.com/backslashxx/KernelSU/issues/5
-   - GKI olmayan çekirdeğin varsayılan kanca yöntemi
-   - `CONFIG_KSU_MANUAL_HOOK=y` gerektirir
-
-## KPM Desteği
-
-- KernelPatch tabanlı olarak KSU ile çakışan işlevleri kaldırdık ve yalnızca KPM desteğini koruduk
-- APatch ile daha fazla uyumlu fonksiyon ekleyerek KPM işlevlerinin bütünlüğünü sağlayacağız
-
-Kaynak kodu: https://github.com/ShirkNeko/SukiSU_KernelPatch_patch
-
-KPM şablonu: https://github.com/udochina/KPM-Build-Anywhere
-
-> [!Note]
->
-> 1. `CONFIG_KPM=y` gerektirir
-> 2. GKI olmayan cihazlar ayrıca `CONFIG_KALLSYMS=y` ve `CONFIG_KALLSYMS_ALL=y` gerektirir
-> 3. Bazı çekirdek `4.19` altı kaynak kodları, `4.19`dan geri taşınan başlık dosyası `set_memory.h` gerektirir
-
-## Sistem Güncellemesini Yaparak ROOT\'u Koruma
-
-- OTA\'dan sonra hemen yeniden başlatmayın, yöneticiye girin ve çekirdek yazma/onarma arayüzüne gidin, `GKI/non_GKI yükleme` seçeneğini bulun ve Anykernel3 çekirdek sıkıştırma dosyasını seçin, şu anda sistemin çalıştığı yuva ile zıt yuvaya yazın ve yeniden başlatın, böylece GKI modu güncellemesini koruyabilirsiniz (şu anda tüm GKI olmayan cihazlar bu yöntemi desteklemiyor, lütfen kendiniz deneyin. GKI olmayan cihazlar için TWRP kullanmak en güvenlidir)
-- Veya kullanılmayan yuvaya LKM modunu kullanarak yükleyin (OTA\'dan sonra)
-
-## Uyumluluk Durumu
-
-- KernelSU (v1.0.0 öncesi sürümler) resmi olarak Android GKI 2.0 cihazlarını destekler (çekirdek 5.10+)
-
-- Eski çekirdekler (4.4+) de uyumludur, ancak çekirdeği manuel olarak oluşturmanız gerekir
-
-- Daha fazla geri taşımayla KernelSU, 3.x çekirdeğini (3.4-3.18) destekleyebilir
-
-- Şu anda `arm64-v8a`, `armeabi-v7a (bare)` ve bazı `X86_64` desteklenmektedir
-
-## Daha Fazla Bağlantı
-
-SukiSU ve susfs tabanlı derlenen projeler
-
-- [GKI](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS)
-- [OnePlus](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)
-
-## Kullanım Yöntemi
-
-### Evrensel GKI
-
-Lütfen **tümünü** https://kernelsu.org/zh_CN/guide/installation.html adresinden inceleyin
-
-> [!Note]
->
-> 1. Xiaomi, Redmi, Samsung gibi GKI 2.0 cihazlar için uygundur (Meizu, OnePlus, Realme ve Oppo gibi değiştirilmiş çekirdekli üreticiler hariç)
-> 2. [Daha fazla bağlantı](#daha-fazla-bağlantı) bölümündeki GKI tabanlı projeleri bulun. Cihaz çekirdek sürümünü bulun. Ardından indirin ve TWRP veya çekirdek yazma aracı kullanarak AnyKernel3 soneki olan sıkıştırılmış paketi yazın
-> 3. Genellikle sonek olmayan .zip sıkıştırılmış paketler sıkıştırılmamıştır, gz soneki olanlar ise Dimensity modelleri için kullanılan sıkıştırma yöntemidir
-
-### OnePlus
-
-1. Daha fazla bağlantı bölümündeki OnePlus projesini bulun ve kendiniz doldurun, ardından bulut derleme yapın ve AnyKernel3 soneki olan sıkıştırılmış paketi yazın
-
-> [!Note]
->
-> - Çekirdek sürümü için yalnızca ilk iki haneyi doldurmanız yeterlidir, örneğin 5.10, 5.15, 6.1, 6.6
-> - İşlemci kod adını kendiniz arayın, genellikle tamamen İngilizce ve sayı içermeden oluşur
-> - Dal ve yapılandırma dosyasını kendiniz OnePlus çekirdek kaynak kodundan doldurun
-
-## Özellikler
-
-1. Çekirdek tabanlı `su` ve root erişim yönetimi
-2. 5ec1cff\'nin [Magic Mount](https://github.com/5ec1cff/KernelSU) tabanlı modül sistemi
-3. [App Profile](https://kernelsu.org/guide/app-profile.html): root yetkilerini kafeste kilitleyin
-4. GKI 2.0 olmayan çekirdekler için desteğin geri getirilmesi
-5. Daha fazla özelleştirme özelliği
-6. KPM çekirdek modülleri için destek
-
-## Lisans
-
-- `kernel` dizinindeki dosyalar [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) lisansı altındadır.
-- Anime karakter ifadeleri içeren `ic_launcher(?!.*alt.*).*` dosyalarının görüntüleri [怡子曰曰](https://space.bilibili.com/10545509) tarafından telif hakkıyla korunmaktadır, görüntülerdeki Marka Fikri Mülkiyeti [明风 OuO](https://space.bilibili.com/274939213)'ye aittir ve vektörleştirme @MiRinChan tarafından yapılmıştır. Bu dosyaları kullanmadan önce, [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt) ile uyumlu olmanın yanı sıra, bu sanatsal içerikleri kullanmak için iki yazarın yetkilendirmesine de uymanız gerekir.
-- Yukarıda belirtilen dosyalar veya dizinler hariç, diğer tüm parçalar [GPL-3.0 veya üzeri](https://www.gnu.org/licenses/gpl-3.0.html)'dir.
-
-## Afdian Bağlantısı
-
-- https://afdian.com/a/shirkneko
-
-## Sponsor Listesi
-
-- [Ktouls](https://github.com/Ktouls) Bana sağladığınız destek için çok teşekkür ederim
-- [zaoqi123](https://github.com/zaoqi123) Bana sütlü çay ısmarlamanız da güzel
-- [wswzgdg](https://github.com/wswzgdg) Bu projeye olan desteğiniz için çok teşekkür ederim
-- [yspbwx2010](https://github.com/yspbwx2010) Çok teşekkür ederim
-- [DARKWWEE](https://github.com/DARKWWEE) 100 USDT için teşekkürler
-
-## Katkıda Bulunanlar
-
-- [KernelSU](https://github.com/tiann/KernelSU): Orijinal proje
-- [MKSU](https://github.com/5ec1cff/KernelSU): Kullanılan proje
-- [RKSU](https://github.com/rsuntk/KernelsU): GKI olmayan cihazlar için destek sağlayan proje
-- [susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu): Kullanılan susfs dosya sistemi
-- [kernel-assisted-superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/): KernelSU fikri
-- [Magisk](https://github.com/topjohnwu/Magisk): Güçlü root aracı
-- [genuine](https://github.com/brevent/genuine/): APK v2 imza doğrulama
-- [Diamorphine](https://github.com/m0nad/Diamorphine): Bazı rootkit becerileri
-- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch, APatch\'in çekirdek modüllerini uygulamak için kritik bir parçadır

docs/zakomonochrome-128.svg

@@ -1,65 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   width="128"
-   height="128"
-   viewBox="0 0 128 128"
-   version="1.1"
-   id="svg1"
-   inkscape:version="1.4.2 (ebf0e940d0, 2025-05-08)"
-   sodipodi:docname="zakomonochrome-128.svg"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg">
-  <sodipodi:namedview
-     id="namedview1"
-     pagecolor="#ffffff"
-     bordercolor="#999999"
-     borderopacity="1"
-     inkscape:showpageshadow="2"
-     inkscape:pageopacity="0"
-     inkscape:pagecheckerboard="0"
-     inkscape:deskcolor="#d1d1d1"
-     inkscape:document-units="px"
-     inkscape:zoom="2.6185048"
-     inkscape:cx="59.957881"
-     inkscape:cy="71.032903"
-     inkscape:window-width="1280"
-     inkscape:window-height="696"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1"
-     inkscape:current-layer="layer1" />
-  <defs
-     id="defs1" />
-  <g
-     inkscape:label="图层 1"
-     inkscape:groupmode="layer"
-     id="layer1">
-    <rect
-       style="fill:#ffffff;stroke:#000000;stroke-width:0;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:1.3;stroke-dasharray:none;paint-order:fill markers stroke;fill-opacity:1"
-       id="rect1"
-       width="128"
-       height="128"
-       x="0"
-       y="0"
-       rx="7.772471"
-       ry="7.772471" />
-    <path
-       id="path101"
-       style="fill:#ffffff;fill-opacity:0.734285;stroke:#000000;stroke-width:4.27504;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:1.3;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
-       d="m 42.510282,81.796052 c 0,0 -7.224141,-5.638356 -10.043315,-9.338525 M 14.847106,81.97224 25.41902,71.576535 m 0.17619,-6.695549 2.819179,19.910444 M 11.675534,73.338532 38.281518,71.047931 M 43.567475,62.7666 34.40515,62.942814 M 34.22896,62.590425 33.524162,48.494537 m -18.500855,1.58577 17.972249,-1.409582 m -11.8053,-5.462154 0.352397,18.853251"
-       inkscape:label="杂" />
-    <path
-       id="path111"
-       style="fill:#ffffff;fill-opacity:0.734285;stroke:#000000;stroke-width:3.94824;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:1.3;stroke-dasharray:none;stroke-opacity:1;paint-order:fill markers stroke"
-       d="M 55.912937,82.876745 79.671596,81.412163 M 59.330273,75.391135 74.952411,74.089291 m -9.43837,-14.157553 1.139102,14.645756 m -8.299247,-7.160159 16.273048,-1.464569 m 0.650926,8.136525 0.325472,-14.808482 m -0.162747,0.162739 -17.900363,0.976379 m 0,-0.162738 1.952774,14.645756 m 12.042061,-21.154974 1.464576,-6.346492 m 0,-0.650928 -12.042063,0.650928 m -0.650918,6.509218 0.325459,-8.787441"
-       inkscape:label="鱼" />
-    <path
-       d="m 95.08569,51.121163 c -1.90515,0.116064 -3.64694,0.97349 -4.86738,2.391307 -1.34538,1.56738 -1.91476,3.733159 -1.59523,6.070852 0.40842,2.982962 2.1502,6.17135 5.13887,9.411078 0.63424,0.68546 1.08109,1.129773 1.98202,1.967071 1.58321,1.469144 3.01507,2.634638 4.9875,4.052454 0.70392,0.50905 2.09253,1.453525 2.61627,1.781734 l 0.15133,0.09594 0.22103,-0.140663 c 0.80481,-0.515755 2.23909,-1.504852 3.08956,-2.130057 3.21689,-2.364488 5.79232,-4.737902 7.70228,-7.100167 3.09676,-3.831409 4.4133,-7.562359 3.80549,-10.773058 -0.42043,-2.210414 -1.82588,-4.039057 -3.81992,-4.967887 -0.85767,-0.399664 -1.69132,-0.607312 -2.6355,-0.656431 -1.22285,-0.0647 -2.42648,0.178619 -3.57485,0.721182 -1.95561,0.922124 -3.58927,2.719503 -4.61752,5.081755 -0.072,0.165235 -0.1394,0.310355 -0.14895,0.319295 -0.0312,0.02902 -0.0648,-0.02679 -0.19458,-0.330457 -0.30752,-0.714476 -0.91055,-1.752718 -1.38382,-2.377871 -0.4853,-0.645282 -1.2661,-1.431214 -1.84749,-1.862143 -1.50155,-1.114153 -3.26013,-1.658924 -5.00914,-1.553996 z"
-       id="path1-4"
-       style="fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.00231605" />
-  </g>
-</svg>

docs/zh/README.md

@@ -1,101 +0,0 @@
-# SukiSU Ultra
-<img align='right' src='SukiSU-mini.svg' width='220px' alt="sukisu logo">
-
-
-[English](../README.md) | **简体中文** | [日本語](../ja/README.md) | [Türkçe](../tr/README.md)
-
-一个 Android 上基于内核的 root 方案，由 [`tiann/KernelSU`](https://github.com/tiann/KernelSU) 分叉而来，添加了一些有趣的变更。
-
-[![最新发行](https://img.shields.io/github/v/release/SukiSU-Ultra/SukiSU-Ultra?label=Release&logo=github)](https://github.com/tiann/KernelSU/releases/latest)
-[![频道](https://img.shields.io/badge/Follow-Telegram-blue.svg?logo=telegram)](https://t.me/Sukiksu)
-[![协议: GPL v2](https://img.shields.io/badge/License-GPL%20v2-orange.svg?logo=gnu)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)
-[![GitHub 协议](https://img.shields.io/github/license/tiann/KernelSU?logo=gnu)](/LICENSE)
-
-## 特性
-
-1. 基于内核的 `su` 和权限管理。
-2. 基于 [Magic Mount](https://github.com/5ec1cff/KernelSU) 的模块系统。
-3. [App Profile](https://kernelsu.org/zh_CN/guide/app-profile.html): 把 Root 权限关进笼子里。
-4. 支持 non-GKI 与 GKI 1.0。
-5. KPM 支持
-6. 可调整管理器外观，可自定义 susfs 配置。
-
-## 兼容状态
-
-- KernelSU 官方支持 GKI 2.0 的设备（内核版本 5.10 以上）。
-
-- 旧内核也是兼容的（最低 4.14+），不过需要自己编译内核。
-
-- 通过更多的反向移植，KernelSU 可以支持 3.x 内核（3.4-3.18）。
-
-- 目前支持架构 : `arm64-v8a`、`armeabi-v7a (bare)`、`X86_64`。
-
-## 安装指导
-
-查看 [`guide/installation.md`](guide/installation.md)
-
-## 集成指导
-
-查看 [`guide/how-to-integrate.md`](guide/how-to-integrate.md)
-
-## 参与翻译
-
-要将 SukiSU 翻译成您的语言，或完善现有的翻译，请使用 [Crowdin](https://crowdin.com/project/SukiSU-Ultra).
-
-## KPM 支持
-
-- 基于 KernelPatch 开发，移除了与 KernelSU 重复的功能。
-- 正在进行（WIP）：通过集成附加功能来扩展 APatch 兼容性，以确保跨不同实现的兼容性。
-
-**开源仓库**: [https://github.com/ShirkNeko/SukiSU_KernelPatch_patch](https://github.com/ShirkNeko/SukiSU_KernelPatch_patch)
-
-**KPM 模板**: [https://github.com/udochina/KPM-Build-Anywhere](https://github.com/udochina/KPM-Build-Anywhere)
-
-> [!Note]
->
-> 1. 需要 `CONFIG_KPM=y`
-> 2. Non-GKI 设备需要 `CONFIG_KALLSYMS=y` and `CONFIG_KALLSYMS_ALL=y`
-> 3. 对于低于 `4.19` 的内核，需要从 `4.19` 的 `set_memory.h` 进行反向移植。
-
-## 故障排除
-
-1. 卸载管理器后系统卡住？
-   卸载 _com.sony.playmemories.mobile_
-
-## 许可证
-
-- 目录 `kernel` 下所有文件为 [GPL-2.0-only](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html)。
-- 有动漫人物图片表情包的这些文件 `ic_launcher(?!.*alt.*).*` 的图像版权为[怡子曰曰](https://space.bilibili.com/10545509)所有，图像中的知识产权由[明风 OuO](https://space.bilibili.com/274939213)所有，矢量化由 @MiRinChan 完成，在使用这些文件之前，除了必须遵守 [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode.txt) 以外，还需要遵守向前两者索要使用这些艺术内容的授权。
-- 除上述文件及目录的其他部分均为 [GPL-3.0-or-later](https://www.gnu.org/licenses/gpl-3.0.html)。
-
-## 赞助
-
-- [ShirkNeko](https://afdian.com/a/shirkneko) (SukiSU 主要维护者)
-- [weishu](https://github.com/sponsors/tiann) (KernelSU 作者)
-
-## ShirkNeko 的赞助列表
-
-- [Ktouls](https://github.com/Ktouls) 非常感谢你给我带来的支持
-- [zaoqi123](https://github.com/zaoqi123) 请我喝奶茶也不错
-- [wswzgdg](https://github.com/wswzgdg) 非常感谢对此项目的支持
-- [yspbwx2010](https://github.com/yspbwx2010) 非常感谢
-- [DARKWWEE](https://github.com/DARKWWEE) 感谢老哥的 100 USDT
-- [Saksham Singla](https://github.com/TypeFlu) 网站的提供以及维护
-- [OukaroMF](https://github.com/OukaroMF) 网站域名捐赠
-
-## 鸣谢
-
-- [KernelSU](https://github.com/tiann/KernelSU): 上游
-- [MKSU](https://github.com/5ec1cff/KernelSU): 魔法坐骑支持
-- [RKSU](https://github.com/rsuntk/KernelsU): non-GKI 支持
-- [susfs](https://gitlab.com/simonpunk/susfs4ksu): 隐藏内核补丁以及用户空间模组的 KernelSU 附件
-- [KernelPatch](https://github.com/bmax121/KernelPatch): KernelPatch 是内核模块 APatch 实现的关键部分
-
-<details>
-<summary>KernelSU 的鸣谢</summary>
-
-- [kernel-assisted-superuser](https://git.zx2c4.com/kernel-assisted-superuser/about/)：KernelSU 的灵感。
-- [Magisk](https://github.com/topjohnwu/Magisk)：强大的 root 工具箱。
-- [genuine](https://github.com/brevent/genuine/)：apk v2 签名验证。
-- [Diamorphine](https://github.com/m0nad/Diamorphine)：一些 rootkit 技巧。
-</details>

docs/zh/guide/how-to-integrate.md

@@ -1,97 +0,0 @@
-# 集成指导
-
-SukiSU 可以集成到 GKI 和 non-GKI 内核中，并且已反向移植到 4.14 版本。
-
-<!-- 应该是 3.4 版本，但 backslashxx 的 syscall manual hook 无法在 SukiSU 中使用-->
-
-有些 OEM 定制可能导致多达 50% 的内核代码超出内核树代码，而非来自上游 Linux 内核或 ACK。因此，non-GKI 内核的定制特性导致了严重的内核碎片化，而且我们缺乏构建它们的通用方法。因此，我们无法提供 non-GKI 内核的启动映像。
-
-前提条件：开源的、可启动的内核。
-
-## Hook 方法
-
-1. **KPROBES hook:**
-
-   - GKI kernels 的默认 hook 方法。
-   - 需要 `# CONFIG_KSU_MANUAL_HOOK is not set`（未设定） & `CONFIG_KPROBES=y`
-   - 用作可加载的内核模块 (LKM).
-
-2. **Manual hook:**
-
-   <!-- - backslashxx's syscall manual hook: https://github.com/backslashxx/KernelSU/issues/5 (v1.5 version is not available at the moment, if you want to use it, please use v1.4 version, or standard KernelSU hooks)-->
-
-   - 需要 `CONFIG_KSU_MANUAL_HOOK=y`
-   - 需要 [`guide/how-to-integrate.md`](how-to-integrate.md)
-   - 需要 [https://github.com/~](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#manually-modify-the-kernel-source)
-
-3. **Tracepoint Hook:**
-
-   - 自 SukiSU commit [49b01aad](https://github.com/SukiSU-Ultra/SukiSU-Ultra/commit/49b01aad74bcca6dba5a8a2e053bb54b648eb124) 引入的 hook 方法
-   - 需要 `CONFIG_KSU_TRACEPOINT_HOOK=y`
-   - 需要 [`guide/tracepoint-hook.md`](tracepoint-hook.md)
-   
-<!-- This part refer to [rsuntk/KernelSU](https://github.com/rsuntk/KernelSU). -->
-
-如果您能够构建可启动内核，有两种方法可以将 KernelSU 集成到内核源代码中：
-
-1. 使用 `kprobe` 自动集成
-2. 手动集成
-
-## 与 kprobe 集成
-
-适用：
-
-- GKI 内核
-
-不适用：
-
-- non-GKI 内核
-
-KernelSU 使用 kprobe 机制来做内核的相关 hook，如果 _kprobe_ 可以在你编译的内核中正常运行，那么推荐用这个方法来集成。
-
-请参阅此文档 [https://github.com/~](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#integrate-with-kprobe)。虽然标题为“适用于 non-GKI”，但仅适用于 GKI。
-
-替换 KernelSU 添加到内核源代码树的步骤的执行命令为：
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-## 手动修改内核源代码
-
-适用：
-
-- GKI 内核
-- non-GKI 内核
-
-请参考此文档 [https://github.com/~ (non-GKI 内核集成)](https://github.com/tiann/KernelSU/blob/main/website/docs/guide/how-to-integrate-for-non-gki.md#manually-modify-the-kernel-source) 和 [https://github.com/~ (GKI 内核构建)](https://kernelsu.org/zh_CN/guide/how-to-build.html) 进行手动集成。虽然第一个链接的标题是“适用于 non-GKI”，但它也适用于 GKI。两者都可以正常工作。
-
-还有另一种集成方法，但是仍在开发中。
-
-<!-- 这是 backslashxx 的syscall manual hook，但目前无法使用。 -->
-
-将 KernelSU（SukiSU）添加到内核源代码树的步骤的运行命令将被替换为：
-
-### GKI 内核
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s main
-```
-
-### non-GKI 内核
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s nongki
-```
-
-### 带有 susfs 的 GKI / non-GKI 内核（实验）
-
-```sh
-curl -LSs "https://raw.githubusercontent.com/SukiSU-Ultra/SukiSU-Ultra/main/kernel/setup.sh" | bash -s susfs-{{branch}}
-```
-
-分支:
-
-- `main` (susfs-main)
-- `test` (susfs-test)
-- 版本号 (例如： susfs-1.5.7, 你需要在 [分支](https://github.com/SukiSU-Ultra/SukiSU-Ultra/branches) 里找到它)

docs/zh/guide/installation.md

@@ -1,34 +0,0 @@
-# 安装指导
-
-您可以前往 [KernelSU 文档 - 安装](https://kernelsu.org/guide/installation.html) 获取有关如何安装的参考，这里只是额外的说明。
-
-## 通过加载可加载内核模块 (LKM) 进行安装
-
-请参阅 [KernelSU 文档 - LKM 安装](https://kernelsu.org/guide/installation.html#lkm-installation)
-
-从 **Android™**（商标，意为获得 Google 移动服务的许可）12 开始，搭载内核版本 5.10 或更高版本的设备必须搭载 GKI 内核。因此你或许可以使用 LKM 模式。
-
-## 通过安装内核进行安装
-
-请参阅 [KernelSU 文档 - GKI 模式安装](https://kernelsu.org/guide/installation.html#gki-mode-installation)
-
-我们提供预编译的内核供您使用：
-
-- [ShirkNeko 内核](https://github.com/ShirkNeko/GKI_KernelSU_SUSFS)（添加了 ZRAM 压缩算法补丁、susfs 文件和 KPM 文件。适用于很多设备。）
-- [MiRinFork 内核](https://github.com/MiRinFork/GKI_SukiSU_SUSFS)（添加了 susfs 文件和 KPM 文件。最接近 GKI 的内核，适用于大多数设备。）
-
-虽然某些设备可以使用 LKM 模式安装，但无法使用 GKI 内核将其安装到设备上；因此，需要手动修改内核进行编译。例如：
-
-- 欧珀（一加、真我）
-- 魅族
-
-此外，我们还为您的 OnePlus 设备提供预编译的内核：
-
-- [ShirkNeko/Action_OnePlus_MKSU_SUSFS](https://github.com/ShirkNeko/Action_OnePlus_MKSU_SUSFS)（添加 ZRAM 压缩算法补丁、susfs 和 KPM。）
-
-使用上面的链接，Fork 到 GitHub Action，填写构建参数，进行编译，最后将 zip 文件以 AnyKernel3 后缀上传到 GitHub Action。
-
-> [!Note]
->
-> - 使用时，您只需填写版本号的前两部分，例如 `5.10`、`6.1`...
-> - 使用前请确保您了解处理器名称、内核版本等信息。

docs/zh/guide/tracepoint-hook.md

@@ -1,239 +0,0 @@
-# Tracepoint Hook 集成
-
-## 介绍
-
-自 commit [49b01aad](https://github.com/SukiSU-Ultra/SukiSU-Ultra/commit/49b01aad74bcca6dba5a8a2e053bb54b648eb124) 起，SukiSU 引入了 Tracepoint Hook
-
-该 Hook 理论上相比于 Kprobes Hook，性能开销更小，但次于 Manual Hook / Syscall Hook
-
-> [!NOTE]
-> 本教程参考了 [backslashxx/KernelSU#5](https://github.com/backslashxx/KernelSU/issues/5) 的 syscall hook v1.4 版本钩子，以及原版 KernelSU 的 [Manual Hook](https://kernelsu.org/guide/how-to-integrate-for-non-gki.html#manually-modify-the-kernel-source)
-
-## Guide
-
-### execve 钩子（`exec.c`）
-
-一般需要修改 `fs/exec.c` 的 `do_execve` 和 `compat_do_execve` 方法
-
-```patch
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -78,6 +78,10 @@
- #include <trace/hooks/sched.h>
- #endif
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- EXPORT_TRACEPOINT_SYMBOL_GPL(task_rename);
- 
- static int bprm_creds_from_file(struct linux_binprm *bprm);
-@@ -2037,6 +2041,9 @@ static int do_execve(struct filename *filename,
- {
- 	struct user_arg_ptr argv = { .ptr.native = __argv };
- 	struct user_arg_ptr envp = { .ptr.native = __envp };
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_execveat_hook((int *)AT_FDCWD, &filename, &argv, &envp, 0);
-+#endif
- 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
- }
- 
-@@ -2064,6 +2071,9 @@ static int compat_do_execve(struct filename *filename,
- 		.is_compat = true,
- 		.ptr.compat = __envp,
- 	};
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_execveat_hook((int *)AT_FDCWD, &filename, &argv, &envp, 0)); // 32-bit su and 32-on-64 support
-+#endif
- 	return do_execveat_common(AT_FDCWD, filename, argv, envp, 0);
- }
-```
-
-### faccessat 钩子 (`open.c`)
-
-一般需要修改 `/fs/open.c` 的 `do_faccessat` 方法 
-
-```patch
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -37,6 +37,10 @@
- #include "internal.h"
- #include <trace/hooks/syscall_check.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- int do_truncate(struct user_namespace *mnt_userns, struct dentry *dentry,
- 		loff_t length, unsigned int time_attrs, struct file *filp)
- {
-@@ -468,6 +472,9 @@ static long do_faccessat(int dfd, const char __user *filename, int mode, int fla
- 
- SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- {
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_faccessat_hook(&dfd, &filename, &mode, NULL);
-+#endif
- 	return do_faccessat(dfd, filename, mode, 0);
- }
-```
-
-如果没有 `do_faccessat` 方法，可以找 `faccessat` 的 SYSCALL 定义（对于早于 4.17 的内核）
-
-```patch
---- a/fs/open.c
-+++ b/fs/open.c
-@@ -31,6 +31,9 @@
- #include <linux/ima.h>
- #include <linux/dnotify.h>
- #include <linux/compat.h>
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
- 
- #include "internal.h"
- 
-@@ -369,6 +372,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
- 	int res;
- 	unsigned int lookup_flags = LOOKUP_FOLLOW;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_faccessat_hook(&dfd, &filename, &mode, NULL);
-+#endif
- 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
- 		return -EINVAL;
-```
-
-###  sys_read 钩子 ( `read_write.c` )
-
-需要修改 `fs/read_write.c` 的 `sys_read` 方法（4.19 及以上）
-
-```patch
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -25,6 +25,10 @@
- #include <linux/uaccess.h>
- #include <asm/unistd.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- const struct file_operations generic_ro_fops = {
- 	.llseek		= generic_file_llseek,
- 	.read_iter	= generic_file_read_iter,
-@@ -630,6 +634,9 @@ ssize_t ksys_read(unsigned int fd, char __user *buf, size_t count)
- 
- SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
- {
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_sys_read_hook(fd, &buf, &count);
-+#endif
- 	return ksys_read(fd, buf, count);
- }
-```
-
-或者是 `read` 的 SYSCALL 定义（4.14 及以下）
-
-```patch
---- a/fs/read_write.c
-+++ b/fs/read_write.c
-@@ -25,6 +25,11 @@
- #include <linux/uaccess.h>
- #include <asm/unistd.h>
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
-+
- const struct file_operations generic_ro_fops = {
- 	.llseek		= generic_file_llseek,
- 	.read_iter	= generic_file_read_iter,
-@@ -575,6 +580,9 @@ SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
- 
- 	if (f.file) {
- 		loff_t pos = file_pos_read(f.file);
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+		trace_ksu_trace_sys_read_hook(fd, &buf, &count);
-+#endif
- 		ret = vfs_read(f.file, buf, count, &pos);
- 		if (ret >= 0)
- 			file_pos_write(f.file, pos);
-```
-
-### fstatat 钩子 ( `stat.c` )
-
-需要修改 `stat.c` 的 `newfstatat` SYSCALL 定义
-
-如果需要 32 位支持，还需要修改 `statat64` SYSCALL 定义
-
-```patch
---- a/fs/stat.c
-+++ b/fs/stat.c
-@@ -24,6 +24,10 @@
- #include "internal.h"
- #include "mount.h"
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- /**
-  * generic_fillattr - Fill in the basic attributes from the inode struct
-  * @mnt_userns:	user namespace of the mount the inode was found from
-@@ -408,6 +412,10 @@ SYSCALL_DEFINE4(newfstatat, int, dfd, const char __user *, filename,
- 	struct kstat stat;
- 	int error;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_stat_hook(&dfd, &filename, &flag);
-+#endif
-+
- 	error = vfs_fstatat(dfd, filename, &stat, flag);
- 	if (error)
- 		return error;
-@@ -559,6 +567,10 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, const char __user *, filename,
- 	struct kstat stat;
- 	int error;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+	trace_ksu_trace_stat_hook(&dfd, &filename, &flag); /* 32-bit su support */
-+#endif
-+
- 	error = vfs_fstatat(dfd, filename, &stat, flag);
- 	if (error)
- 		return error;
-```
-
-### input 钩子 (`input.c` ,用于进入KSU系的内置安全模式)
-
-需要修改 `drivers/input/input.c` 的 `input_event` 方法，而不是 `input_handle_event`
-
-```patch
---- a/drivers/input/input.c
-+++ b/drivers/input/input.c
-@@ -26,6 +26,10 @@
- #include "input-compat.h"
- #include "input-poller.h"
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+#include <../../drivers/kernelsu/ksu_trace.h>
-+#endif
-+
- MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
- MODULE_DESCRIPTION("Input core");
- MODULE_LICENSE("GPL");
-@@ -451,6 +455,10 @@ void input_event(struct input_dev *dev,
- {
- 	unsigned long flags;
- 
-+#if defined(CONFIG_KSU) && defined(CONFIG_KSU_TRACEPOINT_HOOK)
-+    trace_ksu_trace_input_hook(&type, &code, &value);
-+#endif
-+
- 	if (is_event_supported(type, dev->evbit, EV_MAX)) {
- 
- 		spin_lock_irqsave(&dev->event_lock, flags);
-```

kernel/.clang-format

@@ -56,8 +56,8 @@ ColumnLimit: 80
 CommentPragmas: '^ IWYU pragma:'
 #CompactNamespaces: false # Unknown to clang-format-4.0
 ConstructorInitializerAllOnOneLineOrOnePerLine: false
-ConstructorInitializerIndentWidth: 4
-ContinuationIndentWidth: 4
+ConstructorInitializerIndentWidth: 8
+ContinuationIndentWidth: 8
 Cpp11BracedListStyle: false
 DerivePointerAlignment: false
 DisableFormat: false
@@ -501,7 +501,7 @@ IncludeCategories:
 IncludeIsMainRegex: '(Test)?$'
 IndentCaseLabels: false
 #IndentPPDirectives: None # Unknown to clang-format-5.0
-IndentWidth: 4
+IndentWidth: 8
 IndentWrappedFunctionNames: false
 JavaScriptQuotes: Leave
 JavaScriptWrapImports: true
@@ -511,7 +511,7 @@ MacroBlockEnd: ''
 MaxEmptyLinesToKeep: 1
 NamespaceIndentation: None
 #ObjCBinPackProtocolList: Auto # Unknown to clang-format-5.0
-ObjCBlockIndentWidth: 4
+ObjCBlockIndentWidth: 8
 ObjCSpaceAfterProperty: true
 ObjCSpaceBeforeProtocolList: true
 
@@ -543,6 +543,6 @@ SpacesInCStyleCastParentheses: false
 SpacesInParentheses: false
 SpacesInSquareBrackets: false
 Standard: Cpp03
-TabWidth: 4
-UseTab: Never
+TabWidth: 8
+UseTab: Always
 ...

kernel/.gitignore

@@ -1,22 +0,0 @@
-.cache/
-.thinlto-cache/
-compile_commands.json
-*.ko
-*.o
-*.mod
-*.lds
-*.mod.o
-.*.o*
-.*.mod*
-*.ko*
-*.mod.c
-*.symvers*
-*.order
-.*.ko.cmd
-.tmp_versions/
-libs/
-obj/
-
-CLAUDE.md
-.ddk-version
-.vscode/settings.json

kernel/.vscode/c_cpp_properties.json

@@ -1,11 +0,0 @@
-{
-    "configurations": [
-        {
-            "name": "Linux",
-            "cStandard": "c11",
-            "intelliSenseMode": "gcc-arm64",
-            "compileCommands": "${workspaceFolder}/compile_commands.json"
-        }
-    ],
-    "version": 4
-}

kernel/.vscode/generate_compdb.py

@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-
-from __future__ import print_function, division
-
-import argparse
-import fnmatch
-import functools
-import json
-import math
-import multiprocessing
-import os
-import re
-import sys
-
-
-CMD_VAR_RE = re.compile(r'^\s*(?:saved)?cmd_(\S+)\s*:=\s*(.+)\s*$', re.MULTILINE)
-SOURCE_VAR_RE = re.compile(r'^\s*source_(\S+)\s*:=\s*(.+)\s*$', re.MULTILINE)
-
-
-def print_progress_bar(progress):
-    progress_bar = '[' + '|' * int(50 * progress) + '-' * int(50 * (1.0 - progress)) + ']'
-    print('\r', progress_bar, "{0:.1%}".format(progress), end='\r', file=sys.stderr)
-
-
-def parse_cmd_file(out_dir, cmdfile_path):
-    with open(cmdfile_path, 'r') as cmdfile:
-        cmdfile_content = cmdfile.read()
-
-    commands = { match.group(1): match.group(2) for match in CMD_VAR_RE.finditer(cmdfile_content) }
-    sources = { match.group(1): match.group(2) for match in SOURCE_VAR_RE.finditer(cmdfile_content) }
-
-    return [{
-            'directory': out_dir,
-            'command': commands[o_file_name],
-            'file': source,
-            'output': o_file_name
-        } for o_file_name, source in sources.items()]
-
-
-def gen_compile_commands(cmd_file_search_path, out_dir):
-    print("Building *.o.cmd file list...", file=sys.stderr)
-
-    out_dir = os.path.abspath(out_dir)
-
-    if not cmd_file_search_path:
-        cmd_file_search_path = [out_dir]
-
-    cmd_files = []
-    for search_path in cmd_file_search_path:
-        if (os.path.isdir(search_path)):
-            for cur_dir, subdir, files in os.walk(search_path):
-                cmd_files.extend(os.path.join(cur_dir, cmdfile_name) for cmdfile_name in fnmatch.filter(files, '*.o.cmd'))
-        else:
-            cmd_files.extend(search_path)
-
-    if not cmd_files:
-        print("No *.o.cmd files found in", ", ".join(cmd_file_search_path), file=sys.stderr)
-        return
-
-    print("Parsing *.o.cmd files...", file=sys.stderr)
-
-    n_processed = 0
-    print_progress_bar(0)
-
-    compdb = []
-    pool = multiprocessing.Pool()
-    try:
-        for compdb_chunk in pool.imap_unordered(functools.partial(parse_cmd_file, out_dir), cmd_files, chunksize=int(math.sqrt(len(cmd_files)))):
-            compdb.extend(compdb_chunk)
-            n_processed += 1
-            print_progress_bar(n_processed / len(cmd_files))
-
-    finally:
-        pool.terminate()
-        pool.join()
-
-    print(file=sys.stderr)
-    print("Writing compile_commands.json...", file=sys.stderr)
-
-    with open('compile_commands.json', 'w') as compdb_file:
-        json.dump(compdb, compdb_file, indent=1)
-
-
-def main():
-    cmd_parser = argparse.ArgumentParser()
-    cmd_parser.add_argument('-O', '--out-dir', type=str, default=os.getcwd(), help="Build output directory")
-    cmd_parser.add_argument('cmd_file_search_path', nargs='*', help="*.cmd file search path")
-    gen_compile_commands(**vars(cmd_parser.parse_args()))
-
-
-if __name__ == '__main__':
-    main()

kernel/.vscode/tasks.json

@@ -1,16 +0,0 @@
-{
-    // See https://go.microsoft.com/fwlink/?LinkId=733558
-    // for the documentation about the tasks.json format
-    "version": "2.0.0",
-    "tasks": [
-        {
-            "label": "Generate compile_commands.json",
-            "type": "process",
-            "command": "python",
-            "args": [
-                "${workspaceRoot}/.vscode/generate_compdb.py"
-            ],
-            "problemMatcher": []
-        }
-    ]
-}

kernel/Kconfig

@@ -2,6 +2,7 @@ menu "KernelSU"
 
 config KSU
 	tristate "KernelSU function support"
+	depends on OVERLAY_FS
 	default y
 	help
 	  Enable kernel-level root privileges on Android System.
@@ -15,28 +16,20 @@ config KSU_DEBUG
 	help
 	  Enable KernelSU debug mode.
 
-config KSU_MANUAL_SU
-    bool "Use manual su"
-    depends on KSU
-    default y
+config KSU_HOOK
+	bool "Enable KernelSU Hook"
+	default n
 	help
-      Use manual su and authorize the corresponding command line and application via prctl
+	  This option enables the KernelSU Hook feature. If enabled, it will
+	  override the kernel version check and enable the hook functionality.
 
 config KPM
 	bool "Enable SukiSU KPM"
-    depends on KSU && 64BIT
 	default n
 	help
 	  Enabling this option will activate the KPM feature of SukiSU.
 	  This option is suitable for scenarios where you need to force KPM to be enabled.
 	  but it may affect system stability.
-    select KALLSYMS
-    select KALLSYMS_ALL
 
-config KSU_MANUAL_HOOK
-    bool "Hook KernelSU manually"
-    depends on KSU != m
-    help
-      If enabled, Hook required KernelSU syscalls with manually-patched function.
 
 endmenu

kernel/Makefile

@@ -1,29 +1,12 @@
 kernelsu-objs := ksu.o
 kernelsu-objs += allowlist.o
-kernelsu-objs += app_profile.o
-kernelsu-objs += dynamic_manager.o
 kernelsu-objs += apk_sign.o
 kernelsu-objs += sucompat.o
-kernelsu-objs += syscall_hook_manager.o
 kernelsu-objs += throne_tracker.o
-kernelsu-objs += pkg_observer.o
-kernelsu-objs += throne_tracker.o
-kernelsu-objs += umount_manager.o
-kernelsu-objs += setuid_hook.o
-kernelsu-objs += kernel_umount.o
-kernelsu-objs += supercalls.o
-kernelsu-objs += feature.o
+kernelsu-objs += core_hook.o
 kernelsu-objs += ksud.o
 kernelsu-objs += embed_ksud.o
-kernelsu-objs += seccomp_cache.o
-kernelsu-objs += file_wrapper.o
-kernelsu-objs += throne_comm.o
-kernelsu-objs += sulog.o
-
-ifeq ($(CONFIG_KSU_MANUAL_SU), y)
-ccflags-y += -DCONFIG_KSU_MANUAL_SU
-kernelsu-objs += manual_su.o
-endif
+kernelsu-objs += kernel_compat.o
 
 kernelsu-objs += selinux/selinux.o
 kernelsu-objs += selinux/sepolicy.o
@@ -35,138 +18,49 @@ obj-$(CONFIG_KSU) += kernelsu.o
 
 obj-$(CONFIG_KPM) += kpm/
 
-REPO_OWNER := SukiSU-Ultra
-REPO_NAME := SukiSU-Ultra
-REPO_BRANCH := main
-KSU_VERSION_API := 4.0.0
-
-GIT_BIN := /usr/bin/env PATH="$$PATH":/usr/bin:/usr/local/bin git
-CURL_BIN := /usr/bin/env PATH="$$PATH":/usr/bin:/usr/local/bin curl
-
-KDIR := $(KDIR)
-MDIR := $(realpath $(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
-
-ifneq ($(KDIR),)
-$(info -- KDIR: $(KDIR))
-$(info -- MDIR: $(MDIR))
-endif
-
-KSU_GITHUB_VERSION := $(shell $(CURL_BIN) -s "https://api.github.com/repos/$(REPO_OWNER)/$(REPO_NAME)/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')
-KSU_GITHUB_VERSION_COMMIT := $(shell $(CURL_BIN) -sI "https://api.github.com/repos/$(REPO_OWNER)/$(REPO_NAME)/commits?sha=$(REPO_BRANCH)&per_page=1" | grep -i "link:" | sed -n 's/.*page=\([0-9]*\)>; rel="last".*/\1/p')
-
-ifeq ($(findstring $(srctree),$(src)),$(srctree))
-  KSU_SRC := $(src)
-else
-  KSU_SRC := $(srctree)/$(src)
-endif
-
-ifneq ($(shell test -e $(KSU_SRC)/../.git && echo "in-tree"),in-tree)
-  KSU_SRC := $(MDIR)
-endif
-
-LOCAL_GIT_EXISTS := $(shell test -e $(KSU_SRC)/../.git && echo 1 || echo 0)
-
-define get_ksu_version_full
-v$1-$(shell cd $(KSU_SRC); $(GIT_BIN) rev-parse --short=8 HEAD)@$(shell cd $(KSU_SRC); $(GIT_BIN) rev-parse --abbrev-ref HEAD)
-endef
-
-ifeq ($(KSU_GITHUB_VERSION_COMMIT),)
-  ifeq ($(LOCAL_GIT_EXISTS),1)
-    $(shell cd $(KSU_SRC); [ -f ../.git/shallow ] && $(GIT_BIN) fetch --unshallow)
-    KSU_LOCAL_VERSION := $(shell cd $(KSU_SRC); $(GIT_BIN) rev-list --count $(REPO_BRANCH))
-    KSU_VERSION := $(shell expr 40000 + $(KSU_LOCAL_VERSION) - 2815)
-    $(info -- $(REPO_NAME) version (local .git): $(KSU_VERSION))
-  else
-    KSU_VERSION := 13000
-    $(warning -- Could not fetch version online or via local .git! Using fallback version: $(KSU_VERSION))
-  endif
-else
-  KSU_VERSION := $(shell expr 40000 + $(KSU_GITHUB_VERSION_COMMIT) - 2815)
-  $(info -- $(REPO_NAME) version (GitHub): $(KSU_VERSION))
-endif
-
-ifeq ($(KSU_GITHUB_VERSION),)
-  ifeq ($(LOCAL_GIT_EXISTS),1)
-    $(shell cd $(KSU_SRC); [ -f ../.git/shallow ] && $(GIT_BIN) fetch --unshallow)
-    KSU_VERSION_FULL := $(call get_ksu_version_full,$(KSU_VERSION_API))
-    $(info -- $(REPO_NAME) version (local .git): $(KSU_VERSION_FULL))
-    $(info -- $(REPO_NAME) Formatted version (local .git): $(KSU_VERSION))
-  else
-    KSU_VERSION_FULL := v$(KSU_VERSION_API)-$(REPO_NAME)-unknown@unknown
-    $(warning -- $(REPO_NAME) version: $(KSU_VERSION_FULL))
-  endif
-else
-  $(shell cd $(KSU_SRC); [ -f ../.git/shallow ] && $(GIT_BIN) fetch --unshallow)
-  KSU_VERSION_FULL := $(call get_ksu_version_full,$(KSU_GITHUB_VERSION))
-  $(info -- $(REPO_NAME) version (Github): $(KSU_VERSION_FULL))
-endif
 
+# .git is a text file while the module is imported by 'git submodule add'.
+ifeq ($(shell test -e $(srctree)/$(src)/../.git; echo $$?),0)
+$(shell cd $(srctree)/$(src); /usr/bin/env PATH="$$PATH":/usr/bin:/usr/local/bin [ -f ../.git/shallow ] && git fetch --unshallow)
+KSU_GIT_VERSION := $(shell cd $(srctree)/$(src); /usr/bin/env PATH="$$PATH":/usr/bin:/usr/local/bin git rev-list --count main)
+# ksu_version: major * 10000 + git version + 606 for historical reasons
+$(eval KSU_VERSION=$(shell expr 10000 + $(KSU_GIT_VERSION) + 606))
+$(info -- SukiSU version: $(KSU_VERSION))
 ccflags-y += -DKSU_VERSION=$(KSU_VERSION)
-ccflags-y += -DKSU_VERSION_FULL=\"$(KSU_VERSION_FULL)\"
-
-# Custom Signs
-ifdef KSU_EXPECTED_SIZE
-ccflags-y += -DEXPECTED_SIZE=$(KSU_EXPECTED_SIZE)
-$(info -- Custom KernelSU Manager signature size: $(KSU_EXPECTED_SIZE))
+else # If there is no .git file, the default version will be passed.
+$(warning "KSU_GIT_VERSION not defined! It is better to make SukiSU a git submodule!")
+ccflags-y += -DKSU_VERSION=12800
 endif
 
-ifdef KSU_EXPECTED_HASH
-ccflags-y += -DEXPECTED_HASH=\"$(KSU_EXPECTED_HASH)\"
-$(info -- Custom KernelSU Manager signature hash: $(KSU_EXPECTED_HASH))
+ifndef KSU_EXPECTED_SIZE
+KSU_EXPECTED_SIZE := 0x35c
+endif
+
+ifndef KSU_EXPECTED_HASH
+KSU_EXPECTED_HASH := 947ae944f3de4ed4c21a7e4f7953ecf351bfa2b36239da37a34111ad29993eef
 endif
 
 ifdef KSU_MANAGER_PACKAGE
 ccflags-y += -DKSU_MANAGER_PACKAGE=\"$(KSU_MANAGER_PACKAGE)\"
-$(info -- SukiSU Manager package name: $(KSU_MANAGER_PACKAGE))
-endif
-
-ifeq ($(CONFIG_KSU_MANUAL_HOOK), y)
-ccflags-y += -DKSU_MANUAL_HOOK
-$(info -- SukiSU: KSU_MANUAL_HOOK Temporarily discontinued）)
-else
-ccflags-y += -DKSU_KPROBES_HOOK
-ccflags-y += -DKSU_TP_HOOK
-$(info -- SukiSU: KSU_TRACEPOINT_HOOK)
+$(info -- KernelSU Manager package name: $(KSU_MANAGER_PACKAGE))
 endif
 
+$(info -- KernelSU Manager signature size: $(KSU_EXPECTED_SIZE))
+$(info -- KernelSU Manager signature hash: $(KSU_EXPECTED_HASH))
+$(info -- Supported Unofficial Manager: 5ec1cff (GKI) ShirkNeko udochina (GKI and KPM))
 KERNEL_VERSION := $(VERSION).$(PATCHLEVEL)
-KERNEL_TYPE := Non-GKI
-# Check for GKI 2.0 (5.10+ or 6.x+)
-ifneq ($(shell test \( $(VERSION) -ge 5 -a $(PATCHLEVEL) -ge 10 \) -o $(VERSION) -ge 6; echo $$?),0)
-# Check for GKI 1.0 (5.4)
-ifeq ($(shell test $(VERSION)-$(PATCHLEVEL) = 5-4; echo $$?),0)
-KERNEL_TYPE := GKI 1.0
-endif
-else
-KERNEL_TYPE := GKI 2.0
-endif
 $(info -- KERNEL_VERSION: $(KERNEL_VERSION))
-$(info -- KERNEL_TYPE: $(KERNEL_TYPE))
-
 ifeq ($(CONFIG_KPM),y)
 $(info -- KPM is enabled)
 else
 $(info -- KPM is disabled)
 endif
 
-# Check new vfs_getattr()
-ifeq ($(shell grep -A1 "^int vfs_getattr" $(srctree)/fs/stat.c | grep -q "query_flags" ; echo $$?),0)
-ccflags-y += -DKSU_HAS_NEW_VFS_GETATTR
-endif
 
-# Function proc_ops check
-ifeq ($(shell grep -q "struct proc_ops " $(srctree)/include/linux/proc_fs.h; echo $$?),0)
-ccflags-y += -DKSU_COMPAT_HAS_PROC_OPS
-endif
+ccflags-y += -DEXPECTED_SIZE=$(KSU_EXPECTED_SIZE)
+ccflags-y += -DEXPECTED_HASH=\"$(KSU_EXPECTED_HASH)\"
 
-ccflags-y += -Wno-strict-prototypes -Wno-int-conversion -Wno-gcc-compat -Wno-missing-prototypes
-ccflags-y += -Wno-declaration-after-statement -Wno-unused-function -Wno-unused-variable
-
-all:
-	make -C $(KDIR) M=$(MDIR) modules
-compdb:
-	python3 $(MDIR)/.vscode/generate_compdb.py -O $(KDIR) $(MDIR)
-clean:
-	make -C $(KDIR) M=$(MDIR) clean
+ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion -Wno-gcc-compat
+ccflags-y += -Wno-declaration-after-statement -Wno-unused-function
 
 # Keep a new line here!! Because someone may append config

kernel/allowlist.c

@@ -1,5 +1,3 @@
-#include <linux/mutex.h>
-#include <linux/task_work.h>
 #include <linux/capability.h>
 #include <linux/compiler.h>
 #include <linux/fs.h>
@@ -10,16 +8,14 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/version.h>
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)
 #include <linux/compiler_types.h>
-#endif
 
+#include "ksu.h"
 #include "klog.h" // IWYU pragma: keep
-#include "ksud.h"
 #include "selinux/selinux.h"
+#include "kernel_compat.h"
 #include "allowlist.h"
 #include "manager.h"
-#include "syscall_hook_manager.h"
 
 #define FILE_MAGIC 0x7f4b5355 // ' KSU', u32
 #define FILE_FORMAT_VERSION 3 // u32
@@ -33,10 +29,7 @@ static DEFINE_MUTEX(allowlist_mutex);
 static struct root_profile default_root_profile;
 static struct non_root_profile default_non_root_profile;
 
-void persistent_allow_list(void);
-
-static int allow_list_arr[PAGE_SIZE / sizeof(int)] __read_mostly
-    __aligned(PAGE_SIZE);
+static int allow_list_arr[PAGE_SIZE / sizeof(int)] __read_mostly __aligned(PAGE_SIZE);
 static int allow_list_pointer __read_mostly = 0;
 
 static void remove_uid_from_arr(uid_t uid)
@@ -47,7 +40,7 @@ static void remove_uid_from_arr(uid_t uid)
 	if (allow_list_pointer == 0)
 		return;
 
-    temp_arr = kzalloc(sizeof(allow_list_arr), GFP_KERNEL);
+	temp_arr = kmalloc(sizeof(allow_list_arr), GFP_KERNEL);
 	if (temp_arr == NULL) {
 		pr_err("%s: unable to allocate memory\n", __func__);
 		return;
@@ -68,7 +61,7 @@ static void remove_uid_from_arr(uid_t uid)
 	kfree(temp_arr);
 }
 
-static void init_default_profiles(void)
+static void init_default_profiles()
 {
 	kernel_cap_t full_cap = CAP_FULL_SET;
 
@@ -97,6 +90,11 @@ static uint8_t allow_list_bitmap[PAGE_SIZE] __read_mostly __aligned(PAGE_SIZE);
 
 #define KERNEL_SU_ALLOWLIST "/data/adb/ksu/.allowlist"
 
+static struct work_struct ksu_save_work;
+static struct work_struct ksu_load_work;
+
+bool persistent_allow_list(void);
+
 void ksu_show_allow_list(void)
 {
 	struct perm_data *p = NULL;
@@ -110,7 +108,7 @@ void ksu_show_allow_list(void)
 }
 
 #ifdef CONFIG_KSU_DEBUG
-static void ksu_grant_root_to_shell(void)
+static void ksu_grant_root_to_shell()
 {
 	struct app_profile profile = {
 		.version = KSU_APP_PROFILE_VER,
@@ -118,8 +116,7 @@ static void ksu_grant_root_to_shell(void)
 		.current_uid = 2000,
 	};
 	strcpy(profile.key, "com.android.shell");
-    strcpy(profile.rp_config.profile.selinux_domain,
-           KSU_DEFAULT_SELINUX_DOMAIN);
+	strcpy(profile.rp_config.profile.selinux_domain, KSU_DEFAULT_SELINUX_DOMAIN);
 	ksu_set_app_profile(&profile, false);
 }
 #endif
@@ -145,8 +142,7 @@ exit:
 	return found;
 }
 
-static inline bool forbid_system_uid(uid_t uid)
-{
+static inline bool forbid_system_uid(uid_t uid) {
 	#define SHELL_UID 2000
 	#define SYSTEM_UID 1000
 	return uid < SHELL_UID && uid != SYSTEM_UID;
@@ -200,7 +196,7 @@ bool ksu_set_app_profile(struct app_profile *profile, bool persist)
 	}
 
 	// not found, alloc a new node!
-    p = (struct perm_data *)kzalloc(sizeof(struct perm_data), GFP_KERNEL);
+	p = (struct perm_data *)kmalloc(sizeof(struct perm_data), GFP_KERNEL);
 	if (!p) {
 		pr_err("ksu_set_app_profile alloc failed\n");
 		return false;
@@ -222,11 +218,9 @@ bool ksu_set_app_profile(struct app_profile *profile, bool persist)
 out:
 	if (profile->current_uid <= BITMAP_UID_MAX) {
 		if (profile->allow_su)
-            allow_list_bitmap[profile->current_uid / BITS_PER_BYTE] |=
-                1 << (profile->current_uid % BITS_PER_BYTE);
+			allow_list_bitmap[profile->current_uid / BITS_PER_BYTE] |= 1 << (profile->current_uid % BITS_PER_BYTE);
 		else
-            allow_list_bitmap[profile->current_uid / BITS_PER_BYTE] &=
-                ~(1 << (profile->current_uid % BITS_PER_BYTE));
+			allow_list_bitmap[profile->current_uid / BITS_PER_BYTE] &= ~(1 << (profile->current_uid % BITS_PER_BYTE));
 	} else {
 		if (profile->allow_su) {
 			/*
@@ -258,11 +252,8 @@ out:
 		       sizeof(default_root_profile));
 	}
 
-    if (persist) {
+	if (persist)
 		persistent_allow_list();
-        // FIXME: use a new flag
-        ksu_mark_running_process();
-    }
 
 	return result;
 }
@@ -271,20 +262,23 @@ bool __ksu_is_allow_uid(uid_t uid)
 {
 	int i;
 
+	if (unlikely(uid == 0)) {
+		// already root, but only allow our domain.
+		return is_ksu_domain();
+	}
+
 	if (forbid_system_uid(uid)) {
 		// do not bother going through the list if it's system
 		return false;
 	}
 
-    if (likely(ksu_is_manager_uid_valid()) &&
-        unlikely(ksu_get_manager_uid() == uid)) {
+	if (likely(ksu_is_manager_uid_valid()) && unlikely(ksu_get_manager_uid() == uid)) {
 		// manager is always allowed!
 		return true;
 	}
 
 	if (likely(uid <= BITMAP_UID_MAX)) {
-        return !!(allow_list_bitmap[uid / BITS_PER_BYTE] &
-                  (1 << (uid % BITS_PER_BYTE)));
+		return !!(allow_list_bitmap[uid / BITS_PER_BYTE] & (1 << (uid % BITS_PER_BYTE)));
 	} else {
 		for (i = 0; i < allow_list_pointer; i++) {
 			if (allow_list_arr[i] == uid)
@@ -295,20 +289,10 @@ bool __ksu_is_allow_uid(uid_t uid)
 	return false;
 }
 
-bool __ksu_is_allow_uid_for_current(uid_t uid)
-{
-    if (unlikely(uid == 0)) {
-        // already root, but only allow our domain.
-        return is_ksu_domain();
-    }
-    return __ksu_is_allow_uid(uid);
-}
-
 bool ksu_uid_should_umount(uid_t uid)
 {
 	struct app_profile profile = { .current_uid = uid };
-    if (likely(ksu_is_manager_uid_valid()) &&
-        unlikely(ksu_get_manager_uid() == uid)) {
+	if (likely(ksu_is_manager_uid_valid()) && unlikely(ksu_get_manager_uid() == uid)) {
 		// we should not umount on manager!
 		return false;
 	}
@@ -365,7 +349,7 @@ bool ksu_get_allow_list(int *array, int *length, bool allow)
 	return true;
 }
 
-static void do_persistent_allow_list(struct callback_head *_cb)
+void do_save_allow_list(struct work_struct *work)
 {
 	u32 magic = FILE_MAGIC;
 	u32 version = FILE_FORMAT_VERSION;
@@ -373,64 +357,41 @@ static void do_persistent_allow_list(struct callback_head *_cb)
 	struct list_head *pos = NULL;
 	loff_t off = 0;
 
-    mutex_lock(&allowlist_mutex);
 	struct file *fp =
-        filp_open(KERNEL_SU_ALLOWLIST, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+		ksu_filp_open_compat(KERNEL_SU_ALLOWLIST, O_WRONLY | O_CREAT | O_TRUNC, 0644);
 	if (IS_ERR(fp)) {
 		pr_err("save_allow_list create file failed: %ld\n", PTR_ERR(fp));
-        goto unlock;
+		return;
 	}
 
 	// store magic and version
-    if (kernel_write(fp, &magic, sizeof(magic), &off) != sizeof(magic)) {
+	if (ksu_kernel_write_compat(fp, &magic, sizeof(magic), &off) !=
+	    sizeof(magic)) {
 		pr_err("save_allow_list write magic failed.\n");
-        goto close_file;
+		goto exit;
 	}
 
-    if (kernel_write(fp, &version, sizeof(version), &off) != sizeof(version)) {
+	if (ksu_kernel_write_compat(fp, &version, sizeof(version), &off) !=
+	    sizeof(version)) {
 		pr_err("save_allow_list write version failed.\n");
-        goto close_file;
+		goto exit;
 	}
 
 	list_for_each (pos, &allow_list) {
 		p = list_entry(pos, struct perm_data, list);
 		pr_info("save allow list, name: %s uid :%d, allow: %d\n",
-                p->profile.key, p->profile.current_uid, p->profile.allow_su);
+			p->profile.key, p->profile.current_uid,
+			p->profile.allow_su);
 
-        kernel_write(fp, &p->profile, sizeof(p->profile), &off);
+		ksu_kernel_write_compat(fp, &p->profile, sizeof(p->profile),
+					&off);
 	}
 
-close_file:
+exit:
 	filp_close(fp, 0);
-unlock:
-    mutex_unlock(&allowlist_mutex);
-    kfree(_cb);
 }
 
-void persistent_allow_list()
-{
-    struct task_struct *tsk;
-
-    tsk = get_pid_task(find_vpid(1), PIDTYPE_PID);
-    if (!tsk) {
-        pr_err("save_allow_list find init task err\n");
-        return;
-    }
-
-    struct callback_head *cb =
-        kzalloc(sizeof(struct callback_head), GFP_KERNEL);
-    if (!cb) {
-        pr_err("save_allow_list alloc cb err\b");
-        goto put_task;
-    }
-    cb->func = do_persistent_allow_list;
-    task_work_add(tsk, cb, TWA_RESUME);
-
-put_task:
-    put_task_struct(tsk);
-}
-
-void ksu_load_allow_list()
+void do_load_allow_list(struct work_struct *work)
 {
 	loff_t off = 0;
 	ssize_t ret = 0;
@@ -444,20 +405,22 @@ void ksu_load_allow_list()
 #endif
 
 	// load allowlist now!
-    fp = filp_open(KERNEL_SU_ALLOWLIST, O_RDONLY, 0);
+	fp = ksu_filp_open_compat(KERNEL_SU_ALLOWLIST, O_RDONLY, 0);
 	if (IS_ERR(fp)) {
 		pr_err("load_allow_list open file failed: %ld\n", PTR_ERR(fp));
 		return;
 	}
 
 	// verify magic
-    if (kernel_read(fp, &magic, sizeof(magic), &off) != sizeof(magic) ||
+	if (ksu_kernel_read_compat(fp, &magic, sizeof(magic), &off) !=
+		    sizeof(magic) ||
 	    magic != FILE_MAGIC) {
 		pr_err("allowlist file invalid: %d!\n", magic);
 		goto exit;
 	}
 
-    if (kernel_read(fp, &version, sizeof(version), &off) != sizeof(version)) {
+	if (ksu_kernel_read_compat(fp, &version, sizeof(version), &off) !=
+	    sizeof(version)) {
 		pr_err("allowlist read version: %d failed\n", version);
 		goto exit;
 	}
@@ -467,15 +430,16 @@ void ksu_load_allow_list()
 	while (true) {
 		struct app_profile profile;
 
-        ret = kernel_read(fp, &profile, sizeof(profile), &off);
+		ret = ksu_kernel_read_compat(fp, &profile, sizeof(profile),
+					     &off);
 
 		if (ret <= 0) {
 			pr_info("load_allow_list read err: %zd\n", ret);
 			break;
 		}
 
-        pr_info("load_allow_uid, name: %s, uid: %d, allow: %d\n", profile.key,
-                profile.current_uid, profile.allow_su);
+		pr_info("load_allow_uid, name: %s, uid: %d, allow: %d\n",
+			profile.key, profile.current_uid, profile.allow_su);
 		ksu_set_app_profile(&profile, false);
 	}
 
@@ -484,17 +448,11 @@ exit:
 	filp_close(fp, 0);
 }
 
-void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *),
-                         void *data)
+void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *), void *data)
 {
 	struct perm_data *np = NULL;
 	struct perm_data *n = NULL;
 
-    if (!ksu_boot_completed) {
-        pr_info("boot not completed, skip prune\n");
-        return;
-    }
-
 	bool modified = false;
 	// TODO: use RCU!
 	mutex_lock(&allowlist_mutex);
@@ -508,8 +466,7 @@ void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *),
 			pr_info("prune uid: %d, package: %s\n", uid, package);
 			list_del(&np->list);
 			if (likely(uid <= BITMAP_UID_MAX)) {
-                allow_list_bitmap[uid / BITS_PER_BYTE] &=
-                    ~(1 << (uid % BITS_PER_BYTE));
+				allow_list_bitmap[uid / BITS_PER_BYTE] &= ~(1 << (uid % BITS_PER_BYTE));
 			}
 			remove_uid_from_arr(uid);
 			smp_mb();
@@ -523,6 +480,17 @@ void ksu_prune_allowlist(bool (*is_uid_valid)(uid_t, char *, void *),
 	}
 }
 
+// make sure allow list works cross boot
+bool persistent_allow_list(void)
+{
+	return ksu_queue_work(&ksu_save_work);
+}
+
+bool ksu_load_allow_list(void)
+{
+	return ksu_queue_work(&ksu_load_work);
+}
+
 void ksu_allowlist_init(void)
 {
 	int i;
@@ -535,6 +503,9 @@ void ksu_allowlist_init(void)
 
 	INIT_LIST_HEAD(&allow_list);
 
+	INIT_WORK(&ksu_save_work, do_save_allow_list);
+	INIT_WORK(&ksu_load_work, do_load_allow_list);
+
 	init_default_profiles();
 }
 
@@ -543,6 +514,8 @@ void ksu_allowlist_exit(void)
 	struct perm_data *np = NULL;
 	struct perm_data *n = NULL;
 
+	do_save_allow_list(NULL);
+
 	// free allowlist
 	mutex_lock(&allowlist_mutex);
 	list_for_each_entry_safe (np, n, &allow_list, list) {
@@ -551,81 +524,3 @@ void ksu_allowlist_exit(void)
 	}
 	mutex_unlock(&allowlist_mutex);
 }
-
-#ifdef CONFIG_KSU_MANUAL_SU
-bool ksu_temp_grant_root_once(uid_t uid)
-{
-    struct app_profile profile = {
-        .version = KSU_APP_PROFILE_VER,
-        .allow_su = true,
-        .current_uid = uid,
-    };
-
-    const char *default_key = "com.temp.once";
-
-    struct perm_data *p = NULL;
-    struct list_head *pos = NULL;
-    bool found = false;
-
-    list_for_each (pos, &allow_list) {
-        p = list_entry(pos, struct perm_data, list);
-        if (p->profile.current_uid == uid) {
-            strcpy(profile.key, p->profile.key);
-            found = true;
-            break;
-        }
-    }
-
-    if (!found) {
-        strcpy(profile.key, default_key);
-    }
-
-    profile.rp_config.profile.uid = default_root_profile.uid;
-    profile.rp_config.profile.gid = default_root_profile.gid;
-    profile.rp_config.profile.groups_count = default_root_profile.groups_count;
-    memcpy(profile.rp_config.profile.groups, default_root_profile.groups, sizeof(default_root_profile.groups));
-    memcpy(&profile.rp_config.profile.capabilities, &default_root_profile.capabilities, sizeof(default_root_profile.capabilities));
-    profile.rp_config.profile.namespaces = default_root_profile.namespaces;
-    strcpy(profile.rp_config.profile.selinux_domain, default_root_profile.selinux_domain);
-
-    bool ok = ksu_set_app_profile(&profile, false);
-    if (ok)
-        pr_info("pending_root: UID=%d granted and persisted\n", uid);
-    return ok;
-}
-
-void ksu_temp_revoke_root_once(uid_t uid)
-{
-    struct app_profile profile = {
-        .version = KSU_APP_PROFILE_VER,
-        .allow_su = false,
-        .current_uid = uid,
-    };
-
-    const char *default_key = "com.temp.once";
-
-    struct perm_data *p = NULL;
-    struct list_head *pos = NULL;
-    bool found = false;
-
-    list_for_each (pos, &allow_list) {
-        p = list_entry(pos, struct perm_data, list);
-        if (p->profile.current_uid == uid) {
-            strcpy(profile.key, p->profile.key);
-            found = true;
-            break;
-        }
-    }
-
-    if (!found) {
-        strcpy(profile.key, default_key);
-    }
-
-    profile.nrp_config.profile.umount_modules = default_non_root_profile.umount_modules;
-    strcpy(profile.rp_config.profile.selinux_domain, KSU_DEFAULT_SELINUX_DOMAIN);
-
-    ksu_set_app_profile(&profile, false);
-    persistent_allow_list();
-    pr_info("pending_root: UID=%d removed and persist updated\n", uid);
-}
-#endif

kernel/allowlist.h

@@ -2,31 +2,19 @@
 #define __KSU_H_ALLOWLIST
 
 #include <linux/types.h>
-#include <linux/uidgid.h>
-#include "app_profile.h"
-
-#define PER_USER_RANGE 100000
-#define FIRST_APPLICATION_UID 10000
-#define LAST_APPLICATION_UID 19999
-#define FIRST_ISOLATED_UID 99000
-#define LAST_ISOLATED_UID 99999
+#include "ksu.h"
 
 void ksu_allowlist_init(void);
 
 void ksu_allowlist_exit(void);
 
-void ksu_load_allow_list(void);
+bool ksu_load_allow_list(void);
 
 void ksu_show_allow_list(void);
 
-// Check if the uid is in allow list
 bool __ksu_is_allow_uid(uid_t uid);
 #define ksu_is_allow_uid(uid) unlikely(__ksu_is_allow_uid(uid))
 
-// Check if the uid is in allow list, or current is ksu domain root
-bool __ksu_is_allow_uid_for_current(uid_t uid);
-#define ksu_is_allow_uid_for_current(uid) unlikely(__ksu_is_allow_uid_for_current(uid))
-
 bool ksu_get_allow_list(int *array, int *length, bool allow);
 
 void ksu_prune_allowlist(bool (*is_uid_exist)(uid_t, char *, void *), void *data);
@@ -36,22 +24,4 @@ bool ksu_set_app_profile(struct app_profile *, bool persist);
 
 bool ksu_uid_should_umount(uid_t uid);
 struct root_profile *ksu_get_root_profile(uid_t uid);
-
-static inline bool is_appuid(uid_t uid)
-{
-    uid_t appid = uid % PER_USER_RANGE;
-    return appid >= FIRST_APPLICATION_UID && appid <= LAST_APPLICATION_UID;
-}
-
-static inline bool is_isolated_process(uid_t uid)
-{
-    uid_t appid = uid % PER_USER_RANGE;
-    return appid >= FIRST_ISOLATED_UID && appid <= LAST_ISOLATED_UID;
-}
-
-#ifdef CONFIG_KSU_MANUAL_SU
-bool ksu_temp_grant_root_once(uid_t uid);
-void ksu_temp_revoke_root_once(uid_t uid);
-#endif
-
 #endif

kernel/apk_sign.c

@@ -15,29 +15,22 @@
 #endif
 
 #include "apk_sign.h"
-#include "dynamic_manager.h"
 #include "klog.h" // IWYU pragma: keep
-#include "manager_sign.h"
+#include "kernel_compat.h"
+
 
 struct sdesc {
 	struct shash_desc shash;
 	char ctx[];
 };
 
-static apk_sign_key_t apk_sign_keys[] = {
-    {EXPECTED_SIZE_SHIRKNEKO, EXPECTED_HASH_SHIRKNEKO}, // ShirkNeko/SukiSU
-#ifdef EXPECTED_SIZE
-    {EXPECTED_SIZE, EXPECTED_HASH}, // Custom
-#endif
-};
-
 static struct sdesc *init_sdesc(struct crypto_shash *alg)
 {
 	struct sdesc *sdesc;
 	int size;
 
 	size = sizeof(struct shash_desc) + crypto_shash_descsize(alg);
-    sdesc = kzalloc(size, GFP_KERNEL);
+	sdesc = kmalloc(size, GFP_KERNEL);
 	if (!sdesc)
 		return ERR_PTR(-ENOMEM);
 	sdesc->shash.tfm = alg;
@@ -78,88 +71,25 @@ static int ksu_sha256(const unsigned char *data, unsigned int datalen,
 	return ret;
 }
 
-
-static struct dynamic_sign_key dynamic_sign = DYNAMIC_SIGN_DEFAULT_CONFIG;
-
-static bool check_dynamic_sign(struct file *fp, u32 size4, loff_t *pos, int *matched_index)
+static bool check_block(struct file *fp, u32 *size4, loff_t *pos, u32 *offset,
+			unsigned expected_size, const char *expected_sha256)
 {
-    struct dynamic_sign_key current_dynamic_key = dynamic_sign;
-    
-    if (ksu_get_dynamic_manager_config(&current_dynamic_key.size, &current_dynamic_key.hash)) {
-        pr_debug("Using dynamic manager config: size=0x%x, hash=%.16s...\n", 
-                 current_dynamic_key.size, current_dynamic_key.hash);
-    }
-    
-    if (size4 != current_dynamic_key.size) {
-        return false;
-    }
-
-#define CERT_MAX_LENGTH 1024
-    char cert[CERT_MAX_LENGTH];
-    if (size4 > CERT_MAX_LENGTH) {
-        pr_info("cert length overlimit\n");
-        return false;
-    }
-    
-    kernel_read(fp, cert, size4, pos);
-    
-    unsigned char digest[SHA256_DIGEST_SIZE];
-    if (ksu_sha256(cert, size4, digest) < 0) {
-        pr_info("sha256 error\n");
-        return false;
-    }
-
-    char hash_str[SHA256_DIGEST_SIZE * 2 + 1];
-    hash_str[SHA256_DIGEST_SIZE * 2] = '\0';
-    bin2hex(hash_str, digest, SHA256_DIGEST_SIZE);
-    
-    pr_info("sha256: %s, expected: %s, index: dynamic\n", hash_str, current_dynamic_key.hash);
-    
-    if (strcmp(current_dynamic_key.hash, hash_str) == 0) {
-        if (matched_index) {
-            *matched_index = DYNAMIC_SIGN_INDEX;
-        }
-        return true;
-    }
-    
-    return false;
-}
-
-static bool check_block(struct file *fp, u32 *size4, loff_t *pos, u32 *offset, int *matched_index)
-{
-    int i;
-    apk_sign_key_t sign_key;
-    bool signature_valid = false;
-
-    kernel_read(fp, size4, 0x4, pos); // signer-sequence length
-    kernel_read(fp, size4, 0x4, pos); // signer length
-    kernel_read(fp, size4, 0x4, pos); // signed data length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // signer-sequence length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // signer length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // signed data length
 
 	*offset += 0x4 * 3;
 
-    kernel_read(fp, size4, 0x4, pos); // digests-sequence length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // digests-sequence length
 
 	*pos += *size4;
 	*offset += 0x4 + *size4;
 
-    kernel_read(fp, size4, 0x4, pos); // certificates length
-    kernel_read(fp, size4, 0x4, pos); // certificate length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // certificates length
+	ksu_kernel_read_compat(fp, size4, 0x4, pos); // certificate length
 	*offset += 0x4 * 2;
 
-    if (ksu_is_dynamic_manager_enabled()) {
-        loff_t temp_pos = *pos;
-        if (check_dynamic_sign(fp, *size4, &temp_pos, matched_index)) {
-            *pos = temp_pos;
-            *offset += *size4;
-            return true;
-        }
-    }
-
-    for (i = 0; i < ARRAY_SIZE(apk_sign_keys); i++) {
-        sign_key = apk_sign_keys[i];
-
-        if (*size4 != sign_key.size)
-            continue;
+	if (*size4 == expected_size) {
 		*offset += *size4;
 
 #define CERT_MAX_LENGTH 1024
@@ -168,9 +98,9 @@ static bool check_block(struct file *fp, u32 *size4, loff_t *pos, u32 *offset, i
 			pr_info("cert length overlimit\n");
 			return false;
 		}
-        kernel_read(fp, cert, *size4, pos);
+		ksu_kernel_read_compat(fp, cert, *size4, pos);
 		unsigned char digest[SHA256_DIGEST_SIZE];
-        if (ksu_sha256(cert, *size4, digest) < 0 ) {
+		if (IS_ERR(ksu_sha256(cert, *size4, digest))) {
 			pr_info("sha256 error\n");
 			return false;
 		}
@@ -179,17 +109,13 @@ static bool check_block(struct file *fp, u32 *size4, loff_t *pos, u32 *offset, i
 		hash_str[SHA256_DIGEST_SIZE * 2] = '\0';
 
 		bin2hex(hash_str, digest, SHA256_DIGEST_SIZE);
-        pr_info("sha256: %s, expected: %s, index: %d\n", hash_str, sign_key.sha256, i);
-        
-        if (strcmp(sign_key.sha256, hash_str) == 0) {
-            signature_valid = true;
-            if (matched_index) {
-                *matched_index = i;
-            }
-            break;
+		pr_info("sha256: %s, expected: %s\n", hash_str,
+			expected_sha256);
+		if (strcmp(expected_sha256, hash_str) == 0) {
+			return true;
 		}
 	}
-    return signature_valid;
+	return false;
 }
 
 struct zip_entry_header {
@@ -214,7 +140,7 @@ static bool has_v1_signature_file(struct file *fp)
 
 	loff_t pos = 0;
 
-    while (kernel_read(fp, &header,
+	while (ksu_kernel_read_compat(fp, &header,
 				      sizeof(struct zip_entry_header), &pos) ==
 	       sizeof(struct zip_entry_header)) {
 		if (header.signature != 0x04034b50) {
@@ -224,7 +150,7 @@ static bool has_v1_signature_file(struct file *fp)
 		// Read the entry file name
 		if (header.file_name_length == sizeof(MANIFEST) - 1) {
 			char fileName[sizeof(MANIFEST)];
-            kernel_read(fp, fileName,
+			ksu_kernel_read_compat(fp, fileName,
 					       header.file_name_length, &pos);
 			fileName[header.file_name_length] = '\0';
 
@@ -245,7 +171,9 @@ static bool has_v1_signature_file(struct file *fp)
 	return false;
 }
 
-static __always_inline bool check_v2_signature(char *path, bool check_multi_manager, int *signature_index)
+static __always_inline bool check_v2_signature(char *path,
+					       unsigned expected_size,
+					       const char *expected_sha256)
 {
 	unsigned char buffer[0x11] = { 0 };
 	u32 size4;
@@ -257,20 +185,14 @@ static __always_inline bool check_v2_signature(char *path, bool check_multi_mana
 	int v2_signing_blocks = 0;
 	bool v3_signing_exist = false;
 	bool v3_1_signing_exist = false;
-    int matched_index = -1;
+
 	int i;
-    struct file *fp = filp_open(path, O_RDONLY, 0);
+	struct file *fp = ksu_filp_open_compat(path, O_RDONLY, 0);
 	if (IS_ERR(fp)) {
 		pr_err("open %s error.\n", path);
 		return false;
 	}
 
-    // If you want to check for multi-manager APK signing, but dynamic managering is not enabled, skip
-    if (check_multi_manager && !ksu_is_dynamic_manager_enabled()) {
-        filp_close(fp, 0);
-        return 0;
-    }
-
 	// disable inotify for this file
 	fp->f_mode |= FMODE_NONOTIFY;
 
@@ -278,10 +200,10 @@ static __always_inline bool check_v2_signature(char *path, bool check_multi_mana
 	for (i = 0;; ++i) {
 		unsigned short n;
 		pos = generic_file_llseek(fp, -i - 2, SEEK_END);
-        kernel_read(fp, &n, 2, &pos);
+		ksu_kernel_read_compat(fp, &n, 2, &pos);
 		if (n == i) {
 			pos -= 22;
-            kernel_read(fp, &size4, 4, &pos);
+			ksu_kernel_read_compat(fp, &size4, 4, &pos);
 			if ((size4 ^ 0xcafebabeu) == 0xccfbf1eeu) {
 				break;
 			}
@@ -294,17 +216,17 @@ static __always_inline bool check_v2_signature(char *path, bool check_multi_mana
 
 	pos += 12;
 	// offset
-    kernel_read(fp, &size4, 0x4, &pos);
+	ksu_kernel_read_compat(fp, &size4, 0x4, &pos);
 	pos = size4 - 0x18;
 
-    kernel_read(fp, &size8, 0x8, &pos);
-    kernel_read(fp, buffer, 0x10, &pos);
+	ksu_kernel_read_compat(fp, &size8, 0x8, &pos);
+	ksu_kernel_read_compat(fp, buffer, 0x10, &pos);
 	if (strcmp((char *)buffer, "APK Sig Block 42")) {
 		goto clean;
 	}
 
 	pos = size4 - (size8 + 0x8);
-    kernel_read(fp, &size_of_block, 0x8, &pos);
+	ksu_kernel_read_compat(fp, &size_of_block, 0x8, &pos);
 	if (size_of_block != size8) {
 		goto clean;
 	}
@@ -313,19 +235,18 @@ static __always_inline bool check_v2_signature(char *path, bool check_multi_mana
 	while (loop_count++ < 10) {
 		uint32_t id;
 		uint32_t offset;
-        kernel_read(fp, &size8, 0x8,
+		ksu_kernel_read_compat(fp, &size8, 0x8,
 				       &pos); // sequence length
 		if (size8 == size_of_block) {
 			break;
 		}
-        kernel_read(fp, &id, 0x4, &pos); // id
+		ksu_kernel_read_compat(fp, &id, 0x4, &pos); // id
 		offset = 4;
 		if (id == 0x7109871au) {
 			v2_signing_blocks++;
-            bool result = check_block(fp, &size4, &pos, &offset, &matched_index);
-            if (result) {
-                v2_signing_valid = true;
-            }
+			v2_signing_valid =
+				check_block(fp, &size4, &pos, &offset,
+					    expected_size, expected_sha256);
 		} else if (id == 0xf05368c0u) {
 			// http://aospxref.com/android-14.0.0_r2/xref/frameworks/base/core/java/android/util/apk/ApkSignatureSchemeV3Verifier.java#73
 			v3_signing_exist = true;
@@ -366,24 +287,7 @@ clean:
 		return false;
 	}
 
-    if (v2_signing_valid) {
-        if (signature_index) {
-            *signature_index = matched_index;
-        }
-        
-        if (check_multi_manager) {
-            // 0: ShirkNeko/SukiSU, DYNAMIC_SIGN_INDEX : Dynamic Sign
-            if (matched_index == 0 || matched_index == DYNAMIC_SIGN_INDEX) {
-                pr_info("Multi-manager APK detected (dynamic_manager enabled): signature_index=%d\n", matched_index);
-                return true;
-            }
-            return false;
-        } else {
-            // Common manager check: any valid signature will do
-            return true;
-        }
-    }
-    return false;
+	return v2_signing_valid;
 }
 
 #ifdef CONFIG_KSU_DEBUG
@@ -412,10 +316,5 @@ module_param_cb(ksu_debug_manager_uid, &expected_size_ops,
 
 bool is_manager_apk(char *path)
 {
-    return check_v2_signature(path, false, NULL);
-}
-
-bool is_dynamic_manager_apk(char *path, int *signature_index)
-{
-    return check_v2_signature(path, true, signature_index);
+	return check_v2_signature(path, EXPECTED_SIZE, EXPECTED_HASH);
 }

kernel/apk_sign.h

@@ -2,10 +2,7 @@
 #define __KSU_H_APK_V2_SIGN
 
 #include <linux/types.h>
-#include "ksu.h"
 
 bool is_manager_apk(char *path);
 
-bool is_dynamic_manager_apk(char *path, int *signature_index);
-
 #endif

kernel/app_profile.c

@@ -1,303 +0,0 @@
-#include <linux/capability.h>
-#include <linux/cred.h>
-#include <linux/sched.h>
-#include <linux/sched/signal.h>
-#include <linux/seccomp.h>
-#include <linux/thread_info.h>
-#include <linux/uidgid.h>
-#include <linux/version.h>
-#include "objsec.h"
-
-#include "allowlist.h"
-#include "app_profile.h"
-#include "klog.h" // IWYU pragma: keep
-#include "selinux/selinux.h"
-#include "syscall_hook_manager.h"
-#include "sucompat.h"
-
-#include "sulog.h"
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION (6, 7, 0)
-    static struct group_info root_groups = { .usage = REFCOUNT_INIT(2), };
-#else 
-    static struct group_info root_groups = { .usage = ATOMIC_INIT(2) };
-#endif
-
-static void setup_groups(struct root_profile *profile, struct cred *cred)
-{
-    if (profile->groups_count > KSU_MAX_GROUPS) {
-        pr_warn("Failed to setgroups, too large group: %d!\n",
-            profile->uid);
-        return;
-    }
-
-    if (profile->groups_count == 1 && profile->groups[0] == 0) {
-        // setgroup to root and return early.
-        if (cred->group_info)
-            put_group_info(cred->group_info);
-        cred->group_info = get_group_info(&root_groups);
-        return;
-    }
-
-    u32 ngroups = profile->groups_count;
-    struct group_info *group_info = groups_alloc(ngroups);
-    if (!group_info) {
-        pr_warn("Failed to setgroups, ENOMEM for: %d\n", profile->uid);
-        return;
-    }
-
-    int i;
-    for (i = 0; i < ngroups; i++) {
-        gid_t gid = profile->groups[i];
-        kgid_t kgid = make_kgid(current_user_ns(), gid);
-        if (!gid_valid(kgid)) {
-            pr_warn("Failed to setgroups, invalid gid: %d\n", gid);
-            put_group_info(group_info);
-            return;
-        }
-        group_info->gid[i] = kgid;
-    }
-
-    groups_sort(group_info);
-    set_groups(cred, group_info);
-    put_group_info(group_info);
-}
-
-void disable_seccomp(void)
-{
-	assert_spin_locked(&current->sighand->siglock);
-	// disable seccomp
-#if defined(CONFIG_GENERIC_ENTRY) &&                                           \
-	LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-	clear_syscall_work(SECCOMP);
-#else
-	clear_thread_flag(TIF_SECCOMP);
-#endif
-
-#ifdef CONFIG_SECCOMP
-	current->seccomp.mode = 0;
-	current->seccomp.filter = NULL;
-	atomic_set(&current->seccomp.filter_count, 0);
-#else
-#endif
-}
-
-void escape_with_root_profile(void)
-{
-    struct cred *cred;
-    struct task_struct *p = current;
-    struct task_struct *t;
-
-    cred = prepare_creds();
-    if (!cred) {
-        pr_warn("prepare_creds failed!\n");
-        return;
-    }
-
-    if (cred->euid.val == 0) {
-        pr_warn("Already root, don't escape!\n");
-#if __SULOG_GATE
-        ksu_sulog_report_su_grant(current_euid().val, NULL, "escape_to_root_failed");
-#endif
-        abort_creds(cred);
-        return;
-    }
-
-    struct root_profile *profile = ksu_get_root_profile(cred->uid.val);
-
-    cred->uid.val = profile->uid;
-    cred->suid.val = profile->uid;
-    cred->euid.val = profile->uid;
-    cred->fsuid.val = profile->uid;
-
-    cred->gid.val = profile->gid;
-    cred->fsgid.val = profile->gid;
-    cred->sgid.val = profile->gid;
-    cred->egid.val = profile->gid;
-    cred->securebits = 0;
-
-    BUILD_BUG_ON(sizeof(profile->capabilities.effective) !=
-             sizeof(kernel_cap_t));
-
-    // setup capabilities
-    // we need CAP_DAC_READ_SEARCH becuase `/data/adb/ksud` is not accessible for non root process
-    // we add it here but don't add it to cap_inhertiable, it would be dropped automaticly after exec!
-    u64 cap_for_ksud =
-        profile->capabilities.effective | CAP_DAC_READ_SEARCH;
-    memcpy(&cred->cap_effective, &cap_for_ksud,
-           sizeof(cred->cap_effective));
-    memcpy(&cred->cap_permitted, &profile->capabilities.effective,
-           sizeof(cred->cap_permitted));
-    memcpy(&cred->cap_bset, &profile->capabilities.effective,
-           sizeof(cred->cap_bset));
-
-    setup_groups(profile, cred);
-
-    commit_creds(cred);
-
-    // Refer to kernel/seccomp.c: seccomp_set_mode_strict
-    // When disabling Seccomp, ensure that current->sighand->siglock is held during the operation.
-    spin_lock_irq(&current->sighand->siglock);
-    disable_seccomp();
-    spin_unlock_irq(&current->sighand->siglock);
-
-    setup_selinux(profile->selinux_domain);
-#if __SULOG_GATE
-    ksu_sulog_report_su_grant(current_euid().val, NULL, "escape_to_root");
-#endif
-
-    for_each_thread (p, t) {
-        ksu_set_task_tracepoint_flag(t);
-    }
-}
-
-#ifdef CONFIG_KSU_MANUAL_SU
-
-#include "ksud.h"
-
-#ifndef DEVPTS_SUPER_MAGIC
-#define DEVPTS_SUPER_MAGIC    0x1cd1
-#endif
-
-static int __manual_su_handle_devpts(struct inode *inode)
-{
-    if (!current->mm) {
-        return 0;
-    }
-
-    uid_t uid = current_uid().val;
-    if (uid % 100000 < 10000) {
-        // not untrusted_app, ignore it
-        return 0;
-    }
-
-    if (likely(!ksu_is_allow_uid_for_current(uid)))
-        return 0;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0) || defined(KSU_OPTIONAL_SELINUX_INODE)
-        struct inode_security_struct *sec = selinux_inode(inode);
-#else
-        struct inode_security_struct *sec =
-            (struct inode_security_struct *)inode->i_security;
-#endif
-    if (ksu_file_sid && sec)
-        sec->sid = ksu_file_sid;
-
-    return 0;
-}
-
-static void disable_seccomp_for_task(struct task_struct *tsk)
-{
-    assert_spin_locked(&tsk->sighand->siglock);
-#ifdef CONFIG_SECCOMP
-    if (tsk->seccomp.mode == SECCOMP_MODE_DISABLED && !tsk->seccomp.filter)
-        return;
-#endif
-    clear_tsk_thread_flag(tsk, TIF_SECCOMP);
-#ifdef CONFIG_SECCOMP
-    tsk->seccomp.mode = SECCOMP_MODE_DISABLED;
-    if (tsk->seccomp.filter) {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
-        seccomp_filter_release(tsk);
-#else
-        put_seccomp_filter(tsk);
-        tsk->seccomp.filter = NULL;
-#endif
-    }
-#endif
-}
-
-void escape_to_root_for_cmd_su(uid_t target_uid, pid_t target_pid)
-{
-    struct cred *newcreds;
-    struct task_struct *target_task;
-    unsigned long flags;
-    struct task_struct *p = current;
-    struct task_struct *t;
-
-    pr_info("cmd_su: escape_to_root_for_cmd_su called for UID: %d, PID: %d\n", target_uid, target_pid);
-
-    // Find target task by PID
-    rcu_read_lock();
-    target_task = pid_task(find_vpid(target_pid), PIDTYPE_PID);
-    if (!target_task) {
-        rcu_read_unlock(); 
-        pr_err("cmd_su: target task not found for PID: %d\n", target_pid);
-#if __SULOG_GATE
-        ksu_sulog_report_su_grant(target_uid, "cmd_su", "target_not_found");
-#endif
-        return;
-    }
-    get_task_struct(target_task);
-    rcu_read_unlock();
-
-    if (task_uid(target_task).val == 0) {
-        pr_warn("cmd_su: target task is already root, PID: %d\n", target_pid);
-        put_task_struct(target_task);
-        return;
-    }
-
-    newcreds = prepare_kernel_cred(target_task);
-    if (newcreds == NULL) {
-        pr_err("cmd_su: failed to allocate new cred for PID: %d\n", target_pid);
-#if __SULOG_GATE
-        ksu_sulog_report_su_grant(target_uid, "cmd_su", "cred_alloc_failed");
-#endif
-        put_task_struct(target_task);
-        return;
-    }
-
-    struct root_profile *profile = ksu_get_root_profile(target_uid);
-
-    newcreds->uid.val = profile->uid;
-    newcreds->suid.val = profile->uid;
-    newcreds->euid.val = profile->uid;
-    newcreds->fsuid.val = profile->uid;
-
-    newcreds->gid.val = profile->gid;
-    newcreds->fsgid.val = profile->gid;
-    newcreds->sgid.val = profile->gid;
-    newcreds->egid.val = profile->gid;
-    newcreds->securebits = 0;
-
-    u64 cap_for_cmd_su = profile->capabilities.effective | CAP_DAC_READ_SEARCH | CAP_SETUID | CAP_SETGID;
-    memcpy(&newcreds->cap_effective, &cap_for_cmd_su, sizeof(newcreds->cap_effective));
-    memcpy(&newcreds->cap_permitted, &profile->capabilities.effective, sizeof(newcreds->cap_permitted));
-    memcpy(&newcreds->cap_bset, &profile->capabilities.effective, sizeof(newcreds->cap_bset));
-
-    setup_groups(profile, newcreds);
-    task_lock(target_task);
-
-    const struct cred *old_creds = get_task_cred(target_task);
-
-    rcu_assign_pointer(target_task->real_cred, newcreds);
-    rcu_assign_pointer(target_task->cred, get_cred(newcreds));
-    task_unlock(target_task);
-
-    if (target_task->sighand) {
-        spin_lock_irqsave(&target_task->sighand->siglock, flags);
-        disable_seccomp_for_task(target_task);
-        spin_unlock_irqrestore(&target_task->sighand->siglock, flags);
-    }
-
-    setup_selinux(profile->selinux_domain);
-    put_cred(old_creds);
-    wake_up_process(target_task);
-
-    if (target_task->signal->tty) {
-        struct inode *inode = target_task->signal->tty->driver_data;
-        if (inode && inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) {
-            __manual_su_handle_devpts(inode);
-        }
-    }
-
-    put_task_struct(target_task);
-#if __SULOG_GATE
-    ksu_sulog_report_su_grant(target_uid, "cmd_su", "manual_escalation");
-#endif
-    for_each_thread (p, t) {
-        ksu_set_task_tracepoint_flag(t);
-    }
-    pr_info("cmd_su: privilege escalation completed for UID: %d, PID: %d\n", target_uid, target_pid);
-}
-#endif

kernel/app_profile.h

@@ -1,70 +0,0 @@
-#ifndef __KSU_H_APP_PROFILE
-#define __KSU_H_APP_PROFILE
-
-#include <linux/types.h>
-
-// Forward declarations
-struct cred;
-
-#define KSU_APP_PROFILE_VER 2
-#define KSU_MAX_PACKAGE_NAME 256
-// NGROUPS_MAX for Linux is 65535 generally, but we only supports 32 groups.
-#define KSU_MAX_GROUPS 32
-#define KSU_SELINUX_DOMAIN 64
-
-struct root_profile {
-	int32_t uid;
-	int32_t gid;
-
-	int32_t groups_count;
-	int32_t groups[KSU_MAX_GROUPS];
-
-	// kernel_cap_t is u32[2] for capabilities v3
-	struct {
-		u64 effective;
-		u64 permitted;
-		u64 inheritable;
-	} capabilities;
-
-	char selinux_domain[KSU_SELINUX_DOMAIN];
-
-	int32_t namespaces;
-};
-
-struct non_root_profile {
-	bool umount_modules;
-};
-
-struct app_profile {
-	// It may be utilized for backward compatibility, although we have never explicitly made any promises regarding this.
-	u32 version;
-
-	// this is usually the package of the app, but can be other value for special apps
-	char key[KSU_MAX_PACKAGE_NAME];
-	int32_t current_uid;
-	bool allow_su;
-
-	union {
-		struct {
-			bool use_default;
-			char template_name[KSU_MAX_PACKAGE_NAME];
-
-			struct root_profile profile;
-		} rp_config;
-
-		struct {
-			bool use_default;
-
-			struct non_root_profile profile;
-		} nrp_config;
-	};
-};
-
-// Escalate current process to root with the appropriate profile
-void escape_with_root_profile(void);
-
-void escape_to_root_for_cmd_su(uid_t target_uid, pid_t target_pid);
-
-void disable_seccomp(void);
-
-#endif

kernel/arch.h

@@ -18,8 +18,10 @@
 #define __PT_SP_REG sp
 #define __PT_IP_REG pc
 
-#define REBOOT_SYMBOL "__arm64_sys_reboot"
+#define PRCTL_SYMBOL "__arm64_sys_prctl"
 #define SYS_READ_SYMBOL "__arm64_sys_read"
+#define SYS_NEWFSTATAT_SYMBOL "__arm64_sys_newfstatat"
+#define SYS_FACCESSAT_SYMBOL "__arm64_sys_faccessat"
 #define SYS_EXECVE_SYMBOL "__arm64_sys_execve"
 
 #elif defined(__x86_64__)
@@ -37,8 +39,10 @@
 #define __PT_RC_REG ax
 #define __PT_SP_REG sp
 #define __PT_IP_REG ip
-#define REBOOT_SYMBOL "__x64_sys_reboot"
+#define PRCTL_SYMBOL "__x64_sys_prctl"
 #define SYS_READ_SYMBOL "__x64_sys_read"
+#define SYS_NEWFSTATAT_SYMBOL "__x64_sys_newfstatat"
+#define SYS_FACCESSAT_SYMBOL "__x64_sys_faccessat"
 #define SYS_EXECVE_SYMBOL "__x64_sys_execve"
 
 #else

kernel/core_hook.c

@@ -0,0 +1,907 @@
+#include <linux/capability.h>
+#include <linux/cred.h>
+#include <linux/dcache.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/init_task.h>
+#include <linux/kallsyms.h>
+#include <linux/kernel.h>
+#include <linux/kprobes.h>
+#include <linux/lsm_hooks.h>
+#include <linux/mm.h>
+#include <linux/nsproxy.h>
+#include <linux/path.h>
+#include <linux/printk.h>
+#include <linux/sched.h>
+#include <linux/security.h>
+#include <linux/stddef.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/uidgid.h>
+#include <linux/version.h>
+#include <linux/mount.h>
+
+#include <linux/fs.h>
+#include <linux/namei.h>
+
+#ifdef MODULE
+#include <linux/list.h>
+#include <linux/irqflags.h>
+#include <linux/mm_types.h>
+#include <linux/rcupdate.h>
+#include <linux/vmalloc.h>
+#endif
+
+#include "allowlist.h"
+#include "arch.h"
+#include "core_hook.h"
+#include "klog.h" // IWYU pragma: keep
+#include "ksu.h"
+#include "ksud.h"
+#include "manager.h"
+#include "selinux/selinux.h"
+#include "throne_tracker.h"
+#include "throne_tracker.h"
+#include "kernel_compat.h"
+
+#include "kpm/kpm.h"
+
+static bool ksu_module_mounted = false;
+
+extern int handle_sepolicy(unsigned long arg3, void __user *arg4);
+
+static bool ksu_su_compat_enabled = true;
+extern void ksu_sucompat_init();
+extern void ksu_sucompat_exit();
+
+static inline bool is_allow_su()
+{
+	if (is_manager()) {
+		// we are manager, allow!
+		return true;
+	}
+	return ksu_is_allow_uid(current_uid().val);
+}
+
+static inline bool is_unsupported_uid(uid_t uid)
+{
+#define LAST_APPLICATION_UID 19999
+	uid_t appid = uid % 100000;
+	return appid > LAST_APPLICATION_UID;
+}
+
+static struct group_info root_groups = { .usage = ATOMIC_INIT(2) };
+
+static void setup_groups(struct root_profile *profile, struct cred *cred)
+{
+	if (profile->groups_count > KSU_MAX_GROUPS) {
+		pr_warn("Failed to setgroups, too large group: %d!\n",
+			profile->uid);
+		return;
+	}
+
+	if (profile->groups_count == 1 && profile->groups[0] == 0) {
+		// setgroup to root and return early.
+		if (cred->group_info)
+			put_group_info(cred->group_info);
+		cred->group_info = get_group_info(&root_groups);
+		return;
+	}
+
+	u32 ngroups = profile->groups_count;
+	struct group_info *group_info = groups_alloc(ngroups);
+	if (!group_info) {
+		pr_warn("Failed to setgroups, ENOMEM for: %d\n", profile->uid);
+		return;
+	}
+
+	int i;
+	for (i = 0; i < ngroups; i++) {
+		gid_t gid = profile->groups[i];
+		kgid_t kgid = make_kgid(current_user_ns(), gid);
+		if (!gid_valid(kgid)) {
+			pr_warn("Failed to setgroups, invalid gid: %d\n", gid);
+			put_group_info(group_info);
+			return;
+		}
+		group_info->gid[i] = kgid;
+	}
+
+	groups_sort(group_info);
+	set_groups(cred, group_info);
+}
+
+static void disable_seccomp()
+{
+	assert_spin_locked(&current->sighand->siglock);
+	// disable seccomp
+#if defined(CONFIG_GENERIC_ENTRY) &&                                           \
+	LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+	current_thread_info()->syscall_work &= ~SYSCALL_WORK_SECCOMP;
+#else
+	current_thread_info()->flags &= ~(TIF_SECCOMP | _TIF_SECCOMP);
+#endif
+
+#ifdef CONFIG_SECCOMP
+	current->seccomp.mode = 0;
+	current->seccomp.filter = NULL;
+#else
+#endif
+}
+
+void escape_to_root(void)
+{
+	struct cred *cred;
+
+	rcu_read_lock();
+
+	do {
+		cred = (struct cred *)__task_cred((current));
+		BUG_ON(!cred);
+	} while (!get_cred_rcu(cred));
+
+	if (cred->euid.val == 0) {
+		pr_warn("Already root, don't escape!\n");
+		rcu_read_unlock();
+		return;
+	}
+	struct root_profile *profile = ksu_get_root_profile(cred->uid.val);
+
+	cred->uid.val = profile->uid;
+	cred->suid.val = profile->uid;
+	cred->euid.val = profile->uid;
+	cred->fsuid.val = profile->uid;
+
+	cred->gid.val = profile->gid;
+	cred->fsgid.val = profile->gid;
+	cred->sgid.val = profile->gid;
+	cred->egid.val = profile->gid;
+	cred->securebits = 0;
+
+	BUILD_BUG_ON(sizeof(profile->capabilities.effective) !=
+		     sizeof(kernel_cap_t));
+
+	// setup capabilities
+	// we need CAP_DAC_READ_SEARCH becuase `/data/adb/ksud` is not accessible for non root process
+	// we add it here but don't add it to cap_inhertiable, it would be dropped automaticly after exec!
+	u64 cap_for_ksud =
+		profile->capabilities.effective | CAP_DAC_READ_SEARCH;
+	memcpy(&cred->cap_effective, &cap_for_ksud,
+	       sizeof(cred->cap_effective));
+	memcpy(&cred->cap_permitted, &profile->capabilities.effective,
+	       sizeof(cred->cap_permitted));
+	memcpy(&cred->cap_bset, &profile->capabilities.effective,
+	       sizeof(cred->cap_bset));
+
+	setup_groups(profile, cred);
+
+	rcu_read_unlock();
+
+	// Refer to kernel/seccomp.c: seccomp_set_mode_strict
+	// When disabling Seccomp, ensure that current->sighand->siglock is held during the operation.
+	spin_lock_irq(&current->sighand->siglock);
+	disable_seccomp();
+	spin_unlock_irq(&current->sighand->siglock);
+
+	setup_selinux(profile->selinux_domain);
+}
+
+int ksu_handle_rename(struct dentry *old_dentry, struct dentry *new_dentry)
+{
+	if (!current->mm) {
+		// skip kernel threads
+		return 0;
+	}
+
+	if (current_uid().val != 1000) {
+		// skip non system uid
+		return 0;
+	}
+
+	if (!old_dentry || !new_dentry) {
+		return 0;
+	}
+
+	// /data/system/packages.list.tmp -> /data/system/packages.list
+	if (strcmp(new_dentry->d_iname, "packages.list")) {
+		return 0;
+	}
+
+	char path[128];
+	char *buf = dentry_path_raw(new_dentry, path, sizeof(path));
+	if (IS_ERR(buf)) {
+		pr_err("dentry_path_raw failed.\n");
+		return 0;
+	}
+
+	if (!strstr(buf, "/system/packages.list")) {
+		return 0;
+	}
+	pr_info("renameat: %s -> %s, new path: %s\n", old_dentry->d_iname,
+		new_dentry->d_iname, buf);
+
+	track_throne();
+
+	return 0;
+}
+
+static void nuke_ext4_sysfs() {
+	struct path path;
+	int err = kern_path("/data/adb/modules", 0, &path);
+	if (err) {
+		pr_err("nuke path err: %d\n", err);
+		return;
+	}
+
+	struct super_block* sb = path.dentry->d_inode->i_sb;
+	const char* name = sb->s_type->name;
+	if (strcmp(name, "ext4") != 0) {
+		pr_info("nuke but module aren't mounted\n");
+		return;
+	}
+
+	ext4_unregister_sysfs(sb);
+}
+
+int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3,
+		     unsigned long arg4, unsigned long arg5)
+{
+	// if success, we modify the arg5 as result!
+	u32 *result = (u32 *)arg5;
+	u32 reply_ok = KERNEL_SU_OPTION;
+
+	if (KERNEL_SU_OPTION != option) {
+		return 0;
+	}
+
+	// TODO: find it in throne tracker!
+	uid_t current_uid_val = current_uid().val;
+	uid_t manager_uid = ksu_get_manager_uid();
+	if (current_uid_val != manager_uid &&
+	    current_uid_val % 100000 == manager_uid) {
+		ksu_set_manager_uid(current_uid_val);
+	}
+
+	bool from_root = 0 == current_uid().val;
+	bool from_manager = is_manager();
+
+	if (!from_root && !from_manager) {
+		// only root or manager can access this interface
+		return 0;
+	}
+
+#ifdef CONFIG_KSU_DEBUG
+	pr_info("option: 0x%x, cmd: %ld\n", option, arg2);
+#endif
+
+	if (arg2 == CMD_BECOME_MANAGER) {
+		if (from_manager) {
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("become_manager: prctl reply error\n");
+			}
+			return 0;
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_GRANT_ROOT) {
+		if (is_allow_su()) {
+			pr_info("allow root for: %d\n", current_uid().val);
+			escape_to_root();
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("grant_root: prctl reply error\n");
+			}
+		}
+		return 0;
+	}
+
+	// Both root manager and root processes should be allowed to get version
+	if (arg2 == CMD_GET_VERSION) {
+		u32 version = KERNEL_SU_VERSION;
+		if (copy_to_user(arg3, &version, sizeof(version))) {
+			pr_err("prctl reply error, cmd: %lu\n", arg2);
+		}
+		u32 version_flags = 0;
+#ifdef MODULE
+		version_flags |= 0x1;
+#endif
+		if (arg4 &&
+		    copy_to_user(arg4, &version_flags, sizeof(version_flags))) {
+			pr_err("prctl reply error, cmd: %lu\n", arg2);
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_REPORT_EVENT) {
+		if (!from_root) {
+			return 0;
+		}
+		switch (arg3) {
+		case EVENT_POST_FS_DATA: {
+			static bool post_fs_data_lock = false;
+			if (!post_fs_data_lock) {
+				post_fs_data_lock = true;
+				pr_info("post-fs-data triggered\n");
+				on_post_fs_data();
+			}
+			break;
+		}
+		case EVENT_BOOT_COMPLETED: {
+			static bool boot_complete_lock = false;
+			if (!boot_complete_lock) {
+				boot_complete_lock = true;
+				pr_info("boot_complete triggered\n");
+			}
+			break;
+		}
+		case EVENT_MODULE_MOUNTED: {
+			ksu_module_mounted = true;
+			pr_info("module mounted!\n");
+			nuke_ext4_sysfs();
+			break;
+		}
+		default:
+			break;
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_SET_SEPOLICY) {
+		if (!from_root) {
+			return 0;
+		}
+		if (!handle_sepolicy(arg3, arg4)) {
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("sepolicy: prctl reply error\n");
+			}
+		}
+
+		return 0;
+	}
+
+	if (arg2 == CMD_CHECK_SAFEMODE) {
+		if (ksu_is_safe_mode()) {
+			pr_warn("safemode enabled!\n");
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("safemode: prctl reply error\n");
+			}
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_GET_ALLOW_LIST || arg2 == CMD_GET_DENY_LIST) {
+		u32 array[128];
+		u32 array_length;
+		bool success = ksu_get_allow_list(array, &array_length,
+						  arg2 == CMD_GET_ALLOW_LIST);
+		if (success) {
+			if (!copy_to_user(arg4, &array_length,
+					  sizeof(array_length)) &&
+			    !copy_to_user(arg3, array,
+					  sizeof(u32) * array_length)) {
+				if (copy_to_user(result, &reply_ok,
+						 sizeof(reply_ok))) {
+					pr_err("prctl reply error, cmd: %lu\n",
+					       arg2);
+				}
+			} else {
+				pr_err("prctl copy allowlist error\n");
+			}
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_UID_GRANTED_ROOT || arg2 == CMD_UID_SHOULD_UMOUNT) {
+		uid_t target_uid = (uid_t)arg3;
+		bool allow = false;
+		if (arg2 == CMD_UID_GRANTED_ROOT) {
+			allow = ksu_is_allow_uid(target_uid);
+		} else if (arg2 == CMD_UID_SHOULD_UMOUNT) {
+			allow = ksu_uid_should_umount(target_uid);
+		} else {
+			pr_err("unknown cmd: %lu\n", arg2);
+		}
+		if (!copy_to_user(arg4, &allow, sizeof(allow))) {
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("prctl reply error, cmd: %lu\n", arg2);
+			}
+		} else {
+			pr_err("prctl copy err, cmd: %lu\n", arg2);
+		}
+		return 0;
+	}
+
+	#ifdef CONFIG_KPM
+	// ADD: 添加KPM模块控制
+	if(sukisu_is_kpm_control_code(arg2)) {
+		int res;
+
+		pr_info("KPM: calling before arg2=%d\n", (int) arg2);
+		
+		res = sukisu_handle_kpm(arg2, arg3, arg4, arg5);
+
+		return 0;
+	}
+	#endif
+
+	// all other cmds are for 'root manager'
+	if (!from_manager) {
+		return 0;
+	}
+
+	// we are already manager
+	if (arg2 == CMD_GET_APP_PROFILE) {
+		struct app_profile profile;
+		if (copy_from_user(&profile, arg3, sizeof(profile))) {
+			pr_err("copy profile failed\n");
+			return 0;
+		}
+
+		bool success = ksu_get_app_profile(&profile);
+		if (success) {
+			if (copy_to_user(arg3, &profile, sizeof(profile))) {
+				pr_err("copy profile failed\n");
+				return 0;
+			}
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("prctl reply error, cmd: %lu\n", arg2);
+			}
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_SET_APP_PROFILE) {
+		struct app_profile profile;
+		if (copy_from_user(&profile, arg3, sizeof(profile))) {
+			pr_err("copy profile failed\n");
+			return 0;
+		}
+
+		// todo: validate the params
+		if (ksu_set_app_profile(&profile, true)) {
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+				pr_err("prctl reply error, cmd: %lu\n", arg2);
+			}
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_IS_SU_ENABLED) {
+		if (copy_to_user(arg3, &ksu_su_compat_enabled,
+				 sizeof(ksu_su_compat_enabled))) {
+			pr_err("copy su compat failed\n");
+			return 0;
+		}
+		if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+			pr_err("prctl reply error, cmd: %lu\n", arg2);
+		}
+		return 0;
+	}
+
+	if (arg2 == CMD_ENABLE_SU) {
+		bool enabled = (arg3 != 0);
+		if (enabled == ksu_su_compat_enabled) {
+			pr_info("cmd enable su but no need to change.\n");
+			if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {// return the reply_ok directly
+				pr_err("prctl reply error, cmd: %lu\n", arg2);
+			}
+			return 0;
+		}
+
+		if (enabled) {
+			ksu_sucompat_init();
+		} else {
+			ksu_sucompat_exit();
+		}
+		ksu_su_compat_enabled = enabled;
+
+		if (copy_to_user(result, &reply_ok, sizeof(reply_ok))) {
+			pr_err("prctl reply error, cmd: %lu\n", arg2);
+		}
+
+		return 0;
+	}
+
+	return 0;
+}
+
+static bool is_appuid(kuid_t uid)
+{
+#define PER_USER_RANGE 100000
+#define FIRST_APPLICATION_UID 10000
+#define LAST_APPLICATION_UID 19999
+
+	uid_t appid = uid.val % PER_USER_RANGE;
+	return appid >= FIRST_APPLICATION_UID && appid <= LAST_APPLICATION_UID;
+}
+
+static bool should_umount(struct path *path)
+{
+	if (!path) {
+		return false;
+	}
+
+	if (current->nsproxy->mnt_ns == init_nsproxy.mnt_ns) {
+		pr_info("ignore global mnt namespace process: %d\n",
+			current_uid().val);
+		return false;
+	}
+
+	if (path->mnt && path->mnt->mnt_sb && path->mnt->mnt_sb->s_type) {
+		const char *fstype = path->mnt->mnt_sb->s_type->name;
+		return strcmp(fstype, "overlay") == 0;
+	}
+	return false;
+}
+
+static void ksu_umount_mnt(struct path *path, int flags)
+{
+	int err = path_umount(path, flags);
+	if (err) {
+		pr_info("umount %s failed: %d\n", path->dentry->d_iname, err);
+	}
+}
+
+static void try_umount(const char *mnt, bool check_mnt, int flags)
+{
+	struct path path;
+	int err = kern_path(mnt, 0, &path);
+	if (err) {
+		return;
+	}
+
+	if (path.dentry != path.mnt->mnt_root) {
+		// it is not root mountpoint, maybe umounted by others already.
+		return;
+	}
+
+	// we are only interest in some specific mounts
+	if (check_mnt && !should_umount(&path)) {
+		return;
+	}
+
+	ksu_umount_mnt(&path, flags);
+}
+
+int ksu_handle_setuid(struct cred *new, const struct cred *old)
+{
+	// this hook is used for umounting overlayfs for some uid, if there isn't any module mounted, just ignore it!
+	if (!ksu_module_mounted) {
+		return 0;
+	}
+
+	if (!new || !old) {
+		return 0;
+	}
+
+	kuid_t new_uid = new->uid;
+	kuid_t old_uid = old->uid;
+
+	if (0 != old_uid.val) {
+		// old process is not root, ignore it.
+		return 0;
+	}
+
+	if (!is_appuid(new_uid) || is_unsupported_uid(new_uid.val)) {
+		// pr_info("handle setuid ignore non application or isolated uid: %d\n", new_uid.val);
+		return 0;
+	}
+
+	if (ksu_is_allow_uid(new_uid.val)) {
+		// pr_info("handle setuid ignore allowed application: %d\n", new_uid.val);
+		return 0;
+	}
+
+	if (!ksu_uid_should_umount(new_uid.val)) {
+		return 0;
+	} else {
+#ifdef CONFIG_KSU_DEBUG
+		pr_info("uid: %d should not umount!\n", current_uid().val);
+#endif
+	}
+
+	// check old process's selinux context, if it is not zygote, ignore it!
+	// because some su apps may setuid to untrusted_app but they are in global mount namespace
+	// when we umount for such process, that is a disaster!
+	bool is_zygote_child = is_zygote(old->security);
+	if (!is_zygote_child) {
+		pr_info("handle umount ignore non zygote child: %d\n",
+			current->pid);
+		return 0;
+	}
+#ifdef CONFIG_KSU_DEBUG
+	// umount the target mnt
+	pr_info("handle umount for uid: %d, pid: %d\n", new_uid.val,
+		current->pid);
+#endif
+
+	// fixme: use `collect_mounts` and `iterate_mount` to iterate all mountpoint and
+	// filter the mountpoint whose target is `/data/adb`
+	try_umount("/system", true, 0);
+	try_umount("/vendor", true, 0);
+	try_umount("/product", true, 0);
+	try_umount("/system_ext", true, 0);
+	try_umount("/data/adb/modules", false, MNT_DETACH);
+
+	// try umount ksu temp path
+	try_umount("/debug_ramdisk", false, MNT_DETACH);
+
+	return 0;
+}
+
+// Init functons
+
+static int handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+	struct pt_regs *real_regs = PT_REAL_REGS(regs);
+	int option = (int)PT_REGS_PARM1(real_regs);
+	unsigned long arg2 = (unsigned long)PT_REGS_PARM2(real_regs);
+	unsigned long arg3 = (unsigned long)PT_REGS_PARM3(real_regs);
+	// PRCTL_SYMBOL is the arch-specificed one, which receive raw pt_regs from syscall
+	unsigned long arg4 = (unsigned long)PT_REGS_SYSCALL_PARM4(real_regs);
+	unsigned long arg5 = (unsigned long)PT_REGS_PARM5(real_regs);
+
+	return ksu_handle_prctl(option, arg2, arg3, arg4, arg5);
+}
+
+static struct kprobe prctl_kp = {
+	.symbol_name = PRCTL_SYMBOL,
+	.pre_handler = handler_pre,
+};
+
+static int renameat_handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
+	// https://elixir.bootlin.com/linux/v5.12-rc1/source/include/linux/fs.h
+	struct renamedata *rd = PT_REGS_PARM1(regs);
+	struct dentry *old_entry = rd->old_dentry;
+	struct dentry *new_entry = rd->new_dentry;
+#else
+	struct dentry *old_entry = (struct dentry *)PT_REGS_PARM2(regs);
+	struct dentry *new_entry = (struct dentry *)PT_REGS_CCALL_PARM4(regs);
+#endif
+
+	return ksu_handle_rename(old_entry, new_entry);
+}
+
+static struct kprobe renameat_kp = {
+	.symbol_name = "vfs_rename",
+	.pre_handler = renameat_handler_pre,
+};
+
+__maybe_unused int ksu_kprobe_init(void)
+{
+	int rc = 0;
+	rc = register_kprobe(&prctl_kp);
+
+	if (rc) {
+		pr_info("prctl kprobe failed: %d.\n", rc);
+		return rc;
+	}
+
+	rc = register_kprobe(&renameat_kp);
+	pr_info("renameat kp: %d\n", rc);
+
+	return rc;
+}
+
+__maybe_unused int ksu_kprobe_exit(void)
+{
+	unregister_kprobe(&prctl_kp);
+	unregister_kprobe(&renameat_kp);
+	return 0;
+}
+
+static int ksu_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+			  unsigned long arg4, unsigned long arg5)
+{
+	ksu_handle_prctl(option, arg2, arg3, arg4, arg5);
+	return -ENOSYS;
+}
+
+static int ksu_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
+			    struct inode *new_inode, struct dentry *new_dentry)
+{
+	return ksu_handle_rename(old_dentry, new_dentry);
+}
+
+static int ksu_task_fix_setuid(struct cred *new, const struct cred *old,
+			       int flags)
+{
+	return ksu_handle_setuid(new, old);
+}
+
+#ifndef MODULE
+static struct security_hook_list ksu_hooks[] = {
+	LSM_HOOK_INIT(task_prctl, ksu_task_prctl),
+	LSM_HOOK_INIT(inode_rename, ksu_inode_rename),
+	LSM_HOOK_INIT(task_fix_setuid, ksu_task_fix_setuid),
+};
+
+void __init ksu_lsm_hook_init(void)
+{
+	security_add_hooks(ksu_hooks, ARRAY_SIZE(ksu_hooks), "ksu");
+}
+
+#else
+static int override_security_head(void *head, const void *new_head, size_t len)
+{
+	unsigned long base = (unsigned long)head & PAGE_MASK;
+	unsigned long offset = offset_in_page(head);
+
+	// this is impossible for our case because the page alignment
+	// but be careful for other cases!
+	BUG_ON(offset + len > PAGE_SIZE);
+	struct page *page = phys_to_page(__pa(base));
+	if (!page) {
+		return -EFAULT;
+	}
+
+	void *addr = vmap(&page, 1, VM_MAP, PAGE_KERNEL);
+	if (!addr) {
+		return -ENOMEM;
+	}
+	local_irq_disable();
+	memcpy(addr + offset, new_head, len);
+	local_irq_enable();
+	vunmap(addr);
+	return 0;
+}
+
+static void free_security_hook_list(struct hlist_head *head)
+{
+	struct hlist_node *temp;
+	struct security_hook_list *entry;
+
+	if (!head)
+		return;
+
+	hlist_for_each_entry_safe (entry, temp, head, list) {
+		hlist_del(&entry->list);
+		kfree(entry);
+	}
+
+	kfree(head);
+}
+
+struct hlist_head *copy_security_hlist(struct hlist_head *orig)
+{
+	struct hlist_head *new_head = kmalloc(sizeof(*new_head), GFP_KERNEL);
+	if (!new_head)
+		return NULL;
+
+	INIT_HLIST_HEAD(new_head);
+
+	struct security_hook_list *entry;
+	struct security_hook_list *new_entry;
+
+	hlist_for_each_entry (entry, orig, list) {
+		new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
+		if (!new_entry) {
+			free_security_hook_list(new_head);
+			return NULL;
+		}
+
+		*new_entry = *entry;
+
+		hlist_add_tail_rcu(&new_entry->list, new_head);
+	}
+
+	return new_head;
+}
+
+#define LSM_SEARCH_MAX 180 // This should be enough to iterate
+static void *find_head_addr(void *security_ptr, int *index)
+{
+	if (!security_ptr) {
+		return NULL;
+	}
+	struct hlist_head *head_start =
+		(struct hlist_head *)&security_hook_heads;
+
+	for (int i = 0; i < LSM_SEARCH_MAX; i++) {
+		struct hlist_head *head = head_start + i;
+		struct security_hook_list *pos;
+		hlist_for_each_entry (pos, head, list) {
+			if (pos->hook.capget == security_ptr) {
+				if (index) {
+					*index = i;
+				}
+				return head;
+			}
+		}
+	}
+
+	return NULL;
+}
+
+#define GET_SYMBOL_ADDR(sym)                                                   \
+	({                                                                     \
+		void *addr = kallsyms_lookup_name(#sym ".cfi_jt");             \
+		if (!addr) {                                                   \
+			addr = kallsyms_lookup_name(#sym);                     \
+		}                                                              \
+		addr;                                                          \
+	})
+
+#define KSU_LSM_HOOK_HACK_INIT(head_ptr, name, func)                           \
+	do {                                                                   \
+		static struct security_hook_list hook = {                      \
+			.hook = { .name = func }                               \
+		};                                                             \
+		hook.head = head_ptr;                                          \
+		hook.lsm = "ksu";                                              \
+		struct hlist_head *new_head = copy_security_hlist(hook.head);  \
+		if (!new_head) {                                               \
+			pr_err("Failed to copy security list: %s\n", #name);   \
+			break;                                                 \
+		}                                                              \
+		hlist_add_tail_rcu(&hook.list, new_head);                      \
+		if (override_security_head(hook.head, new_head,                \
+					   sizeof(*new_head))) {               \
+			free_security_hook_list(new_head);                     \
+			pr_err("Failed to hack lsm for: %s\n", #name);         \
+		}                                                              \
+	} while (0)
+
+void __init ksu_lsm_hook_init(void)
+{
+	void *cap_prctl = GET_SYMBOL_ADDR(cap_task_prctl);
+	void *prctl_head = find_head_addr(cap_prctl, NULL);
+	if (prctl_head) {
+		if (prctl_head != &security_hook_heads.task_prctl) {
+			pr_warn("prctl's address has shifted!\n");
+		}
+		KSU_LSM_HOOK_HACK_INIT(prctl_head, task_prctl, ksu_task_prctl);
+	} else {
+		pr_warn("Failed to find task_prctl!\n");
+	}
+
+	int inode_killpriv_index = -1;
+	void *cap_killpriv = GET_SYMBOL_ADDR(cap_inode_killpriv);
+	find_head_addr(cap_killpriv, &inode_killpriv_index);
+	if (inode_killpriv_index < 0) {
+		pr_warn("Failed to find inode_rename, use kprobe instead!\n");
+		register_kprobe(&renameat_kp);
+	} else {
+		int inode_rename_index = inode_killpriv_index +
+					 &security_hook_heads.inode_rename -
+					 &security_hook_heads.inode_killpriv;
+		struct hlist_head *head_start =
+			(struct hlist_head *)&security_hook_heads;
+		void *inode_rename_head = head_start + inode_rename_index;
+		if (inode_rename_head != &security_hook_heads.inode_rename) {
+			pr_warn("inode_rename's address has shifted!\n");
+		}
+		KSU_LSM_HOOK_HACK_INIT(inode_rename_head, inode_rename,
+				       ksu_inode_rename);
+	}
+	void *cap_setuid = GET_SYMBOL_ADDR(cap_task_fix_setuid);
+	void *setuid_head = find_head_addr(cap_setuid, NULL);
+	if (setuid_head) {
+		if (setuid_head != &security_hook_heads.task_fix_setuid) {
+			pr_warn("setuid's address has shifted!\n");
+		}
+		KSU_LSM_HOOK_HACK_INIT(setuid_head, task_fix_setuid,
+				       ksu_task_fix_setuid);
+	} else {
+		pr_warn("Failed to find task_fix_setuid!\n");
+	}
+	smp_mb();
+}
+#endif
+
+void __init ksu_core_init(void)
+{
+	ksu_lsm_hook_init();
+}
+
+void ksu_core_exit(void)
+{
+#ifdef CONFIG_KPROBE
+	pr_info("ksu_core_kprobe_exit\n");
+	// we dont use this now
+	// ksu_kprobe_exit();
+#endif
+}

kernel/core_hook.h

@@ -0,0 +1,9 @@
+#ifndef __KSU_H_KSU_CORE
+#define __KSU_H_KSU_CORE
+
+#include <linux/init.h>
+
+void __init ksu_core_init(void);
+void ksu_core_exit(void);
+
+#endif

kernel/dynamic_manager.c

@@ -1,504 +0,0 @@
-#include <linux/err.h>
-#include <linux/fs.h>
-#include <linux/gfp.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/version.h>
-#include <linux/workqueue.h>
-#ifdef CONFIG_KSU_DEBUG
-#include <linux/moduleparam.h>
-#endif
-#include <crypto/hash.h>
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-#include <crypto/sha2.h>
-#else
-#include <crypto/sha.h>
-#endif
-
-#include "dynamic_manager.h"
-#include "klog.h" // IWYU pragma: keep
-#include "manager.h"
-
-#define MAX_MANAGERS 2
-
-// Dynamic sign configuration
-static struct dynamic_manager_config dynamic_manager = {
-    .size = 0x300, 
-    .hash = "0000000000000000000000000000000000000000000000000000000000000000",
-    .is_set = 0
-};
-
-// Multi-manager state
-static struct manager_info active_managers[MAX_MANAGERS];
-static DEFINE_SPINLOCK(managers_lock);
-static DEFINE_SPINLOCK(dynamic_manager_lock);
-
-// Work queues for persistent storage
-static struct work_struct save_dynamic_manager_work;
-static struct work_struct load_dynamic_manager_work;
-static struct work_struct clear_dynamic_manager_work;
-
-bool ksu_is_dynamic_manager_enabled(void)
-{
-    unsigned long flags;
-    bool enabled;
-    
-    spin_lock_irqsave(&dynamic_manager_lock, flags);
-    enabled = dynamic_manager.is_set;
-    spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-    
-    return enabled;
-}
-
-void ksu_add_manager(uid_t uid, int signature_index)
-{
-    unsigned long flags;
-    int i;
-    
-    if (!ksu_is_dynamic_manager_enabled()) {
-        pr_info("Dynamic sign not enabled, skipping multi-manager add\n");
-        return;
-    }
-    
-    spin_lock_irqsave(&managers_lock, flags);
-    
-    // Check if manager already exists and update
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (active_managers[i].is_active && active_managers[i].uid == uid) {
-            active_managers[i].signature_index = signature_index;
-            spin_unlock_irqrestore(&managers_lock, flags);
-            pr_info("Updated manager uid=%d, signature_index=%d\n", uid, signature_index);
-            return;
-        }
-    }
-    
-    // Find free slot for new manager
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (!active_managers[i].is_active) {
-            active_managers[i].uid = uid;
-            active_managers[i].signature_index = signature_index;
-            active_managers[i].is_active = true;
-            spin_unlock_irqrestore(&managers_lock, flags);
-            pr_info("Added manager uid=%d, signature_index=%d\n", uid, signature_index);
-            return;
-        }
-    }
-    
-    spin_unlock_irqrestore(&managers_lock, flags);
-    pr_warn("Failed to add manager, no free slots\n");
-}
-
-void ksu_remove_manager(uid_t uid)
-{
-    unsigned long flags;
-    int i;
-    
-    if (!ksu_is_dynamic_manager_enabled()) {
-        return;
-    }
-    
-    spin_lock_irqsave(&managers_lock, flags);
-    
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (active_managers[i].is_active && active_managers[i].uid == uid) {
-            active_managers[i].is_active = false;
-            pr_info("Removed manager uid=%d\n", uid);
-            break;
-        }
-    }
-    
-    spin_unlock_irqrestore(&managers_lock, flags);
-}
-
-bool ksu_is_any_manager(uid_t uid)
-{
-    unsigned long flags;
-    bool is_manager = false;
-    int i;
-    
-    if (!ksu_is_dynamic_manager_enabled()) {
-        return false;
-    }
-    
-    spin_lock_irqsave(&managers_lock, flags);
-    
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (active_managers[i].is_active && active_managers[i].uid == uid) {
-            is_manager = true;
-            break;
-        }
-    }
-    
-    spin_unlock_irqrestore(&managers_lock, flags);
-    return is_manager;
-}
-
-int ksu_get_manager_signature_index(uid_t uid)
-{
-    unsigned long flags;
-    int signature_index = -1;
-    int i;
-    
-    // Check traditional manager first
-    if (ksu_manager_uid != KSU_INVALID_UID && uid == ksu_manager_uid) {
-        return DYNAMIC_SIGN_INDEX;
-    }
-    
-    if (!ksu_is_dynamic_manager_enabled()) {
-        return -1;
-    }
-    
-    spin_lock_irqsave(&managers_lock, flags);
-    
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (active_managers[i].is_active && active_managers[i].uid == uid) {
-            signature_index = active_managers[i].signature_index;
-            break;
-        }
-    }
-    
-    spin_unlock_irqrestore(&managers_lock, flags);
-    return signature_index;
-}
-
-static void clear_dynamic_manager(void)
-{
-    unsigned long flags;
-    int i;
-    
-    spin_lock_irqsave(&managers_lock, flags);
-    
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        if (active_managers[i].is_active) {
-            pr_info("Clearing dynamic manager uid=%d (signature_index=%d) for rescan\n", 
-                    active_managers[i].uid, active_managers[i].signature_index);
-            active_managers[i].is_active = false;
-        }
-    }
-    
-    spin_unlock_irqrestore(&managers_lock, flags);
-}
-
-int ksu_get_active_managers(struct manager_list_info *info)
-{
-    unsigned long flags;
-    int i, count = 0;
-    
-    if (!info) {
-        return -EINVAL;
-    }
-
-    // Add traditional manager first
-    if (ksu_manager_uid != KSU_INVALID_UID && count < 2) {
-        info->managers[count].uid = ksu_manager_uid;
-        info->managers[count].signature_index = 0;
-        count++;
-    }
-    
-    // Add dynamic managers
-    if (ksu_is_dynamic_manager_enabled()) {
-        spin_lock_irqsave(&managers_lock, flags);
-        
-        for (i = 0; i < MAX_MANAGERS && count < 2; i++) {
-            if (active_managers[i].is_active) {
-                info->managers[count].uid = active_managers[i].uid;
-                info->managers[count].signature_index = active_managers[i].signature_index;
-                count++;
-            }
-        }
-        
-        spin_unlock_irqrestore(&managers_lock, flags);
-    }
-    
-    info->count = count;
-    return 0;
-}
-
-static void do_save_dynamic_manager(struct work_struct *work)
-{
-    u32 magic = DYNAMIC_MANAGER_FILE_MAGIC;
-    u32 version = DYNAMIC_MANAGER_FILE_VERSION;
-    struct dynamic_manager_config config_to_save;
-    loff_t off = 0;
-    unsigned long flags;
-    struct file *fp;
-
-    spin_lock_irqsave(&dynamic_manager_lock, flags);
-    config_to_save = dynamic_manager;
-    spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-
-    if (!config_to_save.is_set) {
-        pr_info("Dynamic sign config not set, skipping save\n");
-        return;
-    }
-
-    fp = filp_open(KERNEL_SU_DYNAMIC_MANAGER, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-    if (IS_ERR(fp)) {
-        pr_err("save_dynamic_manager create file failed: %ld\n", PTR_ERR(fp));
-        return;
-    }
-
-    if (kernel_write(fp, &magic, sizeof(magic), &off) != sizeof(magic)) {
-        pr_err("save_dynamic_manager write magic failed.\n");
-        goto exit;
-    }
-
-    if (kernel_write(fp, &version, sizeof(version), &off) != sizeof(version)) {
-        pr_err("save_dynamic_manager write version failed.\n");
-        goto exit;
-    }
-
-    if (kernel_write(fp, &config_to_save, sizeof(config_to_save), &off) != sizeof(config_to_save)) {
-        pr_err("save_dynamic_manager write config failed.\n");
-        goto exit;
-    }
-
-    pr_info("Dynamic sign config saved successfully\n");
-
-exit:
-    filp_close(fp, 0);
-}
-
-static void do_load_dynamic_manager(struct work_struct *work)
-{
-    loff_t off = 0;
-    ssize_t ret = 0;
-    struct file *fp = NULL;
-    u32 magic;
-    u32 version;
-    struct dynamic_manager_config loaded_config;
-    unsigned long flags;
-    int i;
-
-    fp = filp_open(KERNEL_SU_DYNAMIC_MANAGER, O_RDONLY, 0);
-    if (IS_ERR(fp)) {
-        if (PTR_ERR(fp) == -ENOENT) {
-            pr_info("No saved dynamic manager config found\n");
-        } else {
-            pr_err("load_dynamic_manager open file failed: %ld\n", PTR_ERR(fp));
-        }
-        return;
-    }
-
-    if (kernel_read(fp, &magic, sizeof(magic), &off) != sizeof(magic) ||
-        magic != DYNAMIC_MANAGER_FILE_MAGIC) {
-        pr_err("dynamic manager file invalid magic: %x!\n", magic);
-        goto exit;
-    }
-
-    if (kernel_read(fp, &version, sizeof(version), &off) != sizeof(version)) {
-        pr_err("dynamic manager read version failed\n");
-        goto exit;
-    }
-
-    pr_info("dynamic manager file version: %d\n", version);
-
-    ret = kernel_read(fp, &loaded_config, sizeof(loaded_config), &off);
-    if (ret <= 0) {
-        pr_info("load_dynamic_manager read err: %zd\n", ret);
-        goto exit;
-    }
-
-    if (ret != sizeof(loaded_config)) {
-        pr_err("load_dynamic_manager read incomplete config: %zd/%zu\n", ret, sizeof(loaded_config));
-        goto exit;
-    }
-
-    if (loaded_config.size < 0x100 || loaded_config.size > 0x1000) {
-        pr_err("Invalid saved config size: 0x%x\n", loaded_config.size);
-        goto exit;
-    }
-
-    if (strlen(loaded_config.hash) != 64) {
-        pr_err("Invalid saved config hash length: %zu\n", strlen(loaded_config.hash));
-        goto exit;
-    }
-
-    // Validate hash format
-    for (i = 0; i < 64; i++) {
-        char c = loaded_config.hash[i];
-        if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) {
-            pr_err("Invalid saved config hash character at position %d: %c\n", i, c);
-            goto exit;
-        }
-    }
-
-    spin_lock_irqsave(&dynamic_manager_lock, flags);
-    dynamic_manager = loaded_config;
-    spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-
-    pr_info("Dynamic sign config loaded: size=0x%x, hash=%.16s...\n", 
-            loaded_config.size, loaded_config.hash);
-
-exit:
-    filp_close(fp, 0);
-}
-
-static bool persistent_dynamic_manager(void)
-{
-    return ksu_queue_work(&save_dynamic_manager_work);
-}
-
-static void do_clear_dynamic_manager(struct work_struct *work)
-{
-    loff_t off = 0;
-    struct file *fp;
-    char zero_buffer[512];
-
-    memset(zero_buffer, 0, sizeof(zero_buffer));
-
-    fp = filp_open(KERNEL_SU_DYNAMIC_MANAGER, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-    if (IS_ERR(fp)) {
-        pr_err("clear_dynamic_manager create file failed: %ld\n", PTR_ERR(fp));
-        return;
-    }
-
-    // Write null bytes to overwrite the file content
-    if (kernel_write(fp, zero_buffer, sizeof(zero_buffer), &off) != sizeof(zero_buffer)) {
-        pr_err("clear_dynamic_manager write null bytes failed.\n");
-    } else {
-        pr_info("Dynamic sign config file cleared successfully\n");
-    }
-
-    filp_close(fp, 0);
-}
-
-static bool clear_dynamic_manager_file(void)
-{
-    return ksu_queue_work(&clear_dynamic_manager_work);
-}
-
-int ksu_handle_dynamic_manager(struct dynamic_manager_user_config *config)
-{
-    unsigned long flags;
-    int ret = 0;
-    int i;
-    
-    if (!config) {
-        return -EINVAL;
-    }
-    
-    switch (config->operation) {
-    case DYNAMIC_MANAGER_OP_SET:
-        if (config->size < 0x100 || config->size > 0x1000) {
-            pr_err("invalid size: 0x%x\n", config->size);
-            return -EINVAL;
-        }
-        
-        if (strlen(config->hash) != 64) {
-            pr_err("invalid hash length: %zu\n", strlen(config->hash));
-            return -EINVAL;
-        }
-        
-        // Validate hash format
-        for (i = 0; i < 64; i++) {
-            char c = config->hash[i];
-            if (!((c >= '0' && c <= '9') || (c >= 'a' && c <= 'f'))) {
-                pr_err("invalid hash character at position %d: %c\n", i, c);
-                return -EINVAL;
-            }
-        }
-        
-        spin_lock_irqsave(&dynamic_manager_lock, flags);
-        dynamic_manager.size = config->size;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
-        strscpy(dynamic_manager.hash, config->hash, sizeof(dynamic_manager.hash));
-#else
-        strlcpy(dynamic_manager.hash, config->hash, sizeof(dynamic_manager.hash));
-#endif
-        dynamic_manager.is_set = 1;
-        spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-        
-        persistent_dynamic_manager();
-        pr_info("dynamic manager updated: size=0x%x, hash=%.16s... (multi-manager enabled)\n", 
-                config->size, config->hash);
-        break;
-        
-    case DYNAMIC_MANAGER_OP_GET:
-        spin_lock_irqsave(&dynamic_manager_lock, flags);
-        if (dynamic_manager.is_set) {
-            config->size = dynamic_manager.size;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
-            strscpy(config->hash, dynamic_manager.hash, sizeof(config->hash));
-#else
-            strlcpy(config->hash, dynamic_manager.hash, sizeof(config->hash));
-#endif
-            ret = 0;
-        } else {
-            ret = -ENODATA;
-        }
-        spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-        break;
-        
-    case DYNAMIC_MANAGER_OP_CLEAR:
-        spin_lock_irqsave(&dynamic_manager_lock, flags);
-        dynamic_manager.size = 0x300;
-        strcpy(dynamic_manager.hash, "0000000000000000000000000000000000000000000000000000000000000000");
-        dynamic_manager.is_set = 0;
-        spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-        
-        // Clear only dynamic managers, preserve default manager
-        clear_dynamic_manager();
-        
-        // Clear file using the same method as save
-        clear_dynamic_manager_file();
-        
-        pr_info("Dynamic sign config cleared (multi-manager disabled)\n");
-        break;
-        
-    default:
-        pr_err("Invalid dynamic manager operation: %d\n", config->operation);
-        return -EINVAL;
-    }
-
-    return ret;
-}
-
-bool ksu_load_dynamic_manager(void)
-{
-    return ksu_queue_work(&load_dynamic_manager_work);
-}
-
-void ksu_dynamic_manager_init(void)
-{
-    int i;
-    
-    INIT_WORK(&save_dynamic_manager_work, do_save_dynamic_manager);
-    INIT_WORK(&load_dynamic_manager_work, do_load_dynamic_manager);
-    INIT_WORK(&clear_dynamic_manager_work, do_clear_dynamic_manager);
-    
-    // Initialize manager slots
-    for (i = 0; i < MAX_MANAGERS; i++) {
-        active_managers[i].is_active = false;
-    }
-
-    ksu_load_dynamic_manager();
-    
-    pr_info("Dynamic sign initialized with conditional multi-manager support\n");
-}
-
-void ksu_dynamic_manager_exit(void)
-{
-    clear_dynamic_manager();
-    
-    // Save current config before exit
-    do_save_dynamic_manager(NULL);
-    pr_info("Dynamic sign exited with persistent storage\n");
-}
-
-// Get dynamic manager configuration for signature verification
-bool ksu_get_dynamic_manager_config(unsigned int *size, const char **hash)
-{
-    unsigned long flags;
-    bool valid = false;
-    
-    spin_lock_irqsave(&dynamic_manager_lock, flags);
-    if (dynamic_manager.is_set) {
-        if (size) *size = dynamic_manager.size;
-        if (hash) *hash = dynamic_manager.hash;
-        valid = true;
-    }
-    spin_unlock_irqrestore(&dynamic_manager_lock, flags);
-    
-    return valid;
-}

kernel/dynamic_manager.h

@@ -1,51 +0,0 @@
-#ifndef __KSU_H_DYNAMIC_MANAGER
-#define __KSU_H_DYNAMIC_MANAGER
-
-#include <linux/types.h>
-#include "ksu.h"
-
-#define DYNAMIC_MANAGER_FILE_MAGIC 0x7f445347 // 'DSG', u32
-#define DYNAMIC_MANAGER_FILE_VERSION 1 // u32
-#define KERNEL_SU_DYNAMIC_MANAGER "/data/adb/ksu/.dynamic_manager"
-#define DYNAMIC_SIGN_INDEX 100
-
-struct dynamic_sign_key {
-    unsigned int size;
-    const char *hash;
-};
-
-#define DYNAMIC_SIGN_DEFAULT_CONFIG { \
-    .size = 0x300, \
-    .hash = "0000000000000000000000000000000000000000000000000000000000000000" \
-}
-
-struct dynamic_manager_config {
-    unsigned int size;
-    char hash[65];
-    int is_set;
-};
-
-struct manager_info {
-    uid_t uid;
-    int signature_index;
-    bool is_active;
-};
-
-// Dynamic sign operations
-void ksu_dynamic_manager_init(void);
-void ksu_dynamic_manager_exit(void);
-int ksu_handle_dynamic_manager(struct dynamic_manager_user_config *config);
-bool ksu_load_dynamic_manager(void);
-bool ksu_is_dynamic_manager_enabled(void);
-
-// Multi-manager operations
-void ksu_add_manager(uid_t uid, int signature_index);
-void ksu_remove_manager(uid_t uid);
-bool ksu_is_any_manager(uid_t uid);
-int ksu_get_manager_signature_index(uid_t uid);
-int ksu_get_active_managers(struct manager_list_info *info);
-
-// Configuration access for signature verification
-bool ksu_get_dynamic_manager_config(unsigned int *size, const char **hash);
-
-#endif

kernel/feature.c

@@ -1,173 +0,0 @@
-#include "feature.h"
-#include "klog.h" // IWYU pragma: keep
-
-#include <linux/mutex.h>
-
-static const struct ksu_feature_handler *feature_handlers[KSU_FEATURE_MAX];
-
-static DEFINE_MUTEX(feature_mutex);
-
-int ksu_register_feature_handler(const struct ksu_feature_handler *handler)
-{
-    if (!handler) {
-        pr_err("feature: register handler is NULL\n");
-        return -EINVAL;
-    }
-
-    if (handler->feature_id >= KSU_FEATURE_MAX) {
-        pr_err("feature: invalid feature_id %u\n", handler->feature_id);
-        return -EINVAL;
-    }
-
-    if (!handler->get_handler && !handler->set_handler) {
-        pr_err("feature: no handler provided for feature %u\n", handler->feature_id);
-        return -EINVAL;
-    }
-
-    mutex_lock(&feature_mutex);
-
-    if (feature_handlers[handler->feature_id]) {
-        pr_warn("feature: handler for %u already registered, overwriting\n",
-                handler->feature_id);
-    }
-
-    feature_handlers[handler->feature_id] = handler;
-
-    pr_info("feature: registered handler for %s (id=%u)\n",
-            handler->name ? handler->name : "unknown", handler->feature_id);
-
-    mutex_unlock(&feature_mutex);
-    return 0;
-}
-
-int ksu_unregister_feature_handler(u32 feature_id)
-{
-    int ret = 0;
-
-    if (feature_id >= KSU_FEATURE_MAX) {
-        pr_err("feature: invalid feature_id %u\n", feature_id);
-        return -EINVAL;
-    }
-
-    mutex_lock(&feature_mutex);
-
-    if (!feature_handlers[feature_id]) {
-        pr_warn("feature: no handler registered for %u\n", feature_id);
-        ret = -ENOENT;
-        goto out;
-    }
-
-    feature_handlers[feature_id] = NULL;
-
-    pr_info("feature: unregistered handler for id=%u\n", feature_id);
-
-out:
-    mutex_unlock(&feature_mutex);
-    return ret;
-}
-
-int ksu_get_feature(u32 feature_id, u64 *value, bool *supported)
-{
-    int ret = 0;
-    const struct ksu_feature_handler *handler;
-
-    if (feature_id >= KSU_FEATURE_MAX) {
-        pr_err("feature: invalid feature_id %u\n", feature_id);
-        return -EINVAL;
-    }
-
-    if (!value || !supported) {
-        pr_err("feature: invalid parameters\n");
-        return -EINVAL;
-    }
-
-    mutex_lock(&feature_mutex);
-
-    handler = feature_handlers[feature_id];
-
-    if (!handler) {
-        *supported = false;
-        *value = 0;
-        pr_debug("feature: feature %u not supported\n", feature_id);
-        goto out;
-    }
-
-    *supported = true;
-
-    if (!handler->get_handler) {
-        pr_warn("feature: no get_handler for feature %u\n", feature_id);
-        ret = -EOPNOTSUPP;
-        goto out;
-    }
-
-    ret = handler->get_handler(value);
-    if (ret) {
-        pr_err("feature: get_handler for %u failed: %d\n", feature_id, ret);
-    }
-
-out:
-    mutex_unlock(&feature_mutex);
-    return ret;
-}
-
-int ksu_set_feature(u32 feature_id, u64 value)
-{
-    int ret = 0;
-    const struct ksu_feature_handler *handler;
-
-    if (feature_id >= KSU_FEATURE_MAX) {
-        pr_err("feature: invalid feature_id %u\n", feature_id);
-        return -EINVAL;
-    }
-
-    mutex_lock(&feature_mutex);
-
-    handler = feature_handlers[feature_id];
-
-    if (!handler) {
-        pr_err("feature: feature %u not registered\n", feature_id);
-        ret = -EOPNOTSUPP;
-        goto out;
-    }
-
-    if (!handler->set_handler) {
-        pr_warn("feature: no set_handler for feature %u\n", feature_id);
-        ret = -EOPNOTSUPP;
-        goto out;
-    }
-
-    ret = handler->set_handler(value);
-    if (ret) {
-        pr_err("feature: set_handler for %u failed: %d\n", feature_id, ret);
-    }
-
-out:
-    mutex_unlock(&feature_mutex);
-    return ret;
-}
-
-void ksu_feature_init(void)
-{
-    int i;
-
-    for (i = 0; i < KSU_FEATURE_MAX; i++) {
-        feature_handlers[i] = NULL;
-    }
-
-    pr_info("feature: feature management initialized\n");
-}
-
-void ksu_feature_exit(void)
-{
-    int i;
-
-    mutex_lock(&feature_mutex);
-
-    for (i = 0; i < KSU_FEATURE_MAX; i++) {
-        feature_handlers[i] = NULL;
-    }
-
-    mutex_unlock(&feature_mutex);
-
-    pr_info("feature: feature management cleaned up\n");
-}

kernel/feature.h

@@ -1,37 +0,0 @@
-#ifndef __KSU_H_FEATURE
-#define __KSU_H_FEATURE
-
-#include <linux/types.h>
-
-enum ksu_feature_id {
-    KSU_FEATURE_SU_COMPAT = 0,
-    KSU_FEATURE_KERNEL_UMOUNT = 1,
-    KSU_FEATURE_ENHANCED_SECURITY = 2,
-    KSU_FEATURE_SULOG = 3,
-
-    KSU_FEATURE_MAX
-};
-
-typedef int (*ksu_feature_get_t)(u64 *value);
-typedef int (*ksu_feature_set_t)(u64 value);
-
-struct ksu_feature_handler {
-    u32 feature_id;
-    const char *name;
-    ksu_feature_get_t get_handler;
-    ksu_feature_set_t set_handler;
-};
-
-int ksu_register_feature_handler(const struct ksu_feature_handler *handler);
-
-int ksu_unregister_feature_handler(u32 feature_id);
-
-int ksu_get_feature(u32 feature_id, u64 *value, bool *supported);
-
-int ksu_set_feature(u32 feature_id, u64 value);
-
-void ksu_feature_init(void);
-
-void ksu_feature_exit(void);
-
-#endif // __KSU_H_FEATURE

kernel/file_wrapper.c

@@ -1,341 +0,0 @@
-#include <linux/export.h>
-#include <linux/anon_inodes.h>
-#include <linux/capability.h>
-#include <linux/cred.h>
-#include <linux/err.h>
-#include <linux/file.h>
-#include <linux/fs.h>
-#include <linux/seq_file.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-#include <linux/version.h>
-
-#include "klog.h" // IWYU pragma: keep
-#include "selinux/selinux.h"
-
-#include "file_wrapper.h"
-
-static loff_t ksu_wrapper_llseek(struct file *fp, loff_t off, int flags) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->llseek(data->orig, off, flags);
-}
-
-static ssize_t ksu_wrapper_read(struct file *fp, char __user *ptr, size_t sz, loff_t *off) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->read(orig, ptr, sz, off);
-}
-
-static ssize_t ksu_wrapper_write(struct file *fp, const char __user *ptr, size_t sz, loff_t *off) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->write(orig, ptr, sz, off);
-}
-
-static ssize_t ksu_wrapper_read_iter(struct kiocb *iocb, struct iov_iter *iovi) {
-	struct ksu_file_wrapper* data = iocb->ki_filp->private_data;
-	struct file* orig = data->orig;
-	iocb->ki_filp = orig;
-	return orig->f_op->read_iter(iocb, iovi);
-}
-
-static ssize_t ksu_wrapper_write_iter(struct kiocb *iocb, struct iov_iter *iovi) {
-	struct ksu_file_wrapper* data = iocb->ki_filp->private_data;
-	struct file* orig = data->orig;
-	iocb->ki_filp = orig;
-	return orig->f_op->write_iter(iocb, iovi);
-}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
-static int ksu_wrapper_iopoll(struct kiocb *kiocb, struct io_comp_batch* icb, unsigned int v) {
-	struct ksu_file_wrapper* data = kiocb->ki_filp->private_data;
-	struct file* orig = data->orig;
-	kiocb->ki_filp = orig;
-	return orig->f_op->iopoll(kiocb, icb, v);
-}
-#else
-static int ksu_wrapper_iopoll(struct kiocb *kiocb, bool spin) {
-	struct ksu_file_wrapper* data = kiocb->ki_filp->private_data;
-	struct file* orig = data->orig;
-	kiocb->ki_filp = orig;
-	return orig->f_op->iopoll(kiocb, spin);
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
-static int ksu_wrapper_iterate (struct file *fp, struct dir_context *dc) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->iterate(orig, dc);
-}
-#endif
-
-static int ksu_wrapper_iterate_shared(struct file *fp, struct dir_context *dc) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->iterate_shared(orig, dc);
-}
-
-static __poll_t ksu_wrapper_poll(struct file *fp, struct poll_table_struct *pts) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->poll(orig, pts);
-}
-
-static long ksu_wrapper_unlocked_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->unlocked_ioctl(orig, cmd, arg);
-}
-
-static long ksu_wrapper_compat_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->compat_ioctl(orig, cmd, arg);
-}
-
-static int ksu_wrapper_mmap(struct file *fp, struct vm_area_struct * vma) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->mmap(orig, vma);
-}
-
-// static unsigned long mmap_supported_flags {}
-
-static int ksu_wrapper_open(struct inode *ino, struct file *fp) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	struct inode *orig_ino = file_inode(orig);
-	return orig->f_op->open(orig_ino, orig);
-}
-
-static int ksu_wrapper_flush(struct file *fp, fl_owner_t id) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->flush(orig, id);
-}
-
-
-static int ksu_wrapper_fsync(struct file *fp, loff_t off1, loff_t off2, int datasync) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->fsync(orig, off1, off2, datasync);
-}
-
-static int ksu_wrapper_fasync(int arg, struct file *fp, int arg2) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->fasync(arg, orig, arg2);
-}
-
-static int ksu_wrapper_lock(struct file *fp, int arg1, struct file_lock *fl) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	return orig->f_op->lock(orig, arg1, fl);
-}
-
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
-static ssize_t ksu_wrapper_sendpage(struct file *fp, struct page *pg, int arg1, size_t sz, loff_t *off, int arg2) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->sendpage) {
-		return orig->f_op->sendpage(orig, pg, arg1, sz, off, arg2);
-	}
-	return -EINVAL;
-}
-#endif
-
-static unsigned long ksu_wrapper_get_unmapped_area(struct file *fp, unsigned long arg1, unsigned long arg2, unsigned long arg3, unsigned long arg4) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->get_unmapped_area) {
-		return orig->f_op->get_unmapped_area(orig, arg1, arg2, arg3, arg4);
-	}
-	return -EINVAL;
-}
-
-// static int ksu_wrapper_check_flags(int arg) {}
-
-static int ksu_wrapper_flock(struct file *fp, int arg1, struct file_lock *fl) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->flock) {
-		return orig->f_op->flock(orig, arg1, fl);
-	}
-	return -EINVAL;
-}
-
-static ssize_t ksu_wrapper_splice_write(struct pipe_inode_info * pii, struct file *fp, loff_t *off, size_t sz, unsigned int arg1) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->splice_write) {
-		return orig->f_op->splice_write(pii, orig, off, sz, arg1);
-	}
-	return -EINVAL;
-}
-
-static ssize_t ksu_wrapper_splice_read(struct file *fp, loff_t *off, struct pipe_inode_info *pii, size_t sz, unsigned int arg1) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->splice_read) {
-		return orig->f_op->splice_read(orig, off, pii, sz, arg1);
-	}
-	return -EINVAL;
-}
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
-void ksu_wrapper_splice_eof(struct file *fp) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->splice_eof) {
-		return orig->f_op->splice_eof(orig);
-	}
-}
-#endif
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
-static int ksu_wrapper_setlease(struct file *fp, int arg1, struct file_lease **fl, void **p) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->setlease) {
-		return orig->f_op->setlease(orig, arg1, fl, p);
-	}
-	return -EINVAL;
-}
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
-static int ksu_wrapper_setlease(struct file *fp, int arg1, struct file_lock **fl, void **p) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->setlease) {
-		return orig->f_op->setlease(orig, arg1, fl, p);
-	}
-	return -EINVAL;
-}
-#else
-static int ksu_wrapper_setlease(struct file *fp, long arg1, struct file_lock **fl, void **p) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->setlease) {
-		return orig->f_op->setlease(orig, arg1, fl, p);
-	}
-	return -EINVAL;
-}
-#endif
-
-static long ksu_wrapper_fallocate(struct file *fp, int mode, loff_t offset, loff_t len) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->fallocate) {
-		return orig->f_op->fallocate(orig, mode, offset, len);
-	}
-	return -EINVAL;
-}
-
-static void ksu_wrapper_show_fdinfo(struct seq_file *m, struct file *f) {
-	struct ksu_file_wrapper* data = f->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->show_fdinfo) {
-		orig->f_op->show_fdinfo(m, orig);
-	}
-}
-
-static ssize_t ksu_wrapper_copy_file_range(struct file *f1, loff_t off1, struct file *f2,
-		loff_t off2, size_t sz, unsigned int flags) {
-	// TODO: determine which file to use
-	struct ksu_file_wrapper* data = f1->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->copy_file_range) {
-		return orig->f_op->copy_file_range(orig, off1, f2, off2, sz, flags);
-	}
-	return -EINVAL;
-}
-
-static loff_t ksu_wrapper_remap_file_range(struct file *file_in, loff_t pos_in,
-				struct file *file_out, loff_t pos_out,
-				loff_t len, unsigned int remap_flags) {
-	// TODO: determine which file to use
-	struct ksu_file_wrapper* data = file_in->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->remap_file_range) {
-		return orig->f_op->remap_file_range(orig, pos_in, file_out, pos_out, len, remap_flags);
-	}
-	return -EINVAL;
-}
-
-static int ksu_wrapper_fadvise(struct file *fp, loff_t off1, loff_t off2, int flags) {
-	struct ksu_file_wrapper* data = fp->private_data;
-	struct file* orig = data->orig;
-	if (orig->f_op->fadvise) {
-		return orig->f_op->fadvise(orig, off1, off2, flags);
-	}
-	return -EINVAL;
-}
-
-static int ksu_wrapper_release(struct inode *inode, struct file *filp) {
-	ksu_delete_file_wrapper(filp->private_data);
-    return 0;
-}
-
-struct ksu_file_wrapper* ksu_create_file_wrapper(struct file* fp) {
-	struct ksu_file_wrapper* p = kcalloc(sizeof(struct ksu_file_wrapper), 1, GFP_KERNEL);
-	if (!p) {
-		return NULL;
-	}
-
-	get_file(fp);
-
-	p->orig = fp;
-	p->ops.owner = THIS_MODULE;
-	p->ops.llseek = fp->f_op->llseek ? ksu_wrapper_llseek : NULL;
-	p->ops.read = fp->f_op->read ? ksu_wrapper_read : NULL;
-	p->ops.write = fp->f_op->write ? ksu_wrapper_write : NULL;
-	p->ops.read_iter = fp->f_op->read_iter ? ksu_wrapper_read_iter : NULL;
-	p->ops.write_iter = fp->f_op->write_iter ? ksu_wrapper_write_iter : NULL;
-	p->ops.iopoll = fp->f_op->iopoll ? ksu_wrapper_iopoll : NULL;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
-	p->ops.iterate = fp->f_op->iterate ? ksu_wrapper_iterate : NULL;
-#endif
-	p->ops.iterate_shared = fp->f_op->iterate_shared ? ksu_wrapper_iterate_shared : NULL;
-	p->ops.poll = fp->f_op->poll ? ksu_wrapper_poll : NULL;
-	p->ops.unlocked_ioctl = fp->f_op->unlocked_ioctl ? ksu_wrapper_unlocked_ioctl : NULL;
-	p->ops.compat_ioctl = fp->f_op->compat_ioctl ? ksu_wrapper_compat_ioctl : NULL;
-	p->ops.mmap = fp->f_op->mmap ? ksu_wrapper_mmap : NULL;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
-	p->ops.fop_flags = fp->f_op->fop_flags;
-#else
-	p->ops.mmap_supported_flags = fp->f_op->mmap_supported_flags;
-#endif
-	p->ops.open = fp->f_op->open ? ksu_wrapper_open : NULL;
-	p->ops.flush = fp->f_op->flush ? ksu_wrapper_flush : NULL;
-	p->ops.release = ksu_wrapper_release;
-	p->ops.fsync = fp->f_op->fsync ? ksu_wrapper_fsync : NULL;
-	p->ops.fasync = fp->f_op->fasync ? ksu_wrapper_fasync : NULL;
-	p->ops.lock = fp->f_op->lock ? ksu_wrapper_lock : NULL;
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0)
-	p->ops.sendpage = fp->f_op->sendpage ? ksu_wrapper_sendpage : NULL;
-#endif
-	p->ops.get_unmapped_area = fp->f_op->get_unmapped_area ? ksu_wrapper_get_unmapped_area : NULL;
-	p->ops.check_flags = fp->f_op->check_flags;
-	p->ops.flock = fp->f_op->flock ? ksu_wrapper_flock : NULL;
-	p->ops.splice_write = fp->f_op->splice_write ? ksu_wrapper_splice_write : NULL;
-	p->ops.splice_read = fp->f_op->splice_read ? ksu_wrapper_splice_read : NULL;
-	p->ops.setlease = fp->f_op->setlease ? ksu_wrapper_setlease : NULL;
-	p->ops.fallocate = fp->f_op->fallocate ? ksu_wrapper_fallocate : NULL;
-	p->ops.show_fdinfo = fp->f_op->show_fdinfo ? ksu_wrapper_show_fdinfo : NULL;
-	p->ops.copy_file_range = fp->f_op->copy_file_range ? ksu_wrapper_copy_file_range : NULL;
-	p->ops.remap_file_range = fp->f_op->remap_file_range ? ksu_wrapper_remap_file_range : NULL;
-	p->ops.fadvise = fp->f_op->fadvise ? ksu_wrapper_fadvise : NULL;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)
-	p->ops.splice_eof = fp->f_op->splice_eof ? ksu_wrapper_splice_eof : NULL;
-#endif
-
-	return p;
-}
-
-void ksu_delete_file_wrapper(struct ksu_file_wrapper* data) {
-	fput((struct file*) data->orig);
-	kfree(data);
-}

kernel/file_wrapper.h

@@ -1,14 +0,0 @@
-#ifndef KSU_FILE_WRAPPER_H
-#define KSU_FILE_WRAPPER_H
-
-#include <linux/file.h>
-#include <linux/fs.h>
-
-struct ksu_file_wrapper {
-	struct file* orig;
-	struct file_operations ops;
-};
-
-struct ksu_file_wrapper* ksu_create_file_wrapper(struct file* fp);
-void ksu_delete_file_wrapper(struct ksu_file_wrapper* data);
-#endif // KSU_FILE_WRAPPER_H

kernel/include/ksu_hook.h

@@ -0,0 +1,28 @@
+#ifndef __KSU_H_KSHOOK
+#define __KSU_H_KSHOOK
+
+#include <linux/fs.h>
+#include <linux/types.h>
+
+// For sucompat
+
+int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode,
+			 int *flags);
+
+int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags);
+
+// For ksud
+
+int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
+			size_t *count_ptr, loff_t **pos);
+
+// For ksud and sucompat
+
+int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv,
+			void *envp, int *flags);
+
+// For volume button
+int ksu_handle_input_handle_event(unsigned int *type, unsigned int *code, 
+				  int *value);
+
+#endif

kernel/kernel_compat.c

@@ -0,0 +1,88 @@
+#include <linux/version.h>
+#include <linux/fs.h>
+#include <linux/nsproxy.h>
+#include <linux/sched/task.h>
+#include <linux/uaccess.h>
+#include "klog.h" // IWYU pragma: keep
+#include "kernel_compat.h"
+
+extern struct task_struct init_task;
+
+// mnt_ns context switch for environment that android_init->nsproxy->mnt_ns != init_task.nsproxy->mnt_ns, such as WSA
+struct ksu_ns_fs_saved {
+	struct nsproxy *ns;
+	struct fs_struct *fs;
+};
+
+static void ksu_save_ns_fs(struct ksu_ns_fs_saved *ns_fs_saved)
+{
+	ns_fs_saved->ns = current->nsproxy;
+	ns_fs_saved->fs = current->fs;
+}
+
+static void ksu_load_ns_fs(struct ksu_ns_fs_saved *ns_fs_saved)
+{
+	current->nsproxy = ns_fs_saved->ns;
+	current->fs = ns_fs_saved->fs;
+}
+
+static bool android_context_saved_checked = false;
+static bool android_context_saved_enabled = false;
+static struct ksu_ns_fs_saved android_context_saved;
+
+void ksu_android_ns_fs_check()
+{
+	if (android_context_saved_checked)
+		return;
+	android_context_saved_checked = true;
+	task_lock(current);
+	if (current->nsproxy && current->fs &&
+	    current->nsproxy->mnt_ns != init_task.nsproxy->mnt_ns) {
+		android_context_saved_enabled = true;
+		pr_info("android context saved enabled due to init mnt_ns(%p) != android mnt_ns(%p)\n",
+			current->nsproxy->mnt_ns, init_task.nsproxy->mnt_ns);
+		ksu_save_ns_fs(&android_context_saved);
+	} else {
+		pr_info("android context saved disabled\n");
+	}
+	task_unlock(current);
+}
+
+struct file *ksu_filp_open_compat(const char *filename, int flags, umode_t mode)
+{
+	// switch mnt_ns even if current is not wq_worker, to ensure what we open is the correct file in android mnt_ns, rather than user created mnt_ns
+	struct ksu_ns_fs_saved saved;
+	if (android_context_saved_enabled) {
+		pr_info("start switch current nsproxy and fs to android context\n");
+		task_lock(current);
+		ksu_save_ns_fs(&saved);
+		ksu_load_ns_fs(&android_context_saved);
+		task_unlock(current);
+	}
+	struct file *fp = filp_open(filename, flags, mode);
+	if (android_context_saved_enabled) {
+		task_lock(current);
+		ksu_load_ns_fs(&saved);
+		task_unlock(current);
+		pr_info("switch current nsproxy and fs back to saved successfully\n");
+	}
+	return fp;
+}
+
+ssize_t ksu_kernel_read_compat(struct file *p, void *buf, size_t count,
+			       loff_t *pos)
+{
+	return kernel_read(p, buf, count, pos);
+}
+
+ssize_t ksu_kernel_write_compat(struct file *p, const void *buf, size_t count,
+				loff_t *pos)
+{
+	return kernel_write(p, buf, count, pos);
+}
+
+long ksu_strncpy_from_user_nofault(char *dst, const void __user *unsafe_addr,
+				   long count)
+{
+	return strncpy_from_user_nofault(dst, unsafe_addr, count);
+}

kernel/kernel_compat.h

@@ -3,22 +3,33 @@
 
 #include <linux/fs.h>
 #include <linux/version.h>
+#include "ss/policydb.h"
+#include "linux/key.h"
 
 /*
- * ksu_copy_from_user_retry
- * try nofault copy first, if it fails, try with plain
- * paramters are the same as copy_from_user
- * 0 = success
+ * Adapt to Huawei HISI kernel without affecting other kernels ,
+ * Huawei Hisi Kernel EBITMAP Enable or Disable Flag ,
+ * From ss/ebitmap.h
  */
-static long ksu_copy_from_user_retry(void *to, 
-        const void __user *from, unsigned long count)
-{
-    long ret = copy_from_user_nofault(to, from, count);
-    if (likely(!ret))
-        return ret;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)) &&                           \
+		(LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0)) ||               \
+	(LINUX_VERSION_CODE >= KERNEL_VERSION(4, 14, 0)) &&                      \
+		(LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0))
+#ifdef HISI_SELINUX_EBITMAP_RO
+#define CONFIG_IS_HW_HISI
+#endif
+#endif
 
-    // we faulted! fallback to slow path
-    return copy_from_user(to, from, count);
-}
+extern long ksu_strncpy_from_user_nofault(char *dst,
+					  const void __user *unsafe_addr,
+					  long count);
+
+extern void ksu_android_ns_fs_check();
+extern struct file *ksu_filp_open_compat(const char *filename, int flags,
+					 umode_t mode);
+extern ssize_t ksu_kernel_read_compat(struct file *p, void *buf, size_t count,
+				      loff_t *pos);
+extern ssize_t ksu_kernel_write_compat(struct file *p, const void *buf,
+				       size_t count, loff_t *pos);
 
 #endif

kernel/kernel_umount.c

@@ -1,181 +0,0 @@
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/task_work.h>
-#include <linux/cred.h>
-#include <linux/fs.h>
-#include <linux/mount.h>
-#include <linux/namei.h>
-#include <linux/nsproxy.h>
-#include <linux/path.h>
-#include <linux/printk.h>
-#include <linux/types.h>
-
-#include "kernel_umount.h"
-#include "klog.h" // IWYU pragma: keep
-#include "allowlist.h"
-#include "selinux/selinux.h"
-#include "feature.h"
-#include "ksud.h"
-
-#include "umount_manager.h"
-#include "sulog.h"
-
-static bool ksu_kernel_umount_enabled = true;
-
-static int kernel_umount_feature_get(u64 *value)
-{
-    *value = ksu_kernel_umount_enabled ? 1 : 0;
-    return 0;
-}
-
-static int kernel_umount_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    ksu_kernel_umount_enabled = enable;
-    pr_info("kernel_umount: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler kernel_umount_handler = {
-    .feature_id = KSU_FEATURE_KERNEL_UMOUNT,
-    .name = "kernel_umount",
-    .get_handler = kernel_umount_feature_get,
-    .set_handler = kernel_umount_feature_set,
-};
-
-extern int path_umount(struct path *path, int flags);
-
-static void ksu_umount_mnt(struct path *path, int flags)
-{
-    int err = path_umount(path, flags);
-    if (err) {
-        pr_info("umount %s failed: %d\n", path->dentry->d_iname, err);
-    }
-}
-
-void try_umount(const char *mnt, int flags)
-{
-    struct path path;
-    int err = kern_path(mnt, 0, &path);
-    if (err) {
-        return;
-    }
-
-    if (path.dentry != path.mnt->mnt_root) {
-        // it is not root mountpoint, maybe umounted by others already.
-        path_put(&path);
-        return;
-    }
-
-    ksu_umount_mnt(&path, flags);
-}
-
-struct umount_tw {
-    struct callback_head cb;
-    const struct cred *old_cred;
-};
-
-static void umount_tw_func(struct callback_head *cb)
-{
-    struct umount_tw *tw = container_of(cb, struct umount_tw, cb);
-    const struct cred *saved = NULL;
-    if (tw->old_cred) {
-        saved = override_creds(tw->old_cred);
-    }
-
-    struct mount_entry *entry;
-    down_read(&mount_list_lock);
-    list_for_each_entry(entry, &mount_list, list) {
-        pr_info("%s: unmounting: %s flags 0x%x\n", __func__, entry->umountable, entry->flags);
-        try_umount(entry->umountable, entry->flags);
-    }
-    up_read(&mount_list_lock);
-
-    ksu_umount_manager_execute_all(tw->old_cred);
-
-    if (saved)
-        revert_creds(saved);
-
-    if (tw->old_cred)
-        put_cred(tw->old_cred);
-
-    kfree(tw);
-}
-
-int ksu_handle_umount(uid_t old_uid, uid_t new_uid)
-{
-    struct umount_tw *tw;
-
-    // if there isn't any module mounted, just ignore it!
-    if (!ksu_module_mounted) {
-        return 0;
-    }
-
-    if (!ksu_kernel_umount_enabled) {
-        return 0;
-    }
-
-    // There are 5 scenarios:
-    // 1. Normal app: zygote -> appuid
-    // 2. Isolated process forked from zygote: zygote -> isolated_process
-    // 3. App zygote forked from zygote: zygote -> appuid
-    // 4. Isolated process froked from app zygote: appuid -> isolated_process (already handled by 3)
-    // 5. Isolated process froked from webview zygote (no need to handle, app cannot run custom code)
-    if (!is_appuid(new_uid) && !is_isolated_process(new_uid)) {
-        return 0;
-    }
-
-    if (!ksu_uid_should_umount(new_uid) && !is_isolated_process(new_uid)) {
-        return 0;
-    }
-
-    // check old process's selinux context, if it is not zygote, ignore it!
-    // because some su apps may setuid to untrusted_app but they are in global mount namespace
-    // when we umount for such process, that is a disaster!
-    // also handle case 4 and 5
-    bool is_zygote_child = is_zygote(get_current_cred());
-    if (!is_zygote_child) {
-        pr_info("handle umount ignore non zygote child: %d\n", current->pid);
-        return 0;
-    }
-#if __SULOG_GATE
-    ksu_sulog_report_syscall(new_uid, NULL, "setuid", NULL);
-#endif
-    // umount the target mnt
-    pr_info("handle umount for uid: %d, pid: %d\n", new_uid, current->pid);
-
-    tw = kzalloc(sizeof(*tw), GFP_ATOMIC);
-    if (!tw)
-        return 0;
-
-    tw->old_cred = get_current_cred();
-    tw->cb.func = umount_tw_func;
-
-    int err = task_work_add(current, &tw->cb, TWA_RESUME);
-    if (err) {
-        if (tw->old_cred) {
-            put_cred(tw->old_cred);
-        }
-        kfree(tw);
-        pr_warn("unmount add task_work failed\n");
-    }
-
-    return 0;
-}
-
-void ksu_kernel_umount_init(void)
-{
-    int rc = 0;
-    rc = ksu_umount_manager_init();
-    if (rc) {
-        pr_err("Failed to initialize umount manager: %d\n", rc);
-    }
-    if (ksu_register_feature_handler(&kernel_umount_handler)) {
-        pr_err("Failed to register kernel_umount feature handler\n");
-    }
-}
-
-void ksu_kernel_umount_exit(void)
-{
-    ksu_unregister_feature_handler(KSU_FEATURE_KERNEL_UMOUNT);
-}

kernel/kernel_umount.h

@@ -1,25 +0,0 @@
-#ifndef __KSU_H_KERNEL_UMOUNT
-#define __KSU_H_KERNEL_UMOUNT
-
-#include <linux/types.h>
-#include <linux/list.h>
-#include <linux/rwsem.h>
-
-void ksu_kernel_umount_init(void);
-void ksu_kernel_umount_exit(void);
-
-void try_umount(const char *mnt, int flags);
-
-// Handler function to be called from setresuid hook
-int ksu_handle_umount(uid_t old_uid, uid_t new_uid);
-
-// for the umount list
-struct mount_entry {
-    char *umountable;
-    unsigned int flags;
-    struct list_head list;
-};
-extern struct list_head mount_list;
-extern struct rw_semaphore mount_list_lock;
-
-#endif

kernel/kpm/compact.c

@@ -13,7 +13,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
-#include <asm/elf.h>
+#include <asm/elf.h>    /* 包含 ARM64 重定位类型定义 */
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
 #include <linux/string.h>
@@ -29,44 +29,44 @@
 #include "../allowlist.h"
 #include "../manager.h"
 
-static int sukisu_is_su_allow_uid(uid_t uid)
-{
-    return ksu_is_allow_uid_for_current(uid) ? 1 : 0;
+unsigned long sukisu_compact_find_symbol(const char* name);
+
+// ======================================================================
+// 兼容函数 for KPM
+
+static
+int sukisu_is_su_allow_uid(uid_t uid) {
+    return ksu_is_allow_uid(uid) ? 1 : 0;
 }
 
-static int sukisu_get_ap_mod_exclude(uid_t uid)
-{
-    return 0; /* Not supported */
+static
+int sukisu_get_ap_mod_exclude(uid_t uid) {
+    // Not supported
+    return 0;
 }
 
-static int sukisu_is_uid_should_umount(uid_t uid)
-{
+static
+int sukisu_is_uid_should_umount(uid_t uid) {
     return ksu_uid_should_umount(uid) ? 1 : 0;
 }
 
-static int sukisu_is_current_uid_manager(void)
-{
+static
+int sukisu_is_current_uid_manager() {
     return is_manager();
 }
 
-static uid_t sukisu_get_manager_uid(void)
-{
+static
+uid_t sukisu_get_manager_uid() {
     return ksu_manager_uid;
 }
 
-static void sukisu_set_manager_uid(uid_t uid, int force)
-{
-    if (force || ksu_manager_uid == -1)
-        ksu_manager_uid = uid;
-}
+// ======================================================================
 
 struct CompactAddressSymbol {
     const char* symbol_name;
     void* addr;
 };
 
-unsigned long sukisu_compact_find_symbol(const char *name);
-
 static struct CompactAddressSymbol address_symbol [] = {
     { "kallsyms_lookup_name", &kallsyms_lookup_name },
     { "compact_find_symbol", &sukisu_compact_find_symbol },
@@ -75,26 +75,28 @@ static struct CompactAddressSymbol address_symbol[] = {
     { "get_ap_mod_exclude", &sukisu_get_ap_mod_exclude },
     { "is_uid_should_umount", &sukisu_is_uid_should_umount },
     { "is_current_uid_manager", &sukisu_is_current_uid_manager },
-    { "get_manager_uid", &sukisu_get_manager_uid },
-    { "sukisu_set_manager_uid", &sukisu_set_manager_uid }
+    { "get_manager_uid", &sukisu_get_manager_uid }
 };
 
-unsigned long sukisu_compact_find_symbol(const char* name)
-{
+unsigned long sukisu_compact_find_symbol(const char* name) {
     int i;
     unsigned long addr;
 
+    // 先自己在地址表部分查出来
     for(i = 0; i < (sizeof(address_symbol) / sizeof(struct CompactAddressSymbol)); i++) {
         struct CompactAddressSymbol* symbol = &address_symbol[i];
-        
-        if (strcmp(name, symbol->symbol_name) == 0)
+        if(strcmp(name, symbol->symbol_name) == 0) {
             return (unsigned long) symbol->addr;
         }
+    }
 
+    // 通过内核来查
     addr = kallsyms_lookup_name(name);
-    if (addr)
+    if(addr) {
         return addr;
+    }
 
     return 0;
 }
+
 EXPORT_SYMBOL(sukisu_compact_find_symbol);

kernel/kpm/compact.h

@@ -1,6 +1,6 @@
-#ifndef __SUKISU_KPM_COMPACT_H
-#define __SUKISU_KPM_COMPACT_H
+#ifndef ___SUKISU_KPM_COMPACT_H
+#define ___SUKISU_KPM_COMPACT_H
 
-extern unsigned long sukisu_compact_find_symbol(const char *name);
+unsigned long sukisu_compact_find_symbol(const char* name);
 
 #endif

kernel/kpm/kpm.c

@@ -8,11 +8,13 @@
  * 集成了 ELF 解析、内存布局、符号处理、重定位（支持 ARM64 重定位类型）
  * 并参照KernelPatch的标准KPM格式实现加载和控制
  */
-
+#include <linux/export.h>
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/kernfs.h>
 #include <linux/file.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/uaccess.h>
 #include <linux/elf.h>
@@ -21,26 +23,27 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
-#include <asm/elf.h>
+#include <asm/elf.h>    /* 包含 ARM64 重定位类型定义 */
+#include <linux/vmalloc.h>
 #include <linux/mm.h>
 #include <linux/string.h>
 #include <asm/cacheflush.h>
 #include <linux/module.h>
+#include <linux/vmalloc.h>
 #include <linux/set_memory.h>
+#include <linux/version.h>
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <asm/insn.h>
 #include <linux/kprobes.h>
 #include <linux/stacktrace.h>
+#include <linux/kallsyms.h>
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5,0,0) && defined(CONFIG_MODULES)
-#include <linux/moduleloader.h>
+#include <linux/moduleloader.h> // 需要启用 CONFIG_MODULES
 #endif
 #include "kpm.h"
 #include "compact.h"
 
-#define KPM_NAME_LEN 32
-#define KPM_ARGS_LEN 1024
-
 #ifndef NO_OPTIMIZE
 #if defined(__GNUC__) && !defined(__clang__)
     #define NO_OPTIMIZE __attribute__((optimize("O0")))
@@ -51,232 +54,131 @@
 #endif
 #endif
 
-noinline NO_OPTIMIZE void sukisu_kpm_load_module_path(const char *path,
-                const char *args, void *ptr, int *result)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_load_module_path). "
-                    "path=%s args=%s ptr=%p\n", path, args, ptr);
+// ============================================================================================
 
-    __asm__ volatile("nop");
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_load_module_path(const char* path, const char* args, void* ptr, void __user* result) {
+    // This is a KPM module stub.
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_load_module_path). path=%s args=%s ptr=%p\n", path, args, ptr);
+    __asm__ volatile("nop");  // 精确控制循环不被优化
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
 }
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_unload_module(const char* name, void* ptr, void __user* result) {
+    // This is a KPM module stub.
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_unload_module). name=%s ptr=%p\n", name, ptr);
+    __asm__ volatile("nop");  // 精确控制循环不被优化
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_num(void __user* result) {
+    // This is a KPM module stub.
+    int res = 0;
+    printk("KPM: Stub function called (sukisu_kpm_num).\n");
+    __asm__ volatile("nop");  // 精确控制循环不被优化
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_info(const char* name, void __user* out, void __user* result) {
+    // This is a KPM module stub.
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_info). name=%s buffer=%p\n", name, out);
+    __asm__ volatile("nop");  // 精确控制循环不被优化
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_list(void __user* out, unsigned int bufferSize, void __user* result) {
+    // This is a KPM module stub.
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_list). buffer=%p size=%d\n", out, bufferSize);
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_control(void __user* name, void __user* args, void __user* result) {
+    // This is a KPM module stub.
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_control). name=%p args=%p\n", name, args);
+    __asm__ volatile("nop");  // 精确控制循环不被优化
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
+noinline
+NO_OPTIMIZE
+void sukisu_kpm_version(void __user* out, unsigned int bufferSize, void __user* result) {
+    int res = -1;
+    printk("KPM: Stub function called (sukisu_kpm_version). buffer=%p size=%d\n", out, bufferSize);
+    if(copy_to_user(result, &res, sizeof(res)) < 1) printk("KPM: Copy to user faild.");
+}
+
 EXPORT_SYMBOL(sukisu_kpm_load_module_path);
-
-noinline NO_OPTIMIZE void sukisu_kpm_unload_module(const char *name,
-                void *ptr, int *result)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_unload_module). "
-                    "name=%s ptr=%p\n", name, ptr);
-
-    __asm__ volatile("nop");
-}
 EXPORT_SYMBOL(sukisu_kpm_unload_module);
-
-noinline NO_OPTIMIZE void sukisu_kpm_num(int *result)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_num).\n");
-
-    __asm__ volatile("nop");
-}
 EXPORT_SYMBOL(sukisu_kpm_num);
-
-noinline NO_OPTIMIZE void sukisu_kpm_info(const char *name, char *buf, int bufferSize,
-                int *size)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_info). "
-                    "name=%s buffer=%p\n", name, buf);
-
-    __asm__ volatile("nop");
-}
 EXPORT_SYMBOL(sukisu_kpm_info);
-
-noinline NO_OPTIMIZE void sukisu_kpm_list(void *out, int bufferSize,
-                int *result)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_list). "
-                    "buffer=%p size=%d\n", out, bufferSize);
-}
 EXPORT_SYMBOL(sukisu_kpm_list);
-
-noinline NO_OPTIMIZE void sukisu_kpm_control(const char *name, const char *args, long arg_len,
-                int *result)
-{
-    pr_info("kpm: Stub function called (sukisu_kpm_control). "
-                    "name=%p args=%p arg_len=%ld\n", name, args, arg_len);
-
-    __asm__ volatile("nop");
-}
+EXPORT_SYMBOL(sukisu_kpm_version);
 EXPORT_SYMBOL(sukisu_kpm_control);
 
-noinline NO_OPTIMIZE void sukisu_kpm_version(char *buf, int bufferSize)
+noinline
+int sukisu_handle_kpm(unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5)
 {
-    pr_info("kpm: Stub function called (sukisu_kpm_version). "
-                    "buffer=%p\n", buf);
-}
-EXPORT_SYMBOL(sukisu_kpm_version);
+    if(arg2 == SUKISU_KPM_LOAD) {
+        char kernel_load_path[256] = { 0 };
+        char kernel_args_buffer[256] = { 0 };
 
-noinline int sukisu_handle_kpm(unsigned long control_code, unsigned long arg1, unsigned long arg2,
-                unsigned long result_code)
-{
-    int res = -1;
-    if (control_code == SUKISU_KPM_LOAD) {
-        char kernel_load_path[256];
-        char kernel_args_buffer[256];
-
-        if (arg1 == 0) {
-            res = -EINVAL;
-            goto exit;
+        if(arg3 == 0) {
+            return -1;
         }
         
-        if (!access_ok(arg1, 255)) {
-            goto invalid_arg;
+        strncpy_from_user((char*)&kernel_load_path, (const char __user *)arg3, 255);
+        if(arg4 != 0) {
+            strncpy_from_user((char*)&kernel_args_buffer, (const char __user *)arg4, 255);
+        }
+        sukisu_kpm_load_module_path((const char*)&kernel_load_path, (const char*) &kernel_args_buffer, NULL, (void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_UNLOAD) {
+        char kernel_name_buffer[256] = { 0 };
+
+        if(arg3 == 0) {
+            return -1;
         }
         
-        strncpy_from_user((char *)&kernel_load_path, (const char *)arg1, 255);
+        strncpy_from_user((char*)&kernel_name_buffer, (const char __user *)arg3, 255);
+        sukisu_kpm_unload_module((const char*) &kernel_name_buffer, NULL, (void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_NUM) {
+        sukisu_kpm_num((void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_INFO) {
+        char kernel_name_buffer[256] = { 0 };
 
-        if (arg2 != 0) {
-            if (!access_ok(arg2, 255)) {
-                goto invalid_arg;
+        if(arg3 == 0 || arg4 == 0) {
+            return -1;
         }
         
-            strncpy_from_user((char *)&kernel_args_buffer, (const char *)arg2, 255);
+        strncpy_from_user((char*)&kernel_name_buffer, (const char __user *)arg3, 255);
+        sukisu_kpm_info((const char*) &kernel_name_buffer, (char __user*) arg4, (void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_LIST) {
+        sukisu_kpm_list((char __user*) arg3, (unsigned int) arg4, (void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_VERSION) {
+        sukisu_kpm_version((char __user*) arg3, (unsigned int) arg4, (void __user*) arg5);
+    } else if(arg2 == SUKISU_KPM_CONTROL) {
+        sukisu_kpm_control((char __user*) arg3, (char __user*) arg4, (void __user*) arg5);
     }
-
-        sukisu_kpm_load_module_path((const char *)&kernel_load_path,
-                        (const char *)&kernel_args_buffer, NULL, &res);
-    } else if (control_code == SUKISU_KPM_UNLOAD) {
-        char kernel_name_buffer[256];
-
-        if (arg1 == 0) {
-            res = -EINVAL;
-            goto exit;
-        }
-
-        if (!access_ok(arg1, sizeof(kernel_name_buffer))) {
-            goto invalid_arg;
-        }
-        
-        strncpy_from_user((char *)&kernel_name_buffer, (const char *)arg1, sizeof(kernel_name_buffer));
-        
-        sukisu_kpm_unload_module((const char *)&kernel_name_buffer, NULL, &res);
-    } else if (control_code == SUKISU_KPM_NUM) {
-        sukisu_kpm_num(&res);
-    } else if (control_code == SUKISU_KPM_INFO) {
-        char kernel_name_buffer[256];
-        char buf[256];
-        int size;
-
-        if (arg1 == 0 || arg2 == 0) {
-            res = -EINVAL;
-            goto exit;
-        }
-
-        if (!access_ok(arg1, sizeof(kernel_name_buffer))) {
-            goto invalid_arg;
-        }
-        
-        strncpy_from_user((char *)&kernel_name_buffer, (const char __user *)arg1, sizeof(kernel_name_buffer));
-        
-        sukisu_kpm_info((const char *)&kernel_name_buffer, (char *)&buf, sizeof(buf), &size);
-
-        if (!access_ok(arg2, size)) {
-            goto invalid_arg;
-        }
-
-        res = copy_to_user(arg2, &buf, size);
-
-    } else if (control_code == SUKISU_KPM_LIST) {
-        char buf[1024];
-        int len = (int) arg2;
-
-        if (len <= 0) {
-            res = -EINVAL;
-            goto exit;
-        }
-
-        if (!access_ok(arg2, len)) {
-            goto invalid_arg;
-        }
-        
-        sukisu_kpm_list((char *)&buf, sizeof(buf), &res);
-
-        if (res > len) {
-            res = -ENOBUFS;
-            goto exit;
-        }
-
-        if (copy_to_user(arg1, &buf, len) != 0) 
-            pr_info("kpm: Copy to user failed.");
-        
-    } else if (control_code == SUKISU_KPM_CONTROL) {
-        char kpm_name[KPM_NAME_LEN] = { 0 };
-        char kpm_args[KPM_ARGS_LEN] = { 0 };
-
-        if (!access_ok(arg1, sizeof(kpm_name))) {
-            goto invalid_arg;
-        }
-
-        if (!access_ok(arg2, sizeof(kpm_args))) {
-            goto invalid_arg;
-        }
-
-        long name_len = strncpy_from_user((char *)&kpm_name, (const char __user *)arg1, sizeof(kpm_name));
-        if (name_len <= 0) {
-            res = -EINVAL;
-            goto exit;
-        }
-
-        long arg_len = strncpy_from_user((char *)&kpm_args, (const char __user *)arg2, sizeof(kpm_args));
-
-        sukisu_kpm_control((const char *)&kpm_name, (const char *)&kpm_args, arg_len, &res);
-
-    } else if (control_code == SUKISU_KPM_VERSION) {
-        char buffer[256] = {0};
-
-        sukisu_kpm_version((char*) &buffer, sizeof(buffer));
-
-        unsigned int outlen = (unsigned int) arg2;
-        int len = strlen(buffer);
-        if (len >= outlen) len = outlen - 1;
-        
-        res = copy_to_user(arg1, &buffer, len + 1);
-    }
-
-exit:
-    if (copy_to_user(result_code, &res, sizeof(res)) != 0)
-        pr_info("kpm: Copy to user failed.");
-    
     return 0;
-invalid_arg:
-    pr_err("kpm: invalid pointer detected! arg1: %px arg2: %px\n", (void *)arg1, (void *)arg2);
-    res = -EFAULT;
-    goto exit;
 }
+
+int sukisu_is_kpm_control_code(unsigned long arg2) {
+    return (arg2 >= CMD_KPM_CONTROL && arg2 <= CMD_KPM_CONTROL_MAX) ? 1 : 0;
+}
+
 EXPORT_SYMBOL(sukisu_handle_kpm);
-
-int sukisu_is_kpm_control_code(unsigned long control_code) {
-    return (control_code >= CMD_KPM_CONTROL &&
-                    control_code <= CMD_KPM_CONTROL_MAX) ? 1 : 0;
-}
-
-int do_kpm(void __user *arg)
-{
-    struct ksu_kpm_cmd cmd;
-
-    if (copy_from_user(&cmd, arg, sizeof(cmd))) {
-        pr_err("kpm: copy_from_user failed\n");
-        return -EFAULT;
-    }
-
-    if (!access_ok(cmd.control_code, sizeof(int))) {
-        pr_err("kpm: invalid control_code pointer %px\n", (void *)cmd.control_code);
-        return -EFAULT;
-    }
-
-    if (!access_ok(cmd.result_code, sizeof(int))) {
-        pr_err("kpm: invalid result_code pointer %px\n", (void *)cmd.result_code);
-        return -EFAULT;
-    }
-
-    return sukisu_handle_kpm(cmd.control_code, cmd.arg1, cmd.arg2, cmd.result_code);
-}
-

kernel/kpm/kpm.h

@@ -1,70 +1,44 @@
-#ifndef __SUKISU_KPM_H
-#define __SUKISU_KPM_H
+#ifndef ___SUKISU_KPM_H
+#define ___SUKISU_KPM_H
 
-#include <linux/types.h>
-#include <linux/ioctl.h>
+int sukisu_handle_kpm(unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5);
+int sukisu_is_kpm_control_code(unsigned long arg2);
 
-struct ksu_kpm_cmd {
-    __aligned_u64 __user control_code;
-    __aligned_u64 __user arg1;
-    __aligned_u64 __user arg2;
-    __aligned_u64 __user result_code;
-};
+// KPM控制代码
+#define CMD_KPM_CONTROL 28
+#define CMD_KPM_CONTROL_MAX 35
 
-int sukisu_handle_kpm(unsigned long control_code, unsigned long arg3, unsigned long arg4, unsigned long result_code);
-int sukisu_is_kpm_control_code(unsigned long control_code);
-int do_kpm(void __user *arg);
+// 控制代码
 
-#define KSU_IOCTL_KPM _IOC(_IOC_READ|_IOC_WRITE, 'K', 200, 0)
+// prctl(xxx, 28, "PATH", "ARGS")
+// success return 0, error return -N
+#define SUKISU_KPM_LOAD 28
 
-/* KPM Control Code */
-#define CMD_KPM_CONTROL 1
-#define CMD_KPM_CONTROL_MAX 10
+// prctl(xxx, 29, "NAME")
+// success return 0, error return -N
+#define SUKISU_KPM_UNLOAD 29
 
-/* Control Code */
-/*
- * prctl(xxx, 1, "PATH", "ARGS")
- * success return 0, error return -N
- */
-#define SUKISU_KPM_LOAD 1
+// num = prctl(xxx, 30)
+// error return -N
+// success return +num or 0
+#define SUKISU_KPM_NUM 30
 
-/*
- * prctl(xxx, 2, "NAME")
- * success return 0, error return -N
- */
-#define SUKISU_KPM_UNLOAD 2
+// prctl(xxx, 31, Buffer, BufferSize)
+// success return +out, error return -N
+#define SUKISU_KPM_LIST 31
 
-/*
- * num = prctl(xxx, 3)
- * error return -N
- * success return +num or 0
- */
-#define SUKISU_KPM_NUM 3
+// prctl(xxx, 32, "NAME", Buffer[256])
+// success return +out, error return -N
+#define SUKISU_KPM_INFO 32
 
-/*
- * prctl(xxx, 4, Buffer, BufferSize)
- * success return +out, error return -N
- */
-#define SUKISU_KPM_LIST 4
+// prctl(xxx, 33, "NAME", "ARGS")
+// success return KPM's result value
+// error return -N
+#define SUKISU_KPM_CONTROL 33
 
-/*
- * prctl(xxx, 5, "NAME", Buffer[256])
- * success return +out, error return -N
- */
-#define SUKISU_KPM_INFO 5
-
-/*
- * prctl(xxx, 6, "NAME", "ARGS")
- * success return KPM's result value
- * error return -N
- */
-#define SUKISU_KPM_CONTROL 6
-
-/*
- * prctl(xxx, 7, buffer, bufferSize)
- * success return KPM's result value
- * error return -N
- */
-#define SUKISU_KPM_VERSION 7
+// prctl(xxx, 34, buffer, bufferSize)
+// success return KPM's result value
+// error return -N
+#define SUKISU_KPM_VERSION 34
 
 #endif

kernel/kpm/super_access.c

@@ -13,7 +13,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
-#include <asm/elf.h>
+#include <asm/elf.h>    /* 包含 ARM64 重定位类型定义 */
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
 #include <linux/string.h>
@@ -24,23 +24,19 @@
 #include <linux/version.h>
 #include <linux/export.h>
 #include <linux/slab.h>
-#include <linux/types.h>
-#include <linux/stddef.h>
-#include <linux/mount.h>
-#include <linux/kprobes.h>
-#include <linux/mm_types.h>
-#include <linux/netlink.h>
-#include <linux/sched.h>
-#include <../fs/mount.h>
 #include "kpm.h"
 #include "compact.h"
+#include <linux/types.h>
+#include <linux/stddef.h>
 
+// 结构体成员元数据
 struct DynamicStructMember {
     const char* name;
     size_t size;
     size_t offset;
 };
 
+// 结构体元数据（包含总大小）
 struct DynamicStructInfo {
     const char* name;
     size_t count;
@@ -48,6 +44,7 @@ struct DynamicStructInfo {
     struct DynamicStructMember* members;
 };
 
+// 定义结构体元数据的宏（直接使用 struct 名称）
 #define DYNAMIC_STRUCT_BEGIN(struct_name) \
     static struct DynamicStructMember struct_name##_members[] = {
 
@@ -67,6 +64,17 @@ struct DynamicStructInfo {
         .members = struct_name##_members \
     };
 
+// ==================================================================================
+
+#include <linux/version.h>
+
+#define KERNEL_VERSION_6_1 KERNEL_VERSION(6, 1, 0)
+#define KERNEL_VERSION_5_15 KERNEL_VERSION(5, 15, 0)
+
+#include <../fs/mount.h>
+#include <linux/mount.h>
+
+// 定义元数据
 DYNAMIC_STRUCT_BEGIN(mount)
     DEFINE_MEMBER(mount, mnt_parent)
     DEFINE_MEMBER(mount, mnt)
@@ -88,11 +96,13 @@ DYNAMIC_STRUCT_BEGIN(mnt_namespace)
     DEFINE_MEMBER(mnt_namespace, root)
     DEFINE_MEMBER(mnt_namespace, seq)
     DEFINE_MEMBER(mnt_namespace, mounts)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION_5_15
     DEFINE_MEMBER(mnt_namespace, count)
 #endif
 DYNAMIC_STRUCT_END(mnt_namespace)
 
+#include <linux/kprobes.h>
+
 #ifdef CONFIG_KPROBES
 DYNAMIC_STRUCT_BEGIN(kprobe)
     DEFINE_MEMBER(kprobe, addr)
@@ -100,13 +110,16 @@ DYNAMIC_STRUCT_BEGIN(kprobe)
     DEFINE_MEMBER(kprobe, offset)
     DEFINE_MEMBER(kprobe, pre_handler)
     DEFINE_MEMBER(kprobe, post_handler)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION_5_15
     DEFINE_MEMBER(kprobe, fault_handler)
 #endif
     DEFINE_MEMBER(kprobe, flags)
 DYNAMIC_STRUCT_END(kprobe)
 #endif
 
+#include <linux/mm.h>
+#include <linux/mm_types.h>
+
 DYNAMIC_STRUCT_BEGIN(vm_area_struct)
     DEFINE_MEMBER(vm_area_struct,vm_start)
     DEFINE_MEMBER(vm_area_struct,vm_end)
@@ -128,6 +141,8 @@ DYNAMIC_STRUCT_BEGIN(vm_operations_struct)
     DEFINE_MEMBER(vm_operations_struct, access)
 DYNAMIC_STRUCT_END(vm_operations_struct)
 
+#include <linux/netlink.h>
+
 DYNAMIC_STRUCT_BEGIN(netlink_kernel_cfg)
     DEFINE_MEMBER(netlink_kernel_cfg, groups)
     DEFINE_MEMBER(netlink_kernel_cfg, flags)
@@ -135,11 +150,13 @@ DYNAMIC_STRUCT_BEGIN(netlink_kernel_cfg)
     DEFINE_MEMBER(netlink_kernel_cfg, cb_mutex)
     DEFINE_MEMBER(netlink_kernel_cfg, bind)
     DEFINE_MEMBER(netlink_kernel_cfg, unbind)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION_6_1
     DEFINE_MEMBER(netlink_kernel_cfg, compare)
 #endif
 DYNAMIC_STRUCT_END(netlink_kernel_cfg)
 
+
+#include <linux/sched.h>
 DYNAMIC_STRUCT_BEGIN(task_struct)
     DEFINE_MEMBER(task_struct, pid)
     DEFINE_MEMBER(task_struct, tgid)
@@ -150,11 +167,7 @@ DYNAMIC_STRUCT_BEGIN(task_struct)
     DEFINE_MEMBER(task_struct, group_leader)
     DEFINE_MEMBER(task_struct, mm)
     DEFINE_MEMBER(task_struct, active_mm)
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 19, 0) 
-    DEFINE_MEMBER(task_struct, pids[PIDTYPE_PID].pid)
-#else
     DEFINE_MEMBER(task_struct, thread_pid)
-#endif
     DEFINE_MEMBER(task_struct, files)
     DEFINE_MEMBER(task_struct, seccomp)
 #ifdef CONFIG_THREAD_INFO_IN_TASK
@@ -169,9 +182,12 @@ DYNAMIC_STRUCT_BEGIN(task_struct)
     DEFINE_MEMBER(task_struct, thread)
 DYNAMIC_STRUCT_END(task_struct)
 
+// =====================================================================================================================
+
 #define STRUCT_INFO(name) &(name##_info)
 
-static struct DynamicStructInfo *dynamic_struct_infos[] = {
+static
+struct DynamicStructInfo* dynamic_struct_infos[] = {
     STRUCT_INFO(mount),
     STRUCT_INFO(vfsmount),
     STRUCT_INFO(mnt_namespace),
@@ -184,95 +200,86 @@ static struct DynamicStructInfo *dynamic_struct_infos[] = {
     STRUCT_INFO(task_struct)
 };
 
-/*
- * return 0 if successful
- * return -1 if struct not defined
- */
-int sukisu_super_find_struct(const char *struct_name, size_t *out_size, int *out_members)
-{
+// return 0 if successful
+// return -1 if struct not defined
+int sukisu_super_find_struct(
+    const char* struct_name,
+    size_t* out_size,
+    int* out_members
+) {
     for(size_t i = 0; i < (sizeof(dynamic_struct_infos) / sizeof(dynamic_struct_infos[0])); i++) {
         struct DynamicStructInfo* info = dynamic_struct_infos[i];
-        
         if(strcmp(struct_name, info->name) == 0) {
             if(out_size)
                 *out_size = info->total_size;
-                
             if(out_members)
                 *out_members = info->count;
-                
             return 0;
         }
     }
-    
     return -1;
 }
 EXPORT_SYMBOL(sukisu_super_find_struct);
 
-/*
- * Dynamic access struct
- * return 0 if successful
- * return -1 if struct not defined
- * return -2 if member not defined
- */
-int sukisu_super_access(const char *struct_name, const char *member_name, size_t *out_offset,
-                size_t *out_size)
-{
+// Dynamic access struct
+// return 0 if successful
+// return -1 if struct not defined
+// return -2 if member not defined
+int sukisu_super_access (
+    const char* struct_name,
+    const char* member_name,
+    size_t* out_offset,
+    size_t* out_size
+) {
     for(size_t i = 0; i < (sizeof(dynamic_struct_infos) / sizeof(dynamic_struct_infos[0])); i++) {
         struct DynamicStructInfo* info = dynamic_struct_infos[i];
-        
         if(strcmp(struct_name, info->name) == 0) {
             for (size_t i1 = 0; i1 < info->count; i1++) {
                 if (strcmp(info->members[i1].name, member_name) == 0) {
                     if(out_offset)
                         *out_offset = info->members[i].offset;
-                        
                     if(out_size)
                         *out_size = info->members[i].size;
-                        
                     return 0;
                 }
             }
-            
             return -2;
         }
     }
-    
     return -1;
 }
 EXPORT_SYMBOL(sukisu_super_access);
 
+// 动态 container_of 宏
 #define DYNAMIC_CONTAINER_OF(offset, member_ptr) ({ \
     (offset != (size_t)-1) ? (void*)((char*)(member_ptr) - offset) : NULL; \
 })
 
-/*
- * Dynamic container_of
- * return 0 if success
- * return -1 if current struct not defined
- * return -2 if target member not defined
- */
-int sukisu_super_container_of(const char *struct_name, const char *member_name, void *ptr,
-                void **out_ptr)
-{
-    if (ptr == NULL)
+// Dynamic container_of
+// return 0 if success
+// return -1 if current struct not defined
+// return -2 if target member not defined
+int sukisu_super_container_of(
+    const char* struct_name,
+    const char* member_name,
+    void* ptr,
+    void** out_ptr
+) {
+    if(ptr == NULL) {
         return -3;
-
+    }
     for(size_t i = 0; i < (sizeof(dynamic_struct_infos) / sizeof(dynamic_struct_infos[0])); i++) {
         struct DynamicStructInfo* info = dynamic_struct_infos[i];
-        
         if(strcmp(struct_name, info->name) == 0) {
             for (size_t i1 = 0; i1 < info->count; i1++) {
                 if (strcmp(info->members[i1].name, member_name) == 0) {
                     *out_ptr = (void*) DYNAMIC_CONTAINER_OF(info->members[i1].offset, ptr);
-                    
                     return 0;
                 }
             }
-            
             return -2;
         }
     }
-    
     return -1;
 }
 EXPORT_SYMBOL(sukisu_super_container_of);

kernel/kpm/super_access.h

@@ -6,10 +6,34 @@
 #include "kpm.h"
 #include "compact.h"
 
-extern int sukisu_super_find_struct(const char *struct_name, size_t *out_size, int *out_members);
-extern int sukisu_super_access(const char *struct_name, const char *member_name, size_t *out_offset,
-                size_t *out_size);
-extern int sukisu_super_container_of(const char *struct_name, const char *member_name, void *ptr,
-                void **out_ptr);
+// return 0 if successful
+// return -1 if struct not defined
+int sukisu_super_find_struct(
+    const char* struct_name,
+    size_t* out_size,
+    int* out_members
+);
+
+// Dynamic access struct
+// return 0 if successful
+// return -1 if struct not defined
+// return -2 if member not defined
+int sukisu_super_access (
+    const char* struct_name,
+    const char* member_name,
+    size_t* out_offset,
+    size_t* out_size
+);
+
+// Dynamic container_of
+// return 0 if success
+// return -1 if current struct not defined
+// return -2 if target member not defined
+int sukisu_super_container_of(
+    const char* struct_name,
+    const char* member_name,
+    void* ptr,
+    void** out_ptr
+);
 
 #endif

kernel/ksu.c

@@ -3,19 +3,13 @@
 #include <linux/kobject.h>
 #include <linux/module.h>
 #include <linux/workqueue.h>
-#include <linux/version.h>
 
 #include "allowlist.h"
-#include "feature.h"
+#include "arch.h"
+#include "core_hook.h"
 #include "klog.h" // IWYU pragma: keep
+#include "ksu.h"
 #include "throne_tracker.h"
-#include "syscall_hook_manager.h"
-#include "ksud.h"
-#include "supercalls.h"
-
-#include "sulog.h"
-#include "throne_comm.h"
-#include "dynamic_manager.h"
 
 static struct workqueue_struct *ksu_workqueue;
 
@@ -24,19 +18,24 @@ bool ksu_queue_work(struct work_struct *work)
 	return queue_work(ksu_workqueue, work);
 }
 
-void sukisu_custom_config_init(void)
+extern int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr,
+					void *argv, void *envp, int *flags);
+
+extern int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
+				    void *argv, void *envp, int *flags);
+
+int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv,
+			void *envp, int *flags)
 {
+	ksu_handle_execveat_ksud(fd, filename_ptr, argv, envp, flags);
+	return ksu_handle_execveat_sucompat(fd, filename_ptr, argv, envp,
+					    flags);
 }
 
-void sukisu_custom_config_exit(void)
-{
-    ksu_uid_exit();
-    ksu_throne_comm_exit();
-    ksu_dynamic_manager_exit();
-#if __SULOG_GATE
-    ksu_sulog_exit();
-#endif
-}
+extern void ksu_sucompat_init();
+extern void ksu_sucompat_exit();
+extern void ksu_ksud_init();
+extern void ksu_ksud_exit();
 
 int __init kernelsu_init(void)
 {
@@ -50,21 +49,15 @@ int __init kernelsu_init(void)
 	pr_alert("*************************************************************");
 #endif
 
-    ksu_feature_init();
-
-    ksu_supercalls_init();
-
-    sukisu_custom_config_init();
-
-    ksu_syscall_hook_manager_init();
+	ksu_core_init();
 
 	ksu_workqueue = alloc_ordered_workqueue("kernelsu_work_queue", 0);
 
 	ksu_allowlist_init();
 
 	ksu_throne_tracker_init();
-
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
+	ksu_sucompat_init();
 	ksu_ksud_init();
 #else
  	pr_alert("KPROBES is disabled, KernelSU may not work, please check https://kernelsu.org/guide/how-to-integrate-for-non-gki.html");
@@ -78,28 +71,20 @@ int __init kernelsu_init(void)
 	return 0;
 }
 
-extern void ksu_observer_exit(void);
 void kernelsu_exit(void)
 {
 	ksu_allowlist_exit();
 
-    ksu_observer_exit();
-
 	ksu_throne_tracker_exit();
 
 	destroy_workqueue(ksu_workqueue);
 
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	ksu_ksud_exit();
+	ksu_sucompat_exit();
 #endif
 
-    ksu_syscall_hook_manager_exit();
-
-    sukisu_custom_config_exit();
-
-    ksu_supercalls_exit();
-    
-    ksu_feature_exit();
+	ksu_core_exit();
 }
 
 module_init(kernelsu_init);
@@ -108,9 +93,4 @@ module_exit(kernelsu_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("weishu");
 MODULE_DESCRIPTION("Android KernelSU");
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0)
-MODULE_IMPORT_NS("VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver");
-#else
 MODULE_IMPORT_NS(VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver);
-#endif

kernel/ksu.h

@@ -7,43 +7,83 @@
 #define KERNEL_SU_VERSION KSU_VERSION
 #define KERNEL_SU_OPTION 0xDEADBEEF
 
-extern bool ksu_uid_scanner_enabled;
+#define CMD_GRANT_ROOT 0
+#define CMD_BECOME_MANAGER 1
+#define CMD_GET_VERSION 2
+#define CMD_ALLOW_SU 3
+#define CMD_DENY_SU 4
+#define CMD_GET_ALLOW_LIST 5
+#define CMD_GET_DENY_LIST 6
+#define CMD_REPORT_EVENT 7
+#define CMD_SET_SEPOLICY 8
+#define CMD_CHECK_SAFEMODE 9
+#define CMD_GET_APP_PROFILE 10
+#define CMD_SET_APP_PROFILE 11
+#define CMD_UID_GRANTED_ROOT 12
+#define CMD_UID_SHOULD_UMOUNT 13
+#define CMD_IS_SU_ENABLED 14
+#define CMD_ENABLE_SU 15
 
 #define EVENT_POST_FS_DATA 1
 #define EVENT_BOOT_COMPLETED 2
 #define EVENT_MODULE_MOUNTED 3
 
-// SukiSU Ultra kernel su version full strings
-#ifndef KSU_VERSION_FULL 
-#define KSU_VERSION_FULL "v3.x-00000000@unknown"
-#endif
-#define KSU_FULL_VERSION_STRING 255
+#define KSU_APP_PROFILE_VER 2
+#define KSU_MAX_PACKAGE_NAME 256
+// NGROUPS_MAX for Linux is 65535 generally, but we only supports 32 groups.
+#define KSU_MAX_GROUPS 32
+#define KSU_SELINUX_DOMAIN 64
 
-#define DYNAMIC_MANAGER_OP_SET 0
-#define DYNAMIC_MANAGER_OP_GET 1
-#define DYNAMIC_MANAGER_OP_CLEAR 2
+struct root_profile {
+	int32_t uid;
+	int32_t gid;
 
-#define UID_SCANNER_OP_GET_STATUS 0
-#define UID_SCANNER_OP_TOGGLE 1
-#define UID_SCANNER_OP_CLEAR_ENV 2
+	int32_t groups_count;
+	int32_t groups[KSU_MAX_GROUPS];
 
-struct dynamic_manager_user_config {
-    unsigned int operation;
-    unsigned int size;
-    char hash[65];
+	// kernel_cap_t is u32[2] for capabilities v3
+	struct {
+		u64 effective;
+		u64 permitted;
+		u64 inheritable;
+	} capabilities;
+
+	char selinux_domain[KSU_SELINUX_DOMAIN];
+
+	int32_t namespaces;
 };
 
-struct manager_list_info {
-    int count;
+struct non_root_profile {
+	bool umount_modules;
+};
+
+struct app_profile {
+	// It may be utilized for backward compatibility, although we have never explicitly made any promises regarding this.
+	u32 version;
+
+	// this is usually the package of the app, but can be other value for special apps
+	char key[KSU_MAX_PACKAGE_NAME];
+	int32_t current_uid;
+	bool allow_su;
+
+	union {
 		struct {
-        uid_t uid;
-        int signature_index;
-    } managers[2];
+			bool use_default;
+			char template_name[KSU_MAX_PACKAGE_NAME];
+
+			struct root_profile profile;
+		} rp_config;
+
+		struct {
+			bool use_default;
+
+			struct non_root_profile profile;
+		} nrp_config;
+	};
 };
 
 bool ksu_queue_work(struct work_struct *work);
 
-#if 0
 static inline int startswith(char *s, char *prefix)
 {
 	return strncmp(s, prefix, strlen(prefix));
@@ -57,6 +97,5 @@ static inline int endswith(const char *s, const char *t)
 		return 1;
 	return strcmp(s + slen - tlen, t);
 }
-#endif
 
 #endif

kernel/ksud.c

@@ -1,6 +1,3 @@
-#include <linux/rcupdate.h>
-#include <linux/slab.h>
-#include <linux/task_work.h>
 #include <asm/current.h>
 #include <linux/compat.h>
 #include <linux/cred.h>
@@ -14,19 +11,15 @@
 #include <linux/printk.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
-#include <linux/namei.h>
 #include <linux/workqueue.h>
 
-#include "manager.h"
 #include "allowlist.h"
 #include "arch.h"
 #include "klog.h" // IWYU pragma: keep
 #include "ksud.h"
+#include "kernel_compat.h"
 #include "selinux/selinux.h"
-#include "throne_tracker.h"
 
-bool ksu_module_mounted __read_mostly = false;
-bool ksu_boot_completed __read_mostly = false;
 
 static const char KERNEL_SU_RC[] =
 	"\n"
@@ -55,7 +48,7 @@ static void stop_vfs_read_hook();
 static void stop_execve_hook();
 static void stop_input_hook();
 
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 static struct work_struct stop_vfs_read_work;
 static struct work_struct stop_execve_hook_work;
 static struct work_struct stop_input_hook_work;
@@ -65,7 +58,7 @@ bool ksu_execveat_hook __read_mostly = true;
 bool ksu_input_hook __read_mostly = true;
 #endif
 
-u32 ksu_file_sid;
+u32 ksu_devpts_sid;
 
 // Detect whether it is on or not
 static bool is_boot_phase = true;
@@ -80,52 +73,14 @@ void on_post_fs_data(void)
 	done = true;
 	pr_info("on_post_fs_data!\n");
 	ksu_load_allow_list();
-    ksu_observer_init();
 	// sanity check, this may influence the performance
 	stop_input_hook();
 
+	ksu_devpts_sid = ksu_get_devpts_sid();
+	pr_info("devpts sid: %d\n", ksu_devpts_sid);
+
 	// End of boot state
     is_boot_phase = false;
-
-    ksu_file_sid = ksu_get_ksu_file_sid();
-	pr_info("ksu_file sid: %d\n", ksu_file_sid);
-}
-
-extern void ext4_unregister_sysfs(struct super_block *sb);
-int nuke_ext4_sysfs(const char* mnt)
-{
-#ifdef CONFIG_EXT4_FS
-    struct path path;
-    int err = kern_path(mnt, 0, &path);
-    if (err) {
-        pr_err("nuke path err: %d\n", err);
-        return err;
-    }
-
-    struct super_block *sb = path.dentry->d_inode->i_sb;
-    const char *name = sb->s_type->name;
-    if (strcmp(name, "ext4") != 0) {
-        pr_info("nuke but module aren't mounted\n");
-        path_put(&path);
-        return -EINVAL;
-    }
-
-    ext4_unregister_sysfs(sb);
-    path_put(&path);
-
-    return 0;
-#endif
-}
-
-void on_module_mounted(void){
-    pr_info("on_module_mounted!\n");
-    ksu_module_mounted = true;
-}
-
-void on_boot_completed(void){
-    ksu_boot_completed = true;
-    pr_info("on_boot_completed!\n");
-    track_throne(true);
 }
 
 #define MAX_ARG_STRINGS 0x7FFFFFFF
@@ -191,25 +146,18 @@ static int __maybe_unused count(struct user_arg_ptr argv, int max)
 
 			if (fatal_signal_pending(current))
 				return -ERESTARTNOHAND;
+			cond_resched();
 		}
 	}
 	return i;
 }
 
-static void on_post_fs_data_cbfun(struct callback_head *cb)
-{
-    on_post_fs_data();
-}
-
-static struct callback_head on_post_fs_data_cb = { .func =
-                                                       on_post_fs_data_cbfun };
-
 // IMPORTANT NOTE: the call from execve_handler_pre WON'T provided correct value for envp and flags in GKI version
 int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 			     struct user_arg_ptr *argv,
 			     struct user_arg_ptr *envp, int *flags)
 {
-#ifndef KSU_KPROBES_HOOK
+#ifndef CONFIG_KPROBES
  	if (!ksu_execveat_hook) {
  		return 0;
  	}
@@ -243,12 +191,15 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 			const char __user *p = get_user_arg_ptr(*argv, 1);
 			if (p && !IS_ERR(p)) {
 				char first_arg[16];
-                strncpy_from_user_nofault(first_arg, p, sizeof(first_arg));
-                pr_info("/system/bin/init first arg: %s\n", first_arg);
+				ksu_strncpy_from_user_nofault(
+					first_arg, p, sizeof(first_arg));
+				pr_info("/system/bin/init first arg: %s\n",
+					first_arg);
 				if (!strcmp(first_arg, "second_stage")) {
 					pr_info("/system/bin/init second_stage executed\n");
 					apply_kernelsu_rules();
 					init_second_stage_executed = true;
+					ksu_android_ns_fs_check();
 				}
 			} else {
 				pr_err("/system/bin/init parse args err!\n");
@@ -265,12 +216,14 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 			const char __user *p = get_user_arg_ptr(*argv, 1);
 			if (p && !IS_ERR(p)) {
 				char first_arg[16];
-                strncpy_from_user_nofault(first_arg, p, sizeof(first_arg));
+				ksu_strncpy_from_user_nofault(
+					first_arg, p, sizeof(first_arg));
 				pr_info("/init first arg: %s\n", first_arg);
 				if (!strcmp(first_arg, "--second-stage")) {
 					pr_info("/init second_stage executed\n");
 					apply_kernelsu_rules();
 					init_second_stage_executed = true;
+					ksu_android_ns_fs_check();
 				}
 			} else {
 				pr_err("/init parse args err!\n");
@@ -281,13 +234,15 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 			if (envc > 0) {
 				int n;
 				for (n = 1; n <= envc; n++) {
-                    const char __user *p = get_user_arg_ptr(*envp, n);
+					const char __user *p =
+						get_user_arg_ptr(*envp, n);
 					if (!p || IS_ERR(p)) {
 						continue;
 					}
 					char env[256];
 					// Reading environment variable strings from user space
-                    if (strncpy_from_user_nofault(env, p, sizeof(env)) < 0)
+					if (ksu_strncpy_from_user_nofault(
+						    env, p, sizeof(env)) < 0)
 						continue;
 					// Parsing environment variable names and values
 					char *env_name = env;
@@ -298,12 +253,15 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 					*env_value = '\0';
 					env_value++;
 					// Check if the environment variable name and value are matching
-                    if (!strcmp(env_name, "INIT_SECOND_STAGE") &&
+					if (!strcmp(env_name,
+						    "INIT_SECOND_STAGE") &&
 					    (!strcmp(env_value, "1") ||
 					     !strcmp(env_value, "true"))) {
 						pr_info("/init second_stage executed\n");
 						apply_kernelsu_rules();
-                        init_second_stage_executed = true;
+						init_second_stage_executed =
+							true;
+						ksu_android_ns_fs_check();
 					}
 				}
 			}
@@ -315,14 +273,7 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr,
 		first_app_process = false;
 		pr_info("exec app_process, /data prepared, second_stage: %d\n",
 			init_second_stage_executed);
-        struct task_struct *init_task;
-        rcu_read_lock();
-        init_task = rcu_dereference(current->real_parent);
-        if (init_task) {
-            task_work_add(init_task, &on_post_fs_data_cb, TWA_RESUME);
-        }
-        rcu_read_unlock();
-
+		on_post_fs_data(); // we keep this for old ksud
 		stop_execve_hook();
 	}
 
@@ -340,7 +291,8 @@ static ssize_t read_proxy(struct file *file, char __user *buf, size_t count,
 	bool first_read = file->f_pos == 0;
 	ssize_t ret = orig_read(file, buf, count, pos);
 	if (first_read) {
-        pr_info("read_proxy append %ld + %ld\n", ret, read_count_append);
+		pr_info("read_proxy append %ld + %ld\n", ret,
+			read_count_append);
 		ret += read_count_append;
 	}
 	return ret;
@@ -351,16 +303,17 @@ static ssize_t read_iter_proxy(struct kiocb *iocb, struct iov_iter *to)
 	bool first_read = iocb->ki_pos == 0;
 	ssize_t ret = orig_read_iter(iocb, to);
 	if (first_read) {
-        pr_info("read_iter_proxy append %ld + %ld\n", ret, read_count_append);
+		pr_info("read_iter_proxy append %ld + %ld\n", ret,
+			read_count_append);
 		ret += read_count_append;
 	}
 	return ret;
 }
 
-static int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
+int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
 			size_t *count_ptr, loff_t **pos)
 {
-#ifndef KSU_KPROBES_HOOK
+#ifndef CONFIG_KPROBES
  	if (!ksu_vfs_read_hook) {
  		return 0;
  	}
@@ -473,7 +426,7 @@ static bool is_volumedown_enough(unsigned int count)
 int ksu_handle_input_handle_event(unsigned int *type, unsigned int *code,
 				  int *value)
 {
-#ifndef KSU_KPROBES_HOOK
+#ifndef CONFIG_KPROBES
  	if (!ksu_input_hook) {
  		return 0;
  	}
@@ -515,8 +468,7 @@ bool ksu_is_safe_mode()
 	return false;
 }
 
-#ifdef KSU_KPROBES_HOOK
-
+#ifdef CONFIG_KPROBES
 static int sys_execve_handler_pre(struct kprobe *p, struct pt_regs *regs)
 {
 	struct pt_regs *real_regs = PT_REAL_REGS(regs);
@@ -532,11 +484,12 @@ static int sys_execve_handler_pre(struct kprobe *p, struct pt_regs *regs)
 		return 0;
 
 	memset(path, 0, sizeof(path));
-    strncpy_from_user_nofault(path, *filename_user, 32);
+	ksu_strncpy_from_user_nofault(path, *filename_user, 32);
 	filename_in.name = path;
 
 	filename_p = &filename_in;
-    return ksu_handle_execveat_ksud(AT_FDCWD, &filename_p, &argv, NULL, NULL);
+	return ksu_handle_execveat_ksud(AT_FDCWD, &filename_p, &argv, NULL,
+					NULL);
 }
 
 static int sys_read_handler_pre(struct kprobe *p, struct pt_regs *regs)
@@ -591,7 +544,7 @@ static void do_stop_input_hook(struct work_struct *work)
 
 static void stop_vfs_read_hook()
 {
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	bool ret = schedule_work(&stop_vfs_read_work);
 	pr_info("unregister vfs_read kprobe: %d!\n", ret);
 #else
@@ -602,7 +555,7 @@ static void stop_vfs_read_hook()
 
 static void stop_execve_hook()
 {
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	bool ret = schedule_work(&stop_execve_hook_work);
 	pr_info("unregister execve kprobe: %d!\n", ret);
 #else
@@ -618,7 +571,7 @@ static void stop_input_hook()
 		return;
 	}
 	input_hook_stopped = true;
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	bool ret = schedule_work(&stop_input_hook_work);
 	pr_info("unregister input kprobe: %d!\n", ret);
 #else
@@ -630,7 +583,7 @@ static void stop_input_hook()
 // ksud: module support
 void ksu_ksud_init()
 {
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	int ret;
 
 	ret = register_kprobe(&execve_kp);
@@ -650,11 +603,12 @@ void ksu_ksud_init()
 
 void ksu_ksud_exit()
 {
-#ifdef KSU_KPROBES_HOOK
+#ifdef CONFIG_KPROBES
 	unregister_kprobe(&execve_kp);
 	// this should be done before unregister vfs_read_kp
 	// unregister_kprobe(&vfs_read_kp);
 	unregister_kprobe(&input_event_kp);
-#endif
+
 	is_boot_phase = false;
+#endif
 }

kernel/ksud.h

@@ -3,19 +3,9 @@
 
 #define KSUD_PATH "/data/adb/ksud"
 
-void ksu_ksud_init();
-void ksu_ksud_exit();
-
 void on_post_fs_data(void);
-void on_module_mounted(void);
-void on_boot_completed(void);
 
 bool ksu_is_safe_mode(void);
 
-int nuke_ext4_sysfs(const char* mnt);
-
-extern u32 ksu_file_sid;
-extern bool ksu_module_mounted;
-extern bool ksu_boot_completed;
-
+extern u32 ksu_devpts_sid;
 #endif

kernel/manager.h

@@ -8,23 +8,17 @@
 
 extern uid_t ksu_manager_uid; // DO NOT DIRECT USE
 
-extern bool ksu_is_any_manager(uid_t uid);
-extern void ksu_add_manager(uid_t uid, int signature_index);
-extern void ksu_remove_manager(uid_t uid);
-extern int ksu_get_manager_signature_index(uid_t uid);
-
-static inline bool ksu_is_manager_uid_valid(void)
+static inline bool ksu_is_manager_uid_valid()
 {
 	return ksu_manager_uid != KSU_INVALID_UID;
 }
 
-static inline bool is_manager(void)
+static inline bool is_manager()
 {
-    return unlikely(ksu_is_any_manager(current_uid().val) || 
-            (ksu_manager_uid != KSU_INVALID_UID && ksu_manager_uid == current_uid().val));
+	return unlikely(ksu_manager_uid == current_uid().val);
 }
 
-static inline uid_t ksu_get_manager_uid(void)
+static inline uid_t ksu_get_manager_uid()
 {
 	return ksu_manager_uid;
 }
@@ -34,10 +28,9 @@ static inline void ksu_set_manager_uid(uid_t uid)
 	ksu_manager_uid = uid;
 }
 
-static inline void ksu_invalidate_manager_uid(void)
+static inline void ksu_invalidate_manager_uid()
 {
 	ksu_manager_uid = KSU_INVALID_UID;
 }
 
-int ksu_observer_init(void);
 #endif

kernel/manager_sign.h

@@ -1,17 +0,0 @@
-#ifndef MANAGER_SIGN_H
-#define MANAGER_SIGN_H
-
-// ShirkNeko/SukiSU
-#define EXPECTED_SIZE_SHIRKNEKO   0x35c
-#define EXPECTED_HASH_SHIRKNEKO   "947ae944f3de4ed4c21a7e4f7953ecf351bfa2b36239da37a34111ad29993eef"
-
-// Dynamic Sign
-#define EXPECTED_SIZE_OTHER   0x300
-#define EXPECTED_HASH_OTHER   "0000000000000000000000000000000000000000000000000000000000000000"
-
-typedef struct {
-    unsigned size;
-    const char *sha256;
-} apk_sign_key_t;
-
-#endif /* MANAGER_SIGN_H */

kernel/manual_su.c

@@ -1,357 +0,0 @@
-#include <linux/string.h>
-#include <linux/uaccess.h>
-#include <linux/printk.h>
-#include <linux/cred.h>
-#include <linux/fs.h>
-#include <linux/uaccess.h>
-#include <linux/file.h>
-#include <linux/mm.h>
-#include <linux/slab.h>
-#include <linux/binfmts.h>
-
-#include "manual_su.h"
-#include "ksu.h"
-#include "allowlist.h"
-#include "manager.h"
-#include "app_profile.h"
-
-static bool current_verified = false;
-static void ksu_cleanup_expired_tokens(void);
-static bool is_current_verified(void);
-static void add_pending_root(uid_t uid);
-
-static struct pending_uid pending_uids[MAX_PENDING] = {0};
-static int pending_cnt = 0;
-static struct ksu_token_entry auth_tokens[MAX_TOKENS] = {0};
-static int token_count = 0;
-static DEFINE_SPINLOCK(token_lock);
-
-static char* get_token_from_envp(void)
-{
-    struct mm_struct *mm;
-    char *envp_start, *envp_end;
-    char *env_ptr, *token = NULL;
-    unsigned long env_len;
-    char *env_copy = NULL;
-    
-    if (!current->mm)
-        return NULL;
-        
-    mm = current->mm;
-    
-    down_read(&mm->mmap_lock);
-    
-    envp_start = (char *)mm->env_start;
-    envp_end = (char *)mm->env_end;
-    env_len = envp_end - envp_start;
-    
-    if (env_len <= 0 || env_len > PAGE_SIZE * 32) {
-        up_read(&mm->mmap_lock);
-        return NULL;
-    }
-    
-    env_copy = kzalloc(env_len + 1, GFP_KERNEL);
-    if (!env_copy) {
-        up_read(&mm->mmap_lock);
-        return NULL;
-    }
-    
-    if (copy_from_user(env_copy, envp_start, env_len)) {
-        kfree(env_copy);
-        up_read(&mm->mmap_lock);
-        return NULL;
-    }
-    
-    up_read(&mm->mmap_lock);
-    
-    env_copy[env_len] = '\0';
-    env_ptr = env_copy;
-    
-    while (env_ptr < env_copy + env_len) {
-        if (strncmp(env_ptr, KSU_TOKEN_ENV_NAME "=", strlen(KSU_TOKEN_ENV_NAME) + 1) == 0) {
-            char *token_start = env_ptr + strlen(KSU_TOKEN_ENV_NAME) + 1;
-            char *token_end = strchr(token_start, '\0');
-            
-            if (token_end && (token_end - token_start) == KSU_TOKEN_LENGTH) {
-                token = kzalloc(KSU_TOKEN_LENGTH + 1, GFP_KERNEL);
-                if (token) {
-                    memcpy(token, token_start, KSU_TOKEN_LENGTH);
-                    token[KSU_TOKEN_LENGTH] = '\0';
-                    pr_info("manual_su: found auth token in environment\n");
-                }
-            }
-            break;
-        }
-        
-        env_ptr += strlen(env_ptr) + 1;
-    }
-    
-    kfree(env_copy);
-    return token;
-}
-
-static char* ksu_generate_auth_token(void)
-{
-    static char token_buffer[KSU_TOKEN_LENGTH + 1];
-    unsigned long flags;
-    int i;
-    
-    ksu_cleanup_expired_tokens();
-    
-    spin_lock_irqsave(&token_lock, flags);
-    
-    if (token_count >= MAX_TOKENS) {
-        for (i = 0; i < MAX_TOKENS - 1; i++) {
-            auth_tokens[i] = auth_tokens[i + 1];
-        }
-        token_count = MAX_TOKENS - 1;
-    }
-    
-    for (i = 0; i < KSU_TOKEN_LENGTH; i++) {
-        u8 rand_byte;
-        get_random_bytes(&rand_byte, 1);
-        int char_type = rand_byte % 3;
-        if (char_type == 0) {
-            token_buffer[i] = 'A' + (rand_byte % 26);
-        } else if (char_type == 1) {
-            token_buffer[i] = 'a' + (rand_byte % 26);
-        } else {
-            token_buffer[i] = '0' + (rand_byte % 10);
-        }
-    }
-    
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
-        strscpy(auth_tokens[token_count].token, token_buffer, KSU_TOKEN_LENGTH + 1);
-#else
-        strlcpy(auth_tokens[token_count].token, token_buffer, KSU_TOKEN_LENGTH + 1);
-#endif
-    auth_tokens[token_count].expire_time = jiffies + KSU_TOKEN_EXPIRE_TIME * HZ;
-    auth_tokens[token_count].used = false;
-    token_count++;
-    
-    spin_unlock_irqrestore(&token_lock, flags);
-    
-    pr_info("manual_su: generated new auth token (expires in %d seconds)\n", KSU_TOKEN_EXPIRE_TIME);
-    return token_buffer;
-}
-
-static bool ksu_verify_auth_token(const char *token)
-{
-    unsigned long flags;
-    bool valid = false;
-    int i;
-    
-    if (!token || strlen(token) != KSU_TOKEN_LENGTH) {
-        return false;
-    }
-    
-    spin_lock_irqsave(&token_lock, flags);
-    
-    for (i = 0; i < token_count; i++) {
-        if (!auth_tokens[i].used && 
-            time_before(jiffies, auth_tokens[i].expire_time) &&
-            strcmp(auth_tokens[i].token, token) == 0) {
-            
-            auth_tokens[i].used = true;
-            valid = true;
-            pr_info("manual_su: auth token verified successfully\n");
-            break;
-        }
-    }
-    
-    spin_unlock_irqrestore(&token_lock, flags);
-    
-    if (!valid) {
-        pr_warn("manual_su: invalid or expired auth token\n");
-    }
-    
-    return valid;
-}
-
-static void ksu_cleanup_expired_tokens(void)
-{
-    unsigned long flags;
-    int i, j;
-    
-    spin_lock_irqsave(&token_lock, flags);
-    
-    for (i = 0; i < token_count; ) {
-        if (time_after(jiffies, auth_tokens[i].expire_time) || auth_tokens[i].used) {
-            for (j = i; j < token_count - 1; j++) {
-                auth_tokens[j] = auth_tokens[j + 1];
-            }
-            token_count--;
-            pr_debug("manual_su: cleaned up expired/used token\n");
-        } else {
-            i++;
-        }
-    }
-    
-    spin_unlock_irqrestore(&token_lock, flags);
-}
-
-static int handle_token_generation(struct manual_su_request *request)
-{
-    if (current_uid().val > 2000) {
-        pr_warn("manual_su: token generation denied for app UID %d\n", current_uid().val);
-        return -EPERM;
-    }
-    
-    char *new_token = ksu_generate_auth_token();
-    if (!new_token) {
-        pr_err("manual_su: failed to generate token\n");
-        return -ENOMEM;
-    }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
-        strscpy(request->token_buffer, new_token, KSU_TOKEN_LENGTH + 1);
-#else
-        strlcpy(request->token_buffer, new_token, KSU_TOKEN_LENGTH + 1);
-#endif
-
-    pr_info("manual_su: auth token generated successfully\n");
-    return 0;
-}
-
-static int handle_escalation_request(struct manual_su_request *request)
-{
-    uid_t target_uid = request->target_uid;
-    pid_t target_pid = request->target_pid;
-    struct task_struct *tsk;
-    
-    rcu_read_lock();
-    tsk = pid_task(find_vpid(target_pid), PIDTYPE_PID);
-    if (!tsk || ksu_task_is_dead(tsk)) {
-        rcu_read_unlock();
-        pr_err("cmd_su: PID %d is invalid or dead\n", target_pid);
-        return -ESRCH;
-    }
-    rcu_read_unlock();
-    
-    if (current_uid().val == 0 || is_manager() || ksu_is_allow_uid_for_current(current_uid().val))
-        goto allowed;
-
-    char *env_token = get_token_from_envp();
-    if (!env_token) {
-        pr_warn("manual_su: no auth token found in environment\n");
-        return -EACCES;
-    }
-    
-    bool token_valid = ksu_verify_auth_token(env_token);
-    kfree(env_token);
-    
-    if (!token_valid) {
-        pr_warn("manual_su: token verification failed\n");
-        return -EACCES;
-    }
-
-allowed:
-    current_verified = true;
-    escape_to_root_for_cmd_su(target_uid, target_pid);
-    return 0;
-}
-
-static int handle_add_pending_request(struct manual_su_request *request)
-{
-    uid_t target_uid = request->target_uid;
-    
-    if (!is_current_verified()) {
-        pr_warn("manual_su: add_pending denied, not verified\n");
-        return -EPERM;
-    }
-
-    add_pending_root(target_uid);
-    current_verified = false;
-    pr_info("manual_su: pending root added for UID %d\n", target_uid);
-    return 0;
-}
-
-int ksu_handle_manual_su_request(int option, struct manual_su_request *request)
-{
-    if (!request) {
-        pr_err("manual_su: invalid request pointer\n");
-        return -EINVAL;
-    }
-
-    switch (option) {
-    case MANUAL_SU_OP_GENERATE_TOKEN:
-        pr_info("manual_su: handling token generation request\n");
-        return handle_token_generation(request);
-
-    case MANUAL_SU_OP_ESCALATE:
-        pr_info("manual_su: handling escalation request for UID %d, PID %d\n", 
-                request->target_uid, request->target_pid);
-        return handle_escalation_request(request);
-        
-    case MANUAL_SU_OP_ADD_PENDING:
-        pr_info("manual_su: handling add pending request for UID %d\n", request->target_uid);
-        return handle_add_pending_request(request);
-        
-    default:
-        pr_err("manual_su: unknown option %d\n", option);
-        return -EINVAL;
-    }
-}
-
-static bool is_current_verified(void)
-{
-    return current_verified;
-}
-
-bool is_pending_root(uid_t uid)
-{
-    for (int i = 0; i < pending_cnt; i++) {
-        if (pending_uids[i].uid == uid) {
-            pending_uids[i].use_count++;
-            pending_uids[i].remove_calls++;
-            return true;
-        }
-    }
-    return false;
-}
-
-void remove_pending_root(uid_t uid)
-{
-    for (int i = 0; i < pending_cnt; i++) {
-        if (pending_uids[i].uid == uid) {
-            pending_uids[i].remove_calls++;
-
-            if (pending_uids[i].remove_calls >= REMOVE_DELAY_CALLS) {
-                pending_uids[i] = pending_uids[--pending_cnt];
-                pr_info("pending_root: removed UID %d after %d calls\n", uid, REMOVE_DELAY_CALLS);
-                ksu_temp_revoke_root_once(uid);
-            } else {
-                pr_info("pending_root: UID %d remove_call=%d (<%d)\n",
-                        uid, pending_uids[i].remove_calls, REMOVE_DELAY_CALLS);
-            }
-            return;
-        }
-    }
-}
-
-static void add_pending_root(uid_t uid)
-{
-    if (pending_cnt >= MAX_PENDING) {
-        pr_warn("pending_root: cache full\n");
-        return;
-    }
-    for (int i = 0; i < pending_cnt; i++) {
-        if (pending_uids[i].uid == uid) {
-            pending_uids[i].use_count = 0;
-            pending_uids[i].remove_calls = 0;
-            return;
-        }
-    }
-    pending_uids[pending_cnt++] = (struct pending_uid){uid, 0};
-    ksu_temp_grant_root_once(uid);
-    pr_info("pending_root: cached UID %d\n", uid);
-}
-
-void ksu_try_escalate_for_uid(uid_t uid)
-{
-    if (!is_pending_root(uid))
-        return;
-    
-    pr_info("pending_root: UID=%d temporarily allowed\n", uid);
-    remove_pending_root(uid);
-}

kernel/manual_su.h

@@ -1,49 +0,0 @@
-#ifndef __KSU_MANUAL_SU_H
-#define __KSU_MANUAL_SU_H
-
-#include <linux/types.h>
-#include <linux/sched.h>
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 7, 0)
-#define mmap_lock mmap_sem
-#endif
-
-#define ksu_task_is_dead(t) ((t)->exit_state != 0)
-
-#define MAX_PENDING 16
-#define REMOVE_DELAY_CALLS 150
-#define MAX_TOKENS 10
-
-#define KSU_SU_VERIFIED_BIT (1UL << 0)
-#define KSU_TOKEN_LENGTH 32
-#define KSU_TOKEN_ENV_NAME "KSU_AUTH_TOKEN"
-#define KSU_TOKEN_EXPIRE_TIME 150
-
-#define MANUAL_SU_OP_GENERATE_TOKEN 0
-#define MANUAL_SU_OP_ESCALATE 1
-#define MANUAL_SU_OP_ADD_PENDING 2
-
-struct pending_uid {
-    uid_t uid;
-    int use_count;
-    int remove_calls;
-};
-
-struct manual_su_request {
-    uid_t target_uid;
-    pid_t target_pid;
-    char token_buffer[KSU_TOKEN_LENGTH + 1];
-};
-
-struct ksu_token_entry {
-    char token[KSU_TOKEN_LENGTH + 1];
-    unsigned long expire_time;
-    bool used;
-};
-
-int ksu_handle_manual_su_request(int option, struct manual_su_request *request);
-bool is_pending_root(uid_t uid);
-void remove_pending_root(uid_t uid);
-void ksu_try_escalate_for_uid(uid_t uid);
-#endif

kernel/pkg_observer.c

@@ -1,133 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#include <linux/module.h>
-#include <linux/fs.h>
-#include <linux/namei.h>
-#include <linux/fsnotify_backend.h>
-#include <linux/slab.h>
-#include <linux/rculist.h>
-#include <linux/version.h>
-#include "klog.h" // IWYU pragma: keep
-#include "ksu.h"
-#include "throne_tracker.h"
-#include "throne_comm.h"
-
-#define MASK_SYSTEM (FS_CREATE | FS_MOVE | FS_EVENT_ON_CHILD)
-
-struct watch_dir {
-    const char *path;
-    u32 mask;
-    struct path kpath;
-    struct inode *inode;
-    struct fsnotify_mark *mark;
-};
-
-static struct fsnotify_group *g;
-
-static int ksu_handle_inode_event(struct fsnotify_mark *mark, u32 mask,
-                  struct inode *inode, struct inode *dir,
-                  const struct qstr *file_name, u32 cookie)
-{
-    if (!file_name)
-        return 0;
-    if (mask & FS_ISDIR)
-        return 0;
-    if (file_name->len == 13 &&
-        !memcmp(file_name->name, "packages.list", 13)) {
-        pr_info("packages.list detected: %d\n", mask);
-        if (ksu_uid_scanner_enabled) {
-            ksu_request_userspace_scan();
-        }
-        track_throne(false);
-    }
-    return 0;
-}
-
-static const struct fsnotify_ops ksu_ops = {
-    .handle_inode_event = ksu_handle_inode_event,
-};
-
-static int add_mark_on_inode(struct inode *inode, u32 mask,
-                 struct fsnotify_mark **out)
-{
-    struct fsnotify_mark *m;
-
-    m = kzalloc(sizeof(*m), GFP_KERNEL);
-    if (!m)
-        return -ENOMEM;
-
-    fsnotify_init_mark(m, g);
-    m->mask = mask;
-
-    if (fsnotify_add_inode_mark(m, inode, 0)) {
-        fsnotify_put_mark(m);
-        return -EINVAL;
-    }
-    *out = m;
-    return 0;
-}
-
-static int watch_one_dir(struct watch_dir *wd)
-{
-    int ret = kern_path(wd->path, LOOKUP_FOLLOW, &wd->kpath);
-    if (ret) {
-        pr_info("path not ready: %s (%d)\n", wd->path, ret);
-        return ret;
-    }
-    wd->inode = d_inode(wd->kpath.dentry);
-    ihold(wd->inode);
-
-    ret = add_mark_on_inode(wd->inode, wd->mask, &wd->mark);
-    if (ret) {
-        pr_err("Add mark failed for %s (%d)\n", wd->path, ret);
-        path_put(&wd->kpath);
-        iput(wd->inode);
-        wd->inode = NULL;
-        return ret;
-    }
-    pr_info("watching %s\n", wd->path);
-    return 0;
-}
-
-static void unwatch_one_dir(struct watch_dir *wd)
-{
-    if (wd->mark) {
-        fsnotify_destroy_mark(wd->mark, g);
-        fsnotify_put_mark(wd->mark);
-        wd->mark = NULL;
-    }
-    if (wd->inode) {
-        iput(wd->inode);
-        wd->inode = NULL;
-    }
-    if (wd->kpath.dentry) {
-        path_put(&wd->kpath);
-        memset(&wd->kpath, 0, sizeof(wd->kpath));
-    }
-}
-
-static struct watch_dir g_watch = { .path = "/data/system",
-                    .mask = MASK_SYSTEM };
-
-int ksu_observer_init(void)
-{
-    int ret = 0;
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)
-    g = fsnotify_alloc_group(&ksu_ops, 0);
-#else
-    g = fsnotify_alloc_group(&ksu_ops);
-#endif
-    if (IS_ERR(g))
-        return PTR_ERR(g);
-
-    ret = watch_one_dir(&g_watch);
-    pr_info("observer init done\n");
-    return 0;
-}
-
-void ksu_observer_exit(void)
-{
-    unwatch_one_dir(&g_watch);
-    fsnotify_put_group(g);
-    pr_info("observer exit done\n");
-}

kernel/seccomp_cache.c

@@ -1,69 +0,0 @@
-#include <linux/version.h>
-#include <linux/fs.h>
-#include <linux/nsproxy.h>
-#include <linux/sched/task.h>
-#include <linux/uaccess.h>
-#include <linux/filter.h>
-#include <linux/seccomp.h>
-#include "klog.h" // IWYU pragma: keep
-#include "seccomp_cache.h"
-
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 2) // Android backport this feature in 5.10.2
-struct action_cache {
-    DECLARE_BITMAP(allow_native, SECCOMP_ARCH_NATIVE_NR);
-#ifdef SECCOMP_ARCH_COMPAT
-    DECLARE_BITMAP(allow_compat, SECCOMP_ARCH_COMPAT_NR);
-#endif
-};
-
-struct seccomp_filter {
-    refcount_t refs;
-    refcount_t users;
-    bool log;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
-    bool wait_killable_recv;
-#endif
-    struct action_cache cache;
-    struct seccomp_filter *prev;
-    struct bpf_prog *prog;
-    struct notification *notif;
-    struct mutex notify_lock;
-    wait_queue_head_t wqh;
-};
-
-void ksu_seccomp_clear_cache(struct seccomp_filter *filter, int nr)
-{
-    if (!filter) {
-        return;
-    }
-
-    if (nr >= 0 && nr < SECCOMP_ARCH_NATIVE_NR) {
-        clear_bit(nr, filter->cache.allow_native);
-    }
-
-#ifdef SECCOMP_ARCH_COMPAT
-    if (nr >= 0 && nr < SECCOMP_ARCH_COMPAT_NR) {
-        clear_bit(nr, filter->cache.allow_compat);
-    }
-#endif
-}
-
-void ksu_seccomp_allow_cache(struct seccomp_filter *filter, int nr)
-{
-    if (!filter) {
-        return;
-    }
-
-    if (nr >= 0 && nr < SECCOMP_ARCH_NATIVE_NR) {
-        set_bit(nr, filter->cache.allow_native);
-    }
-
-#ifdef SECCOMP_ARCH_COMPAT
-    if (nr >= 0 && nr < SECCOMP_ARCH_COMPAT_NR) {
-        set_bit(nr, filter->cache.allow_compat);
-    }
-#endif
-}
-
-#endif

kernel/seccomp_cache.h

@@ -1,12 +0,0 @@
-#ifndef __KSU_H_SECCOMP_CACHE
-#define __KSU_H_SECCOMP_CACHE
-
-#include <linux/fs.h>
-#include <linux/version.h>
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 2) // Android backport this feature in 5.10.2
-extern void ksu_seccomp_clear_cache(struct seccomp_filter *filter, int nr);
-extern void ksu_seccomp_allow_cache(struct seccomp_filter *filter, int nr);
-#endif
-
-#endif

kernel/selinux/Makefile

@@ -2,7 +2,15 @@ obj-y += selinux.o
 obj-y += sepolicy.o
 obj-y += rules.o
 
-ccflags-y += -Wno-strict-prototypes -Wno-int-conversion
+ifeq ($(shell grep -q " current_sid(void)" $(srctree)/security/selinux/include/objsec.h; echo $$?),0)
+ccflags-y += -DKSU_COMPAT_HAS_CURRENT_SID
+endif
+
+ifeq ($(shell grep -q "struct selinux_state " $(srctree)/security/selinux/include/security.h; echo $$?),0)
+ccflags-y += -DKSU_COMPAT_HAS_SELINUX_STATE
+endif
+
+ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion
 ccflags-y += -Wno-declaration-after-statement -Wno-unused-function
 ccflags-y += -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
 ccflags-y += -I$(objtree)/security/selinux -include $(srctree)/include/uapi/asm-generic/errno.h

kernel/selinux/rules.c

@@ -6,7 +6,7 @@
 #include "selinux.h"
 #include "sepolicy.h"
 #include "ss/services.h"
-#include "linux/lsm_audit.h" // IWYU pragma: keep
+#include "linux/lsm_audit.h"
 #include "xfrm.h"
 
 #define SELINUX_POLICY_INSTEAD_SELINUX_SS
@@ -19,24 +19,19 @@
 static struct policydb *get_policydb(void)
 {
 	struct policydb *db;
-    struct selinux_policy *policy = selinux_state.policy;
+	struct selinux_policy *policy = rcu_dereference(selinux_state.policy);
 	db = &policy->policydb;
 	return db;
 }
 
-static DEFINE_MUTEX(ksu_rules);
-
 void apply_kernelsu_rules()
 {
-    struct policydb *db;
-
 	if (!getenforce()) {
 		pr_info("SELinux permissive or disabled, apply rules!\n");
 	}
 
-    mutex_lock(&ksu_rules);
-
-    db = get_policydb();
+	rcu_read_lock();
+	struct policydb *db = get_policydb();
 
 	ksu_permissive(db, KERNEL_SU_DOMAIN);
 	ksu_typeattribute(db, KERNEL_SU_DOMAIN, "mlstrustedsubject");
@@ -127,10 +122,7 @@ void apply_kernelsu_rules()
     ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "getpgid");
     ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "sigkill");
 
-    // https://android-review.googlesource.com/c/platform/system/logging/+/3725346
-    ksu_dontaudit(db, "untrusted_app", KERNEL_SU_DOMAIN, "dir", "getattr");
-
-    mutex_unlock(&ksu_rules);
+	rcu_read_unlock();
 }
 
 #define MAX_SEPOL_LEN 128
@@ -166,18 +158,14 @@ static int get_object(char *buf, char __user *user_object, size_t buf_sz,
 	}
 
 	if (strncpy_from_user(buf, user_object, buf_sz) < 0) {
-        return -EINVAL;
+		return -1;
 	}
 
 	*object = buf;
 
 	return 0;
 }
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 0))
-extern int avc_ss_reset(u32 seqno);
-#else
-extern int avc_ss_reset(struct selinux_avc *avc, u32 seqno);
-#endif
+
 // reset avc cache table, otherwise the new rules will not take effect if already denied
 static void reset_avc_cache()
 {
@@ -196,10 +184,8 @@ static void reset_avc_cache()
 
 int handle_sepolicy(unsigned long arg3, void __user *arg4)
 {
-    struct policydb *db;
-
 	if (!arg4) {
-        return -EINVAL;
+		return -1;
 	}
 
 	if (!getenforce()) {
@@ -209,17 +195,17 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
 	struct sepol_data data;
 	if (copy_from_user(&data, arg4, sizeof(struct sepol_data))) {
 		pr_err("sepol: copy sepol_data failed.\n");
-        return -EINVAL;
+		return -1;
 	}
 
 	u32 cmd = data.cmd;
 	u32 subcmd = data.subcmd;
 
-    mutex_lock(&ksu_rules);
+	rcu_read_lock();
 
-    db = get_policydb();
+	struct policydb *db = get_policydb();
 
-    int ret = -EINVAL;
+	int ret = -1;
 	if (cmd == CMD_NORMAL_PERM) {
 		char src_buf[MAX_SEPOL_LEN];
 		char tgt_buf[MAX_SEPOL_LEN];
@@ -260,7 +246,7 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
 		} else {
 			pr_err("sepol: unknown subcmd: %d\n", subcmd);
 		}
-        ret = success ? 0 : -EINVAL;
+		ret = success ? 0 : -1;
 
 	} else if (cmd == CMD_XPERM) {
 		char src_buf[MAX_SEPOL_LEN];
@@ -305,7 +291,7 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
 		} else {
 			pr_err("sepol: unknown subcmd: %d\n", subcmd);
 		}
-        ret = success ? 0 : -EINVAL;
+		ret = success ? 0 : -1;
 	} else if (cmd == CMD_TYPE_STATE) {
 		char src[MAX_SEPOL_LEN];
 
@@ -467,7 +453,7 @@ int handle_sepolicy(unsigned long arg3, void __user *arg4)
 	}
 
 exit:
-    mutex_unlock(&ksu_rules);
+	rcu_read_unlock();
 
 	// only allow and xallow needs to reset avc cache, but we cannot do that because
 	// we are in atomic context. so we just reset it every time.

kernel/selinux/selinux.c

@@ -1,6 +1,4 @@
 #include "selinux.h"
-#include "linux/cred.h"
-#include "linux/sched.h"
 #include "objsec.h"
 #include "linux/version.h"
 #include "../klog.h" // IWYU pragma: keep
@@ -42,6 +40,13 @@ void setup_selinux(const char *domain)
 		pr_err("transive domain failed.\n");
 		return;
 	}
+
+	/* we didn't need this now, we have change selinux rules when boot!
+if (!is_domain_permissive) {
+  if (set_domain_permissive() == 0) {
+      is_domain_permissive = true;
+  }
+}*/
 }
 
 void setenforce(bool enforce)
@@ -66,89 +71,60 @@ bool getenforce()
 #endif
 }
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 14, 0)
-struct lsm_context {
-    char *context;
-    u32 len;
-};
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 10, 0)) &&                         \
+	!defined(KSU_COMPAT_HAS_CURRENT_SID)
+/*
+ * get the subjective security ID of the current task
+ */
+static inline u32 current_sid(void)
+{
+	const struct task_security_struct *tsec = current_security();
 
-static int __security_secid_to_secctx(u32 secid, struct lsm_context *cp)
-{
-    return security_secid_to_secctx(secid, &cp->context, &cp->len);
+	return tsec->sid;
 }
-static void __security_release_secctx(struct lsm_context *cp)
-{
-    return security_release_secctx(cp->context, cp->len);
-}
-#else
-#define __security_secid_to_secctx security_secid_to_secctx
-#define __security_release_secctx security_release_secctx
 #endif
 
-bool is_task_ksu_domain(const struct cred* cred)
-{
-    struct lsm_context ctx;
-    bool result;
-    if (!cred) {
-        return false;
-    }
-    const struct task_security_struct *tsec = selinux_cred(cred);
-    if (!tsec) {
-        return false;
-    }
-    int err = __security_secid_to_secctx(tsec->sid, &ctx);
-    if (err) {
-        return false;
-    }
-    result = strncmp(KERNEL_SU_DOMAIN, ctx.context, ctx.len) == 0;
-    __security_release_secctx(&ctx);
-    return result;
-}
-
 bool is_ksu_domain()
 {
-    current_sid();
-    return is_task_ksu_domain(current_cred());
-}
-
-bool is_context(const struct cred* cred, const char* context)
-{
-    if (!cred) {
-        return false;
-    }
-    const struct task_security_struct * tsec = selinux_cred(cred);
-    if (!tsec) {
-        return false;
-    }
-    struct lsm_context ctx;
+	char *domain;
+	u32 seclen;
 	bool result;
-    int err = __security_secid_to_secctx(tsec->sid, &ctx);
+	int err = security_secid_to_secctx(current_sid(), &domain, &seclen);
 	if (err) {
 		return false;
 	}
-    result = strncmp(context, ctx.context, ctx.len) == 0;
-    __security_release_secctx(&ctx);
+	result = strncmp(KERNEL_SU_DOMAIN, domain, seclen) == 0;
+	security_release_secctx(domain, seclen);
 	return result;
 }
 
-bool is_zygote(const struct cred* cred)
+bool is_zygote(void *sec)
 {
-    return is_context(cred, "u:r:zygote:s0");
+	struct task_security_struct *tsec = (struct task_security_struct *)sec;
+	if (!tsec) {
+		return false;
 	}
-
-bool is_init(const struct cred* cred) {
-    return is_context(cred, "u:r:init:s0");
-}
-
-#define KSU_FILE_DOMAIN "u:object_r:ksu_file:s0"
-
-u32 ksu_get_ksu_file_sid()
-{
-    u32 ksu_file_sid = 0;
-    int err = security_secctx_to_secid(KSU_FILE_DOMAIN, strlen(KSU_FILE_DOMAIN),
-                       &ksu_file_sid);
+	char *domain;
+	u32 seclen;
+	bool result;
+	int err = security_secid_to_secctx(tsec->sid, &domain, &seclen);
 	if (err) {
-        pr_info("get ksufile sid err %d\n", err);
+		return false;
 	}
-    return ksu_file_sid;
+	result = strncmp("u:r:zygote:s0", domain, seclen) == 0;
+	security_release_secctx(domain, seclen);
+	return result;
+}
+
+#define DEVPTS_DOMAIN "u:object_r:ksu_file:s0"
+
+u32 ksu_get_devpts_sid()
+{
+	u32 devpts_sid = 0;
+	int err = security_secctx_to_secid(DEVPTS_DOMAIN, strlen(DEVPTS_DOMAIN),
+					   &devpts_sid);
+	if (err) {
+		pr_info("get devpts sid err %d\n", err);
+	}
+	return devpts_sid;
 }

kernel/selinux/selinux.h

@@ -3,7 +3,6 @@
 
 #include "linux/types.h"
 #include "linux/version.h"
-#include "linux/cred.h"
 
 void setup_selinux(const char *);
 
@@ -11,18 +10,12 @@ void setenforce(bool);
 
 bool getenforce();
 
-bool is_task_ksu_domain(const struct cred* cred);
-
 bool is_ksu_domain();
 
-bool is_zygote(const struct cred* cred);
-
-bool is_init(const struct cred* cred);
+bool is_zygote(void *cred);
 
 void apply_kernelsu_rules();
 
-u32 ksu_get_ksu_file_sid();
-
-int handle_sepolicy(unsigned long arg3, void __user *arg4);
+u32 ksu_get_devpts_sid();
 
 #endif

kernel/selinux/sepolicy.c

@@ -6,6 +6,7 @@
 #include "sepolicy.h"
 #include "../klog.h" // IWYU pragma: keep
 #include "ss/symtab.h"
+#include "../kernel_compat.h" // Add check Huawei Device
 
 #define KSU_SUPPORT_ADD_TYPE
 
@@ -354,7 +355,7 @@ static void add_xperm_rule_raw(struct policydb *db, struct type_datum *src,
 
 		if (datum->u.xperms == NULL) {
 			datum->u.xperms =
-                (struct avtab_extended_perms *)(kzalloc(
+				(struct avtab_extended_perms *)(kmalloc(
 					sizeof(xperms), GFP_KERNEL));
 			if (!datum->u.xperms) {
 				pr_err("alloc xperms failed\n");
@@ -545,10 +546,10 @@ static bool add_filename_trans(struct policydb *db, const char *s,
 	}
 
 	if (trans == NULL) {
-        trans = (struct filename_trans_datum *)kcalloc(1 ,sizeof(*trans),
-                                   GFP_ATOMIC);
+		trans = (struct filename_trans_datum *)kcalloc(sizeof(*trans),
+							       1, GFP_ATOMIC);
 		struct filename_trans_key *new_key =
-            (struct filename_trans_key *)kzalloc(sizeof(*new_key),
+			(struct filename_trans_key *)kmalloc(sizeof(*new_key),
 							     GFP_ATOMIC);
 		*new_key = key;
 		new_key->name = kstrdup(key.name, GFP_ATOMIC);

kernel/setuid_hook.c

@@ -1,171 +0,0 @@
-#include <linux/compiler.h>
-#include <linux/sched/signal.h>
-#include <linux/slab.h>
-#include <linux/task_work.h>
-#include <linux/thread_info.h>
-#include <linux/seccomp.h>
-#include <linux/bpf.h>
-#include <linux/capability.h>
-#include <linux/cred.h>
-#include <linux/dcache.h>
-#include <linux/err.h>
-#include <linux/fs.h>
-#include <linux/init.h>
-#include <linux/init_task.h>
-#include <linux/kernel.h>
-#include <linux/kprobes.h>
-#include <linux/mm.h>
-#include <linux/mount.h>
-#include <linux/namei.h>
-#include <linux/nsproxy.h>
-#include <linux/path.h>
-#include <linux/printk.h>
-#include <linux/sched.h>
-#include <linux/security.h>
-#include <linux/stddef.h>
-#include <linux/string.h>
-#include <linux/types.h>
-#include <linux/uaccess.h>
-#include <linux/uidgid.h>
-#include <linux/version.h>
-#include <linux/binfmts.h>
-#include <linux/tty.h>
-
-#include "allowlist.h"
-#include "setuid_hook.h"
-#include "feature.h"
-#include "klog.h" // IWYU pragma: keep
-#include "manager.h"
-#include "selinux/selinux.h"
-#include "seccomp_cache.h"
-#include "supercalls.h"
-#include "syscall_hook_manager.h"
-#include "kernel_umount.h"
-#include "app_profile.h"
-
-static bool ksu_enhanced_security_enabled = false;
-
-static int enhanced_security_feature_get(u64 *value)
-{
-    *value = ksu_enhanced_security_enabled ? 1 : 0;
-    return 0;
-}
-
-static int enhanced_security_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    ksu_enhanced_security_enabled = enable;
-    pr_info("enhanced_security: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler enhanced_security_handler = {
-    .feature_id = KSU_FEATURE_ENHANCED_SECURITY,
-    .name = "enhanced_security",
-    .get_handler = enhanced_security_feature_get,
-    .set_handler = enhanced_security_feature_set,
-};
-
-static inline bool is_allow_su()
-{
-    if (is_manager()) {
-        // we are manager, allow!
-        return true;
-    }
-    return ksu_is_allow_uid_for_current(current_uid().val);
-}
-
-int ksu_handle_setresuid(uid_t ruid, uid_t euid, uid_t suid)
-{
-    uid_t new_uid = ruid;
-	uid_t old_uid = current_uid().val;
-    
-    pr_info("handle_setresuid from %d to %d\n", old_uid, new_uid);
-
-    // if old process is root, ignore it.
-    if (old_uid != 0 && ksu_enhanced_security_enabled) {
-        // disallow any non-ksu domain escalation from non-root to root!
-        // euid is what we care about here as it controls permission
-        if (unlikely(euid == 0)) {
-            if (!is_ksu_domain()) {
-                pr_warn("find suspicious EoP: %d %s, from %d to %d\n", 
-                    current->pid, current->comm, old_uid, new_uid);
-                force_sig(SIGKILL);
-                return 0;
-            }
-        }
-        // disallow appuid decrease to any other uid if it is not allowed to su
-        if (is_appuid(old_uid)) {
-            if (euid < current_euid().val && !ksu_is_allow_uid_for_current(old_uid)) {
-                pr_warn("find suspicious EoP: %d %s, from %d to %d\n", 
-                    current->pid, current->comm, old_uid, new_uid);
-                force_sig(SIGKILL);
-                return 0;
-            }
-        }
-        return 0;
-    }
-
-    // if on private space, see if its possibly the manager
-    if (new_uid > PER_USER_RANGE && new_uid % PER_USER_RANGE == ksu_get_manager_uid()) {
-         ksu_set_manager_uid(new_uid);
-    }
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
-    if (ksu_get_manager_uid() == new_uid) {
-        pr_info("install fd for manager: %d\n", new_uid);
-        ksu_install_fd();
-        spin_lock_irq(&current->sighand->siglock);
-        ksu_seccomp_allow_cache(current->seccomp.filter, __NR_reboot);
-        ksu_set_task_tracepoint_flag(current);
-        spin_unlock_irq(&current->sighand->siglock);
-        return 0;
-    }
-
-    if (ksu_is_allow_uid_for_current(new_uid)) {
-        if (current->seccomp.mode == SECCOMP_MODE_FILTER &&
-            current->seccomp.filter) {
-            spin_lock_irq(&current->sighand->siglock);
-            ksu_seccomp_allow_cache(current->seccomp.filter, __NR_reboot);
-            spin_unlock_irq(&current->sighand->siglock);
-        }
-        ksu_set_task_tracepoint_flag(current);
-    } else {
-        ksu_clear_task_tracepoint_flag_if_needed(current);
-    }
-#else
-    if (ksu_is_allow_uid_for_current(new_uid)) {
-		spin_lock_irq(&current->sighand->siglock);
-		disable_seccomp();
-		spin_unlock_irq(&current->sighand->siglock);
-
-		if (ksu_get_manager_uid() == new_uid) {
-			pr_info("install fd for ksu manager(uid=%d)\n",
-				new_uid);
-			ksu_install_fd();
-		}
-
-		return 0;
-	}
-#endif
-
-    // Handle kernel umount
-    ksu_handle_umount(old_uid, new_uid);
-
-    return 0;
-}
-
-void ksu_setuid_hook_init(void)
-{
-    ksu_kernel_umount_init();
-    if (ksu_register_feature_handler(&enhanced_security_handler)) {
-        pr_err("Failed to register enhanced security feature handler\n");
-    }
-}
-
-void ksu_setuid_hook_exit(void)
-{
-    pr_info("ksu_core_exit\n");
-    ksu_kernel_umount_exit();
-    ksu_unregister_feature_handler(KSU_FEATURE_ENHANCED_SECURITY);
-}

kernel/setuid_hook.h

@@ -1,14 +0,0 @@
-#ifndef __KSU_H_KSU_CORE
-#define __KSU_H_KSU_CORE
-
-#include <linux/init.h>
-#include <linux/types.h>
-#include "apk_sign.h"
-#include <linux/thread_info.h>
-
-void ksu_setuid_hook_init(void);
-void ksu_setuid_hook_exit(void);
-
-int ksu_handle_setresuid(uid_t ruid, uid_t euid, uid_t suid);
-
-#endif

kernel/setup.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 set -eu
 
-KERNEL_ROOT=$(pwd)
+GKI_ROOT=$(pwd)
 
 display_usage() {
     echo "Usage: $0 [--cleanup | <commit-or-tag>]"
@@ -12,10 +12,10 @@ display_usage() {
 }
 
 initialize_variables() {
-    if test -d "$KERNEL_ROOT/common/drivers"; then
-         DRIVER_DIR="$KERNEL_ROOT/common/drivers"
-    elif test -d "$KERNEL_ROOT/drivers"; then
-         DRIVER_DIR="$KERNEL_ROOT/drivers"
+    if test -d "$GKI_ROOT/common/drivers"; then
+         DRIVER_DIR="$GKI_ROOT/common/drivers"
+    elif test -d "$GKI_ROOT/drivers"; then
+         DRIVER_DIR="$GKI_ROOT/drivers"
     else
          echo '[ERROR] "drivers/" directory not found.'
          exit 127
@@ -30,21 +30,22 @@ perform_cleanup() {
     echo "[+] Cleaning up..."
     [ -L "$DRIVER_DIR/kernelsu" ] && rm "$DRIVER_DIR/kernelsu" && echo "[-] Symlink removed."
     grep -q "kernelsu" "$DRIVER_MAKEFILE" && sed -i '/kernelsu/d' "$DRIVER_MAKEFILE" && echo "[-] Makefile reverted."
-    grep -q "kernelsu" "$DRIVER_KCONFIG" && sed -i '/kernelsu/d' "$DRIVER_KCONFIG" && echo "[-] Kconfig reverted."
-    if [ -d "$KERNEL_ROOT/KernelSU" ]; then
-        rm -rf "$KERNEL_ROOT/KernelSU" && echo "[-] KernelSU directory deleted."
+    grep -q "drivers/kernelsu/Kconfig" "$DRIVER_KCONFIG" && sed -i '/drivers\/kernelsu\/Kconfig/d' "$DRIVER_KCONFIG" && echo "[-] Kconfig reverted."
+    if [ -d "$GKI_ROOT/KernelSU" ]; then
+        rm -rf "$GKI_ROOT/KernelSU" && echo "[-] KernelSU directory deleted."
     fi
 }
 
 # Sets up or update KernelSU environment
 setup_kernelsu() {
     echo "[+] Setting up KernelSU..."
-    # Clone the repository
-    if [ ! -d "$KERNEL_ROOT/KernelSU" ]; then
-        git clone https://github.com/SukiSU-Ultra/SukiSU-Ultra KernelSU
-        echo "[+] Repository cloned."
+    # Clone the repository and rename it to KernelSU
+    if [ ! -d "$GKI_ROOT/KernelSU" ]; then
+        git clone https://github.com/ShirkNeko/SukiSU-Ultra SukiSU-Ultra
+        mv SukiSU-Ultra KernelSU
+        echo "[+] Repository cloned and renamed to KernelSU."
     fi
-    cd "$KERNEL_ROOT/KernelSU"
+    cd "$GKI_ROOT/KernelSU"
     git stash && echo "[-] Stashed current changes."
     if [ "$(git status | grep -Po 'v\d+(\.\d+)*' | head -n1)" ]; then
         git checkout main && echo "[-] Switched to main branch."
@@ -56,11 +57,11 @@ setup_kernelsu() {
         git checkout "$1" && echo "[-] Checked out $1." || echo "[-] Checkout default branch"
     fi
     cd "$DRIVER_DIR"
-    ln -sf "$(realpath --relative-to="$DRIVER_DIR" "$KERNEL_ROOT/KernelSU/kernel")" "kernelsu" && echo "[+] Symlink created."
+    ln -sf "$(realpath --relative-to="$DRIVER_DIR" "$GKI_ROOT/KernelSU/kernel")" "kernelsu" && echo "[+] Symlink created."
 
     # Add entries in Makefile and Kconfig if not already existing
-    grep -q "kernelsu" "$DRIVER_MAKEFILE" || echo 'obj-$(CONFIG_KSU) += kernelsu/' >> "$DRIVER_MAKEFILE" && echo "[+] Modified Makefile."
-    grep -q 'source "drivers/kernelsu/Kconfig"' "$DRIVER_KCONFIG" || sed -i '/endmenu/i\source "drivers/kernelsu/Kconfig"' "$DRIVER_KCONFIG" && echo "[+] Modified Kconfig."
+    grep -q "kernelsu" "$DRIVER_MAKEFILE" || printf "\nobj-\$(CONFIG_KSU) += kernelsu/\n" >> "$DRIVER_MAKEFILE" && echo "[+] Modified Makefile."
+    grep -q "source \"drivers/kernelsu/Kconfig\"" "$DRIVER_KCONFIG" || sed -i "/endmenu/i\source \"drivers/kernelsu/Kconfig\"" "$DRIVER_KCONFIG" && echo "[+] Modified Kconfig."
     echo '[+] Done.'
 }
 

kernel/sucompat.c

@@ -1,54 +1,31 @@
-#include "linux/compiler.h"
-#include "linux/printk.h"
+#include <linux/dcache.h>
+#include <linux/security.h>
 #include <asm/current.h>
 #include <linux/cred.h>
+#include <linux/err.h>
 #include <linux/fs.h>
+#include <linux/kprobes.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
 #include <linux/version.h>
 #include <linux/sched/task_stack.h>
-#include <linux/ptrace.h>
 
+#include "objsec.h"
 #include "allowlist.h"
-#include "feature.h"
+#include "arch.h"
 #include "klog.h" // IWYU pragma: keep
 #include "ksud.h"
-#include "sucompat.h"
-#include "app_profile.h"
-#include "syscall_hook_manager.h"
-
-#include "sulog.h"
+#include "kernel_compat.h"
 
 #define SU_PATH "/system/bin/su"
 #define SH_PATH "/system/bin/sh"
 
-bool ksu_su_compat_enabled __read_mostly = true;
-
-static int su_compat_feature_get(u64 *value)
-{
-    *value = ksu_su_compat_enabled ? 1 : 0;
-    return 0;
-}
-
-static int su_compat_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    ksu_su_compat_enabled = enable;
-    pr_info("su_compat: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler su_compat_handler = {
-    .feature_id = KSU_FEATURE_SU_COMPAT,
-    .name = "su_compat",
-    .get_handler = su_compat_feature_get,
-    .set_handler = su_compat_feature_set,
-};
+extern void escape_to_root();
 
 static void __user *userspace_stack_buffer(const void *d, size_t len)
 {
-    // To avoid having to mmap a page in userspace, just write below the stack
-    // pointer.
+	/* To avoid having to mmap a page in userspace, just write below the stack
+   * pointer. */
 	char __user *p = (void __user *)current_user_stack_pointer() - len;
 
 	return copy_to_user(p, d, len) ? NULL : p;
@@ -73,18 +50,15 @@ int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode,
 {
 	const char su[] = SU_PATH;
 
-    if (!ksu_is_allow_uid_for_current(current_uid().val)) {
+	if (!ksu_is_allow_uid(current_uid().val)) {
 		return 0;
 	}
 
 	char path[sizeof(su) + 1];
 	memset(path, 0, sizeof(path));
-    strncpy_from_user_nofault(path, *filename_user, sizeof(path));
+	ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path));
 
 	if (unlikely(!memcmp(path, su, sizeof(su)))) {
-#if __SULOG_GATE
-        ksu_sulog_report_syscall(current_uid().val, NULL, "faccessat", path);
-#endif
 		pr_info("faccessat su->sh!\n");
 		*filename_user = sh_user_path();
 	}
@@ -97,7 +71,7 @@ int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags)
 	// const char sh[] = SH_PATH;
 	const char su[] = SU_PATH;
 
-    if (!ksu_is_allow_uid_for_current(current_uid().val)) {
+	if (!ksu_is_allow_uid(current_uid().val)) {
 		return 0;
 	}
 
@@ -107,20 +81,63 @@ int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags)
 
 	char path[sizeof(su) + 1];
 	memset(path, 0, sizeof(path));
-    strncpy_from_user_nofault(path, *filename_user, sizeof(path));
+// Remove this later!! we use syscall hook, so this will never happen!!!!!
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0) && 0
+	// it becomes a `struct filename *` after 5.18
+	// https://elixir.bootlin.com/linux/v5.18/source/fs/stat.c#L216
+	const char sh[] = SH_PATH;
+	struct filename *filename = *((struct filename **)filename_user);
+	if (IS_ERR(filename)) {
+		return 0;
+	}
+	if (likely(memcmp(filename->name, su, sizeof(su))))
+		return 0;
+	pr_info("vfs_statx su->sh!\n");
+	memcpy((void *)filename->name, sh, sizeof(sh));
+#else
+	ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path));
 
 	if (unlikely(!memcmp(path, su, sizeof(su)))) {
-#if __SULOG_GATE
-        ksu_sulog_report_syscall(current_uid().val, NULL, "newfstatat", path);
-#endif
 		pr_info("newfstatat su->sh!\n");
 		*filename_user = sh_user_path();
 	}
+#endif
 
 	return 0;
 }
 
-int ksu_handle_execve_sucompat(const char __user **filename_user,
+// the call from execve_handler_pre won't provided correct value for __never_use_argument, use them after fix execve_handler_pre, keeping them for consistence for manually patched code
+int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr,
+				 void *__never_use_argv, void *__never_use_envp,
+				 int *__never_use_flags)
+{
+	struct filename *filename;
+	const char sh[] = KSUD_PATH;
+	const char su[] = SU_PATH;
+
+	if (unlikely(!filename_ptr))
+		return 0;
+
+	filename = *filename_ptr;
+	if (IS_ERR(filename)) {
+		return 0;
+	}
+
+	if (likely(memcmp(filename->name, su, sizeof(su))))
+		return 0;
+
+	if (!ksu_is_allow_uid(current_uid().val))
+		return 0;
+
+	pr_info("do_execveat_common su found\n");
+	memcpy((void *)filename->name, sh, sizeof(sh));
+
+	escape_to_root();
+
+	return 0;
+}
+
+int ksu_handle_execve_sucompat(int *fd, const char __user **filename_user,
 			       void *__never_use_argv, void *__never_use_envp,
 			       int *__never_use_flags)
 {
@@ -131,42 +148,103 @@ int ksu_handle_execve_sucompat(const char __user **filename_user,
 		return 0;
 
 	memset(path, 0, sizeof(path));
-    strncpy_from_user_nofault(path, *filename_user, sizeof(path));
+	ksu_strncpy_from_user_nofault(path, *filename_user, sizeof(path));
 
 	if (likely(memcmp(path, su, sizeof(su))))
 		return 0;
 
-#if __SULOG_GATE
-    bool is_allowed = ksu_is_allow_uid_for_current(current_uid().val);
-    ksu_sulog_report_syscall(current_uid().val, NULL, "execve", path);
-    
-    if (!is_allowed)
+	if (!ksu_is_allow_uid(current_uid().val))
 		return 0;
 
-    ksu_sulog_report_su_attempt(current_uid().val, NULL, path, is_allowed);
-#else
-    if (!ksu_is_allow_uid_for_current(current_uid().val)) {
-        return 0;
-    }
-#endif
-
 	pr_info("sys_execve su found\n");
 	*filename_user = ksud_user_path();
 
-    escape_with_root_profile();
+	escape_to_root();
 
 	return 0;
 }
 
-// sucompat: permitted process can execute 'su' to gain root access.
+#ifdef CONFIG_KPROBES
+static int faccessat_handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+	struct pt_regs *real_regs = PT_REAL_REGS(regs);
+	int *dfd = (int *)&PT_REGS_PARM1(real_regs);
+	const char __user **filename_user =
+		(const char **)&PT_REGS_PARM2(real_regs);
+	int *mode = (int *)&PT_REGS_PARM3(real_regs);
+
+	return ksu_handle_faccessat(dfd, filename_user, mode, NULL);
+}
+
+static int newfstatat_handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+	struct pt_regs *real_regs = PT_REAL_REGS(regs);
+	int *dfd = (int *)&PT_REGS_PARM1(real_regs);
+	const char __user **filename_user =
+		(const char **)&PT_REGS_PARM2(real_regs);
+	int *flags = (int *)&PT_REGS_SYSCALL_PARM4(real_regs);
+
+	return ksu_handle_stat(dfd, filename_user, flags);
+}
+
+static int execve_handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+	struct pt_regs *real_regs = PT_REAL_REGS(regs);
+	const char __user **filename_user =
+		(const char **)&PT_REGS_PARM1(real_regs);
+
+	return ksu_handle_execve_sucompat(AT_FDCWD, filename_user, NULL, NULL,
+					  NULL);
+}
+
+static struct kprobe *init_kprobe(const char *name,
+				  kprobe_pre_handler_t handler)
+{
+	struct kprobe *kp = kzalloc(sizeof(struct kprobe), GFP_KERNEL);
+	if (!kp)
+		return NULL;
+	kp->symbol_name = name;
+	kp->pre_handler = handler;
+
+	int ret = register_kprobe(kp);
+	pr_info("sucompat: register_%s kprobe: %d\n", name, ret);
+	if (ret) {
+		kfree(kp);
+		return NULL;
+	}
+
+	return kp;
+}
+
+static void destroy_kprobe(struct kprobe **kp_ptr)
+{
+	struct kprobe *kp = *kp_ptr;
+	if (!kp)
+		return;
+	unregister_kprobe(kp);
+	synchronize_rcu();
+	kfree(kp);
+	*kp_ptr = NULL;
+}
+
+static struct kprobe *su_kps[3];
+#endif
+
+// sucompat: permited process can execute 'su' to gain root access.
 void ksu_sucompat_init()
 {
-    if (ksu_register_feature_handler(&su_compat_handler)) {
-        pr_err("Failed to register su_compat feature handler\n");
-    }
+#ifdef CONFIG_KPROBES
+	su_kps[0] = init_kprobe(SYS_EXECVE_SYMBOL, execve_handler_pre);
+	su_kps[1] = init_kprobe(SYS_FACCESSAT_SYMBOL, faccessat_handler_pre);
+	su_kps[2] = init_kprobe(SYS_NEWFSTATAT_SYMBOL, newfstatat_handler_pre);
+#endif
 }
 
 void ksu_sucompat_exit()
 {
-    ksu_unregister_feature_handler(KSU_FEATURE_SU_COMPAT);
+#ifdef CONFIG_KPROBES
+	for (int i = 0; i < ARRAY_SIZE(su_kps); i++) {
+		destroy_kprobe(&su_kps[i]);
+	}
+#endif
 }

kernel/sucompat.h

@@ -1,18 +0,0 @@
-#ifndef __KSU_H_SUCOMPAT
-#define __KSU_H_SUCOMPAT
-#include <linux/types.h>
-
-extern bool ksu_su_compat_enabled;
-
-void ksu_sucompat_init(void);
-void ksu_sucompat_exit(void);
-
-// Handler functions exported for hook_manager
-int ksu_handle_faccessat(int *dfd, const char __user **filename_user,
-			 int *mode, int *__unused_flags);
-int ksu_handle_stat(int *dfd, const char __user **filename_user, int *flags);
-int ksu_handle_execve_sucompat(const char __user **filename_user,
-			       void *__never_use_argv, void *__never_use_envp,
-			       int *__never_use_flags);
-
-#endif

kernel/sulog.c

@@ -1,369 +0,0 @@
-#include <linux/fs.h>
-#include <linux/kernel.h>
-#include <linux/printk.h>
-#include <linux/slab.h>
-#include <linux/string.h>
-#include <linux/time.h>
-#include <linux/types.h>
-#include <linux/uaccess.h>
-#include <linux/workqueue.h>
-#include <linux/cred.h>
-#include <linux/sched.h>
-#include <linux/mm.h>
-#include <linux/mutex.h>
-#include <linux/spinlock.h>
-
-#include "klog.h"
-
-#include "sulog.h"
-#include "ksu.h"
-#include "feature.h"
-
-#if __SULOG_GATE
-
-struct dedup_entry dedup_tbl[SULOG_COMM_LEN];
-static DEFINE_SPINLOCK(dedup_lock);
-static LIST_HEAD(sulog_queue);
-static struct workqueue_struct *sulog_workqueue;
-static struct work_struct sulog_work;
-static bool sulog_enabled __read_mostly = true;
-
-static int sulog_feature_get(u64 *value)
-{
-    *value = sulog_enabled ? 1 : 0;
-    return 0;
-}
-
-static int sulog_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    sulog_enabled = enable;
-    pr_info("sulog: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler sulog_handler = {
-    .feature_id = KSU_FEATURE_SULOG,
-    .name = "sulog",
-    .get_handler = sulog_feature_get,
-    .set_handler = sulog_feature_set,
-};
-
-static void get_timestamp(char *buf, size_t len)
-{
-    struct timespec64 ts;
-    struct tm tm;
-
-    ktime_get_real_ts64(&ts);
-    time64_to_tm(ts.tv_sec - sys_tz.tz_minuteswest * 60, 0, &tm);
-
-    snprintf(buf, len, "%04ld-%02d-%02d %02d:%02d:%02d",
-        tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
-        tm.tm_hour, tm.tm_min, tm.tm_sec);
-}
-
-static void ksu_get_cmdline(char *full_comm, const char *comm, size_t buf_len)
-{
-    if (!full_comm || buf_len <= 0)
-        return;
-
-    if (comm && strlen(comm) > 0) {
-        KSU_STRSCPY(full_comm, comm, buf_len);
-        return;
-    }
-
-    if (in_atomic() || in_interrupt() || irqs_disabled()) {
-        KSU_STRSCPY(full_comm, current->comm, buf_len);
-        return;
-    }
-
-    if (!current->mm) {
-        KSU_STRSCPY(full_comm, current->comm, buf_len);
-        return;
-    }
-
-    int n = get_cmdline(current, full_comm, buf_len);
-    if (n <= 0) {
-        KSU_STRSCPY(full_comm, current->comm, buf_len);
-        return;
-    }
-
-    for (int i = 0; i < n && i < buf_len - 1; i++) {
-        if (full_comm[i] == '\0')
-            full_comm[i] = ' ';
-    }
-    full_comm[n < buf_len ? n : buf_len - 1] = '\0';
-}
-
-static void sanitize_string(char *str, size_t len)
-{
-    if (!str || len == 0)
-        return;
-    
-    size_t read_pos = 0, write_pos = 0;
-    
-    while (read_pos < len && str[read_pos] != '\0') {
-        char c = str[read_pos];
-        
-        if (c == '\n' || c == '\r') {
-            read_pos++;
-            continue;
-        }
-        
-        if (c == ' ' && write_pos > 0 && str[write_pos - 1] == ' ') {
-            read_pos++;
-            continue;
-        }
-        
-        str[write_pos++] = c;
-        read_pos++;
-    }
-    
-    str[write_pos] = '\0';
-}
-
-static bool dedup_should_print(uid_t uid, u8 type, const char *content, size_t len)
-{
-    struct dedup_key key = {
-        .crc = dedup_calc_hash(content, len),
-        .uid = uid,
-        .type = type,
-    };
-    u64 now = ktime_get_ns();
-    u64 delta_ns = DEDUP_SECS * NSEC_PER_SEC;
-
-    u32 idx = key.crc & (SULOG_COMM_LEN - 1);
-    spin_lock(&dedup_lock);
-
-    struct dedup_entry *e = &dedup_tbl[idx];
-    if (e->key.crc == key.crc &&
-        e->key.uid == key.uid &&
-        e->key.type == key.type &&
-        (now - e->ts_ns) < delta_ns) {
-        spin_unlock(&dedup_lock);
-        return false;
-    }
-
-    e->key = key;
-    e->ts_ns = now;
-    spin_unlock(&dedup_lock);
-    return true;
-}
-
-static void sulog_work_handler(struct work_struct *work)
-{
-    struct file *fp;
-    struct sulog_entry *entry, *tmp;
-    LIST_HEAD(local_queue);
-    loff_t pos = 0;
-    unsigned long flags;
-
-    spin_lock_irqsave(&dedup_lock, flags);
-    list_splice_init(&sulog_queue, &local_queue);
-    spin_unlock_irqrestore(&dedup_lock, flags);
-
-    if (list_empty(&local_queue))
-        return;
-
-    fp = filp_open(SULOG_PATH, O_WRONLY | O_CREAT | O_APPEND, 0640);
-    if (IS_ERR(fp)) {
-        pr_err("sulog: failed to open log file: %ld\n", PTR_ERR(fp));
-        goto cleanup;
-    }
-
-    if (fp->f_inode->i_size > SULOG_MAX_SIZE) {
-        if (vfs_truncate(&fp->f_path, 0))
-            pr_err("sulog: failed to truncate log file\n");
-        pos = 0;
-    } else {
-        pos = fp->f_inode->i_size;
-    }
-
-    list_for_each_entry(entry, &local_queue, list)
-        kernel_write(fp, entry->content, strlen(entry->content), &pos);
-
-    vfs_fsync(fp, 0);
-    filp_close(fp, 0);
-
-cleanup:
-    list_for_each_entry_safe(entry, tmp, &local_queue, list) {
-        list_del(&entry->list);
-        kfree(entry);
-    }
-}
-
-static void sulog_add_entry(char *log_buf, size_t len, uid_t uid, u8 dedup_type)
-{
-    struct sulog_entry *entry;
-    unsigned long flags;
-
-    if (!sulog_enabled || !log_buf || len == 0)
-        return;
-
-    if (!dedup_should_print(uid, dedup_type, log_buf, len))
-        return;
-
-    entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-    if (!entry)
-        return;
-
-    KSU_STRSCPY(entry->content, log_buf, SULOG_ENTRY_MAX_LEN);
-
-    spin_lock_irqsave(&dedup_lock, flags);
-    list_add_tail(&entry->list, &sulog_queue);
-    spin_unlock_irqrestore(&dedup_lock, flags);
-
-    if (sulog_workqueue)
-        queue_work(sulog_workqueue, &sulog_work);
-}
-
-void ksu_sulog_report_su_grant(uid_t uid, const char *comm, const char *method)
-{
-    char log_buf[SULOG_ENTRY_MAX_LEN];
-    char timestamp[32];
-    char full_comm[SULOG_COMM_LEN];
-
-    if (!sulog_enabled)
-        return;
-
-    get_timestamp(timestamp, sizeof(timestamp));
-    ksu_get_cmdline(full_comm, comm, sizeof(full_comm));
-    
-    sanitize_string(full_comm, sizeof(full_comm));
-
-    snprintf(log_buf, sizeof(log_buf),
-        "[%s] SU_GRANT: UID=%d COMM=%s METHOD=%s PID=%d\n",
-        timestamp, uid, full_comm, method ? method : "unknown", current->pid);
-
-    sulog_add_entry(log_buf, strlen(log_buf), uid, DEDUP_SU_GRANT);
-}
-
-void ksu_sulog_report_su_attempt(uid_t uid, const char *comm, const char *target_path, bool success)
-{
-    char log_buf[SULOG_ENTRY_MAX_LEN];
-    char timestamp[32];
-    char full_comm[SULOG_COMM_LEN];
-
-    if (!sulog_enabled)
-        return;
-
-    get_timestamp(timestamp, sizeof(timestamp));
-    ksu_get_cmdline(full_comm, comm, sizeof(full_comm));
-    
-    sanitize_string(full_comm, sizeof(full_comm));
-
-    snprintf(log_buf, sizeof(log_buf),
-        "[%s] SU_EXEC: UID=%d COMM=%s TARGET=%s RESULT=%s PID=%d\n",
-        timestamp, uid, full_comm, target_path ? target_path : "unknown",
-        success ? "SUCCESS" : "DENIED", current->pid);
-
-    sulog_add_entry(log_buf, strlen(log_buf), uid, DEDUP_SU_ATTEMPT);
-}
-
-void ksu_sulog_report_permission_check(uid_t uid, const char *comm, bool allowed)
-{
-    char log_buf[SULOG_ENTRY_MAX_LEN];
-    char timestamp[32];
-    char full_comm[SULOG_COMM_LEN];
-
-    if (!sulog_enabled)
-        return;
-
-    get_timestamp(timestamp, sizeof(timestamp));
-    ksu_get_cmdline(full_comm, comm, sizeof(full_comm));
-    
-    sanitize_string(full_comm, sizeof(full_comm));
-
-    snprintf(log_buf, sizeof(log_buf),
-        "[%s] PERM_CHECK: UID=%d COMM=%s RESULT=%s PID=%d\n",
-        timestamp, uid, full_comm, allowed ? "ALLOWED" : "DENIED", current->pid);
-
-    sulog_add_entry(log_buf, strlen(log_buf), uid, DEDUP_PERM_CHECK);
-}
-
-void ksu_sulog_report_manager_operation(const char *operation, uid_t manager_uid, uid_t target_uid)
-{
-    char log_buf[SULOG_ENTRY_MAX_LEN];
-    char timestamp[32];
-    char full_comm[SULOG_COMM_LEN];
-
-    if (!sulog_enabled)
-        return;
-
-    get_timestamp(timestamp, sizeof(timestamp));
-    ksu_get_cmdline(full_comm, NULL, sizeof(full_comm));
-    
-    sanitize_string(full_comm, sizeof(full_comm));
-
-    snprintf(log_buf, sizeof(log_buf),
-        "[%s] MANAGER_OP: OP=%s MANAGER_UID=%d TARGET_UID=%d COMM=%s PID=%d\n",
-        timestamp, operation ? operation : "unknown", manager_uid, target_uid, full_comm, current->pid);
-
-    sulog_add_entry(log_buf, strlen(log_buf), manager_uid, DEDUP_MANAGER_OP);
-}
-
-void ksu_sulog_report_syscall(uid_t uid, const char *comm, const char *syscall, const char *args)
-{
-    char log_buf[SULOG_ENTRY_MAX_LEN];
-    char timestamp[32];
-    char full_comm[SULOG_COMM_LEN];
-
-    if (!sulog_enabled)
-        return;
-
-    get_timestamp(timestamp, sizeof(timestamp));
-    ksu_get_cmdline(full_comm, comm, sizeof(full_comm));
-    
-    sanitize_string(full_comm, sizeof(full_comm));
-
-    snprintf(log_buf, sizeof(log_buf),
-        "[%s] SYSCALL: UID=%d COMM=%s SYSCALL=%s ARGS=%s PID=%d\n",
-        timestamp, uid, full_comm, syscall ? syscall : "unknown",
-        args ? args : "none", current->pid);
-
-    sulog_add_entry(log_buf, strlen(log_buf), uid, DEDUP_SYSCALL);
-}
-
-int ksu_sulog_init(void)
-{
-    if (ksu_register_feature_handler(&sulog_handler)) {
-        pr_err("Failed to register sulog feature handler\n");
-    }
-
-    sulog_workqueue = alloc_workqueue("ksu_sulog", WQ_UNBOUND | WQ_HIGHPRI, 1);
-    if (!sulog_workqueue) {
-        pr_err("sulog: failed to create workqueue\n");
-        return -ENOMEM;
-    }
-
-    INIT_WORK(&sulog_work, sulog_work_handler);
-    pr_info("sulog: initialized successfully\n");
-    return 0;
-}
-
-void ksu_sulog_exit(void)
-{
-    struct sulog_entry *entry, *tmp;
-    unsigned long flags;
-
-    ksu_unregister_feature_handler(KSU_FEATURE_SULOG);
-
-    sulog_enabled = false;
-
-    if (sulog_workqueue) {
-        flush_workqueue(sulog_workqueue);
-        destroy_workqueue(sulog_workqueue);
-        sulog_workqueue = NULL;
-    }
-
-    spin_lock_irqsave(&dedup_lock, flags);
-    list_for_each_entry_safe(entry, tmp, &sulog_queue, list) {
-        list_del(&entry->list);
-        kfree(entry);
-    }
-    spin_unlock_irqrestore(&dedup_lock, flags);
-
-    pr_info("sulog: cleaned up successfully\n");
-}
-
-#endif // __SULOG_GATE

kernel/sulog.h

@@ -1,93 +0,0 @@
-#ifndef __KSU_SULOG_H
-#define __KSU_SULOG_H
-
-#include <linux/types.h>
-#include <linux/version.h>
-#include <linux/crc32.h> // needed for function dedup_calc_hash
-
-#define __SULOG_GATE 1
-
-#if __SULOG_GATE
-
-extern struct timezone sys_tz;
-
-#define SULOG_PATH "/data/adb/ksu/log/sulog.log"
-#define SULOG_MAX_SIZE (32 * 1024 * 1024) // 128MB
-#define SULOG_ENTRY_MAX_LEN 512
-#define SULOG_COMM_LEN 256
-#define DEDUP_SECS 10
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 10, 0)
-static inline size_t strlcpy(char *dest, const char *src, size_t size)
-{
-    return strscpy(dest, src, size);
-}
-#endif
-
-#define KSU_STRSCPY(dst, src, size) \
-    do { \
-        if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)) { \
-            strscpy(dst, src, size); \
-        } else { \
-            strlcpy(dst, src, size); \
-        } \
-    } while (0)
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0)
-#include <linux/rtc.h>
-
-static inline void time64_to_tm(time64_t totalsecs, int offset, struct tm *result)
-{
-    struct rtc_time rtc_tm;
-    rtc_time64_to_tm(totalsecs, &rtc_tm);
-
-    result->tm_sec = rtc_tm.tm_sec;
-    result->tm_min = rtc_tm.tm_min;
-    result->tm_hour = rtc_tm.tm_hour;
-    result->tm_mday = rtc_tm.tm_mday;
-    result->tm_mon = rtc_tm.tm_mon;
-    result->tm_year = rtc_tm.tm_year;
-}
-#endif
-
-struct dedup_key {
-    u32 crc;
-    uid_t uid;
-    u8 type;
-    u8 _pad[1];
-};
-
-struct dedup_entry {
-    struct dedup_key key;
-    u64 ts_ns;
-};
-
-enum {
-    DEDUP_SU_GRANT = 0,
-    DEDUP_SU_ATTEMPT,
-    DEDUP_PERM_CHECK,
-    DEDUP_MANAGER_OP,
-    DEDUP_SYSCALL,
-};
-
-static inline u32 dedup_calc_hash(const char *content, size_t len)
-{
-    return crc32(0, content, len);
-}
-
-struct sulog_entry {
-    struct list_head list;
-    char content[SULOG_ENTRY_MAX_LEN];
-};
-
-void ksu_sulog_report_su_grant(uid_t uid, const char *comm, const char *method);
-void ksu_sulog_report_su_attempt(uid_t uid, const char *comm, const char *target_path, bool success);
-void ksu_sulog_report_permission_check(uid_t uid, const char *comm, bool allowed);
-void ksu_sulog_report_manager_operation(const char *operation, uid_t manager_uid, uid_t target_uid);
-void ksu_sulog_report_syscall(uid_t uid, const char *comm, const char *syscall, const char *args);
-
-int ksu_sulog_init(void);
-void ksu_sulog_exit(void);
-#endif // __SULOG_GATE
-
-#endif /* __KSU_SULOG_H */

kernel/supercalls.h

@@ -1,197 +0,0 @@
-#ifndef __KSU_H_SUPERCALLS
-#define __KSU_H_SUPERCALLS
-
-#include <linux/types.h>
-#include <linux/ioctl.h>
-#include "ksu.h"
-#include "app_profile.h"
-
-#ifdef CONFIG_KPM
-#include "kpm/kpm.h"
-#endif
-
-// Magic numbers for reboot hook to install fd
-#define KSU_INSTALL_MAGIC1 0xDEADBEEF
-#define KSU_INSTALL_MAGIC2 0xCAFEBABE
-
-// Command structures for ioctl
-
-struct ksu_become_daemon_cmd {
-    __u8 token[65]; // Input: daemon token (null-terminated)
-};
-
-struct ksu_get_info_cmd {
-    __u32 version; // Output: KERNEL_SU_VERSION
-    __u32 flags; // Output: flags (bit 0: MODULE mode)
-    __u32 features; // Output: max feature ID supported
-};
-
-struct ksu_report_event_cmd {
-    __u32 event; // Input: EVENT_POST_FS_DATA, EVENT_BOOT_COMPLETED, etc.
-};
-
-struct ksu_set_sepolicy_cmd {
-    __u64 cmd; // Input: sepolicy command
-    __aligned_u64 arg; // Input: sepolicy argument pointer
-};
-
-struct ksu_check_safemode_cmd {
-    __u8 in_safe_mode; // Output: true if in safe mode, false otherwise
-};
-
-struct ksu_get_allow_list_cmd {
-    __u32 uids[128]; // Output: array of allowed/denied UIDs
-    __u32 count; // Output: number of UIDs in array
-    __u8 allow; // Input: true for allow list, false for deny list
-};
-
-struct ksu_uid_granted_root_cmd {
-    __u32 uid; // Input: target UID to check
-    __u8 granted; // Output: true if granted, false otherwise
-};
-
-struct ksu_uid_should_umount_cmd {
-    __u32 uid; // Input: target UID to check
-    __u8 should_umount; // Output: true if should umount, false otherwise
-};
-
-struct ksu_get_manager_uid_cmd {
-    __u32 uid; // Output: manager UID
-};
-
-struct ksu_get_app_profile_cmd {
-    struct app_profile profile; // Input/Output: app profile structure
-};
-
-struct ksu_set_app_profile_cmd {
-    struct app_profile profile; // Input: app profile structure
-};
-
-struct ksu_get_feature_cmd {
-    __u32 feature_id; // Input: feature ID (enum ksu_feature_id)
-    __u64 value; // Output: feature value/state
-    __u8 supported; // Output: true if feature is supported, false otherwise
-};
-
-struct ksu_set_feature_cmd {
-    __u32 feature_id; // Input: feature ID (enum ksu_feature_id)
-    __u64 value; // Input: feature value/state to set
-};
-
-struct ksu_get_wrapper_fd_cmd {
-    __u32 fd; // Input: userspace fd
-    __u32 flags; // Input: flags of userspace fd
-};
-
-struct ksu_manage_mark_cmd {
-    __u32 operation; // Input: KSU_MARK_*
-    __s32 pid; // Input: target pid (0 for all processes)
-    __u32 result; // Output: for get operation - mark status or reg_count
-};
-
-#define KSU_MARK_GET 1
-#define KSU_MARK_MARK 2
-#define KSU_MARK_UNMARK 3
-#define KSU_MARK_REFRESH 4
-
-struct ksu_nuke_ext4_sysfs_cmd {
-    __aligned_u64 arg; // Input: mnt pointer
-};
-
-struct ksu_add_try_umount_cmd {
-	__aligned_u64 arg; // char ptr, this is the mountpoint
-	__u32 flags; // this is the flag we use for it
-	__u8 mode; // denotes what to do with it 0:wipe_list 1:add_to_list 2:delete_entry
-};
-
-#define KSU_UMOUNT_WIPE 0  // ignore everything and wipe list
-#define KSU_UMOUNT_ADD 1   // add entry (path + flags)
-#define KSU_UMOUNT_DEL 2   // delete entry, strcmp
-
-
-// Other command structures
-struct ksu_get_full_version_cmd {
-    char version_full[KSU_FULL_VERSION_STRING]; // Output: full version string
-};
-
-struct ksu_hook_type_cmd {
-    char hook_type[32]; // Output: hook type string
-};
-
-struct ksu_enable_kpm_cmd {
-    __u8 enabled; // Output: true if KPM is enabled
-};
-
-struct ksu_dynamic_manager_cmd {
-    struct dynamic_manager_user_config config; // Input/Output: dynamic manager config
-};
-
-struct ksu_get_managers_cmd {
-    struct manager_list_info manager_info; // Output: manager list information
-};
-
-struct ksu_enable_uid_scanner_cmd {
-    __u32 operation; // Input: operation type (UID_SCANNER_OP_GET_STATUS, UID_SCANNER_OP_TOGGLE, UID_SCANNER_OP_CLEAR_ENV)
-    __u32 enabled; // Input: enable or disable (for UID_SCANNER_OP_TOGGLE)
-    void __user *status_ptr; // Input: pointer to store status (for UID_SCANNER_OP_GET_STATUS)
-};
-
-#ifdef CONFIG_KSU_MANUAL_SU
-struct ksu_manual_su_cmd {
-    __u32 option; // Input: operation type (MANUAL_SU_OP_GENERATE_TOKEN, MANUAL_SU_OP_ESCALATE, MANUAL_SU_OP_ADD_PENDING)
-    __u32 target_uid; // Input: target UID
-    __u32 target_pid; // Input: target PID
-    char token_buffer[33]; // Input/Output: token buffer
-};
-#endif
-
-// IOCTL command definitions
-#define KSU_IOCTL_GRANT_ROOT _IOC(_IOC_NONE, 'K', 1, 0)
-#define KSU_IOCTL_GET_INFO _IOC(_IOC_READ, 'K', 2, 0)
-#define KSU_IOCTL_REPORT_EVENT _IOC(_IOC_WRITE, 'K', 3, 0)
-#define KSU_IOCTL_SET_SEPOLICY _IOC(_IOC_READ|_IOC_WRITE, 'K', 4, 0)
-#define KSU_IOCTL_CHECK_SAFEMODE _IOC(_IOC_READ, 'K', 5, 0)
-#define KSU_IOCTL_GET_ALLOW_LIST _IOC(_IOC_READ|_IOC_WRITE, 'K', 6, 0)
-#define KSU_IOCTL_GET_DENY_LIST _IOC(_IOC_READ|_IOC_WRITE, 'K', 7, 0)
-#define KSU_IOCTL_UID_GRANTED_ROOT _IOC(_IOC_READ|_IOC_WRITE, 'K', 8, 0)
-#define KSU_IOCTL_UID_SHOULD_UMOUNT _IOC(_IOC_READ|_IOC_WRITE, 'K', 9, 0)
-#define KSU_IOCTL_GET_MANAGER_UID _IOC(_IOC_READ, 'K', 10, 0)
-#define KSU_IOCTL_GET_APP_PROFILE _IOC(_IOC_READ|_IOC_WRITE, 'K', 11, 0)
-#define KSU_IOCTL_SET_APP_PROFILE _IOC(_IOC_WRITE, 'K', 12, 0)
-#define KSU_IOCTL_GET_FEATURE _IOC(_IOC_READ|_IOC_WRITE, 'K', 13, 0)
-#define KSU_IOCTL_SET_FEATURE _IOC(_IOC_WRITE, 'K', 14, 0)
-#define KSU_IOCTL_GET_WRAPPER_FD _IOC(_IOC_WRITE, 'K', 15, 0)
-#define KSU_IOCTL_MANAGE_MARK _IOC(_IOC_READ|_IOC_WRITE, 'K', 16, 0)
-#define KSU_IOCTL_NUKE_EXT4_SYSFS _IOC(_IOC_WRITE, 'K', 17, 0)
-#define KSU_IOCTL_ADD_TRY_UMOUNT _IOC(_IOC_WRITE, 'K', 18, 0)
-// Other IOCTL command definitions
-#define KSU_IOCTL_GET_FULL_VERSION _IOC(_IOC_READ, 'K', 100, 0)
-#define KSU_IOCTL_HOOK_TYPE _IOC(_IOC_READ, 'K', 101, 0)
-#define KSU_IOCTL_ENABLE_KPM _IOC(_IOC_READ, 'K', 102, 0)
-#define KSU_IOCTL_DYNAMIC_MANAGER _IOC(_IOC_READ|_IOC_WRITE, 'K', 103, 0)
-#define KSU_IOCTL_GET_MANAGERS _IOC(_IOC_READ|_IOC_WRITE, 'K', 104, 0)
-#define KSU_IOCTL_ENABLE_UID_SCANNER _IOC(_IOC_READ|_IOC_WRITE, 'K', 105, 0)
-#ifdef CONFIG_KSU_MANUAL_SU
-#define KSU_IOCTL_MANUAL_SU _IOC(_IOC_READ|_IOC_WRITE, 'K', 106, 0)
-#endif
-#define KSU_IOCTL_UMOUNT_MANAGER _IOC(_IOC_READ|_IOC_WRITE, 'K', 107, 0)
-
-// IOCTL handler types
-typedef int (*ksu_ioctl_handler_t)(void __user *arg);
-typedef bool (*ksu_perm_check_t)(void);
-
-// IOCTL command mapping
-struct ksu_ioctl_cmd_map {
-    unsigned int cmd;
-    const char *name;
-    ksu_ioctl_handler_t handler;
-    ksu_perm_check_t perm_check; // Permission check function
-};
-
-// Install KSU fd to current process
-int ksu_install_fd(void);
-
-void ksu_supercalls_init(void);
-void ksu_supercalls_exit(void);
-
-#endif // __KSU_H_SUPERCALLS

kernel/syscall_hook_manager.c

@@ -1,374 +0,0 @@
-#include "linux/compiler.h"
-#include "linux/cred.h"
-#include "linux/printk.h"
-#include "selinux/selinux.h"
-#include <linux/spinlock.h>
-#include <linux/kprobes.h>
-#include <linux/tracepoint.h>
-#include <asm/syscall.h>
-#include <linux/slab.h>
-#include <linux/ptrace.h>
-#include <trace/events/syscalls.h>
-#include <linux/namei.h>
-
-#include "allowlist.h"
-#include "arch.h"
-#include "klog.h" // IWYU pragma: keep
-#include "syscall_hook_manager.h"
-#include "sucompat.h"
-#include "setuid_hook.h"
-#include "selinux/selinux.h"
-
-// Tracepoint registration count management
-// == 1: just us
-// >  1: someone else is also using syscall tracepoint e.g. ftrace
-static int tracepoint_reg_count = 0;
-static DEFINE_SPINLOCK(tracepoint_reg_lock);
-
-void ksu_clear_task_tracepoint_flag_if_needed(struct task_struct *t)
-{
-	unsigned long flags;
-	spin_lock_irqsave(&tracepoint_reg_lock, flags);
-	if (tracepoint_reg_count <= 1) {
-		ksu_clear_task_tracepoint_flag(t);
-	}
-	spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
-}
-
-// Process marking management
-static void handle_process_mark(bool mark)
-{
-	struct task_struct *p, *t;
-	read_lock(&tasklist_lock);
-	for_each_process_thread(p, t) {
-		if (mark)
-			ksu_set_task_tracepoint_flag(t);
-		else
-			ksu_clear_task_tracepoint_flag(t);
-	}
-	read_unlock(&tasklist_lock);
-}
-
-void ksu_mark_all_process(void)
-{
-	handle_process_mark(true);
-	pr_info("hook_manager: mark all user process done!\n");
-}
-
-void ksu_unmark_all_process(void)
-{
-	handle_process_mark(false);
-	pr_info("hook_manager: unmark all user process done!\n");
-}
-
-static void ksu_mark_running_process_locked()
-{
-	struct task_struct *p, *t;
-	read_lock(&tasklist_lock);
-	for_each_process_thread (p, t) {
-		if (!t->mm) { // only user processes
-			continue;
-		}
-		int uid = task_uid(t).val;
-        const struct cred *cred = get_task_cred(t);
-		bool ksu_root_process =
-			uid == 0 && is_task_ksu_domain(cred);
-        bool is_zygote_process = is_zygote(cred);
-        bool is_shell = uid == 2000;
-        // before boot completed, we shall mark init for marking zygote
-        bool is_init = t->pid == 1;
-		if (ksu_root_process || is_zygote_process  || is_shell || is_init
-            || ksu_is_allow_uid(uid)) {
-			ksu_set_task_tracepoint_flag(t);
-			pr_info("hook_manager: mark process: pid:%d, uid: %d, comm:%s\n",
-					t->pid, uid, t->comm);
-		} else {
-			ksu_clear_task_tracepoint_flag(t);
-			pr_info("hook_manager: unmark process: pid:%d, uid: %d, comm:%s\n",
-					t->pid, uid, t->comm);
-		}
-        put_cred(cred);
-	}
-	read_unlock(&tasklist_lock);
-}
-
-void ksu_mark_running_process()
-{
-	unsigned long flags;
-	spin_lock_irqsave(&tracepoint_reg_lock, flags);
-	if (tracepoint_reg_count <= 1) {
-		ksu_mark_running_process_locked();
-	} else {
-		pr_info("hook_manager: not mark running process since syscall tracepoint is in use\n");
-	}
-	spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
-}
-
-// Get task mark status
-// Returns: 1 if marked, 0 if not marked, -ESRCH if task not found
-int ksu_get_task_mark(pid_t pid)
-{
-	struct task_struct *task;
-	int marked = -ESRCH;
-
-	rcu_read_lock();
-	task = find_task_by_vpid(pid);
-	if (task) {
-		get_task_struct(task);
-		rcu_read_unlock();
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-		marked = test_task_syscall_work(task, SYSCALL_TRACEPOINT) ? 1 : 0;
-#else
-		marked = test_tsk_thread_flag(task, TIF_SYSCALL_TRACEPOINT) ? 1 : 0;
-#endif
-		put_task_struct(task);
-	} else {
-		rcu_read_unlock();
-	}
-
-	return marked;
-}
-
-// Set task mark status
-// Returns: 0 on success, -ESRCH if task not found
-int ksu_set_task_mark(pid_t pid, bool mark)
-{
-	struct task_struct *task;
-	int ret = -ESRCH;
-
-	rcu_read_lock();
-	task = find_task_by_vpid(pid);
-	if (task) {
-		get_task_struct(task);
-		rcu_read_unlock();
-		if (mark) {
-			ksu_set_task_tracepoint_flag(task);
-			pr_info("hook_manager: marked task pid=%d comm=%s\n", pid, task->comm);
-		} else {
-			ksu_clear_task_tracepoint_flag(task);
-			pr_info("hook_manager: unmarked task pid=%d comm=%s\n", pid, task->comm);
-		}
-		put_task_struct(task);
-		ret = 0;
-	} else {
-		rcu_read_unlock();
-	}
-
-	return ret;
-}
-
-#ifdef CONFIG_KRETPROBES
-
-static struct kretprobe *init_kretprobe(const char *name,
-										kretprobe_handler_t handler)
-{
-	struct kretprobe *rp = kzalloc(sizeof(struct kretprobe), GFP_KERNEL);
-	if (!rp)
-		return NULL;
-	rp->kp.symbol_name = name;
-	rp->handler = handler;
-	rp->data_size = 0;
-	rp->maxactive = 0;
-
-	int ret = register_kretprobe(rp);
-	pr_info("hook_manager: register_%s kretprobe: %d\n", name, ret);
-	if (ret) {
-		kfree(rp);
-		return NULL;
-	}
-
-	return rp;
-}
-
-static void destroy_kretprobe(struct kretprobe **rp_ptr)
-{
-	struct kretprobe *rp = *rp_ptr;
-	if (!rp)
-		return;
-	unregister_kretprobe(rp);
-	synchronize_rcu();
-	kfree(rp);
-	*rp_ptr = NULL;
-}
-
-static int syscall_regfunc_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
-{
-	unsigned long flags;
-	spin_lock_irqsave(&tracepoint_reg_lock, flags);
-	if (tracepoint_reg_count < 1) {
-		// while install our tracepoint, mark our processes
-		ksu_mark_running_process_locked();
-	} else if (tracepoint_reg_count == 1) {
-		// while other tracepoint first added, mark all processes
-		ksu_mark_all_process();
-	}
-	tracepoint_reg_count++;
-	spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
-	return 0;
-}
-
-static int syscall_unregfunc_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
-{
-	unsigned long flags;
-	spin_lock_irqsave(&tracepoint_reg_lock, flags);
-	tracepoint_reg_count--;
-	if (tracepoint_reg_count <= 0) {
-		// while no tracepoint left, unmark all processes
-		ksu_unmark_all_process();
-	} else if (tracepoint_reg_count == 1) {
-		// while just our tracepoint left, unmark disallowed processes
-		ksu_mark_running_process_locked();
-	}
-	spin_unlock_irqrestore(&tracepoint_reg_lock, flags);
-	return 0;
-}
-
-static struct kretprobe *syscall_regfunc_rp = NULL;
-static struct kretprobe *syscall_unregfunc_rp = NULL;
-#endif
-
-static inline bool check_syscall_fastpath(int nr)
-{
-    switch (nr) {
-    case __NR_newfstatat:
-    case __NR_faccessat:
-    case __NR_execve:
-    case __NR_setresuid:
-    case __NR_clone:
-    case __NR_clone3:
-        return true;
-    default:
-        return false;
-    }
-}
-
-// Unmark init's child that are not zygote, adbd or ksud
-int ksu_handle_init_mark_tracker(const char __user **filename_user)
-{
-    char path[64];
-
-    if (unlikely(!filename_user))
-        return 0;
-
-    memset(path, 0, sizeof(path));
-    strncpy_from_user_nofault(path, *filename_user, sizeof(path));
-
-    if (likely(strstr(path, "/app_process") == NULL && strstr(path, "/adbd") == NULL && strstr(path, "/ksud") == NULL)) {
-		pr_info("hook_manager: unmark %d exec %s", current->pid, path);
-        ksu_clear_task_tracepoint_flag_if_needed(current);
-    }
-
-    return 0;
-}
-#ifdef CONFIG_KSU_MANUAL_SU
-#include "manual_su.h"
-static inline void ksu_handle_task_alloc(struct pt_regs *regs)
-{
-    ksu_try_escalate_for_uid(current_uid().val);
-}
-#endif
-
-#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
-// Generic sys_enter handler that dispatches to specific handlers
-static void ksu_sys_enter_handler(void *data, struct pt_regs *regs, long id)
-{
-	if (unlikely(check_syscall_fastpath(id))) {
-#ifdef KSU_TP_HOOK
-		if (ksu_su_compat_enabled) {
-			// Handle newfstatat
-			if (id == __NR_newfstatat) {
-				int *dfd = (int *)&PT_REGS_PARM1(regs);
-				const char __user **filename_user =
-					(const char __user **)&PT_REGS_PARM2(regs);
-				int *flags = (int *)&PT_REGS_SYSCALL_PARM4(regs);
-				ksu_handle_stat(dfd, filename_user, flags);
-				return;
-			}
-
-			// Handle faccessat
-			if (id == __NR_faccessat) {
-				int *dfd = (int *)&PT_REGS_PARM1(regs);
-				const char __user **filename_user =
-					(const char __user **)&PT_REGS_PARM2(regs);
-				int *mode = (int *)&PT_REGS_PARM3(regs);
-				ksu_handle_faccessat(dfd, filename_user, mode, NULL);
-				return;
-			}
-
-			// Handle execve
-			if (id == __NR_execve) {
-				const char __user **filename_user =
-					(const char __user **)&PT_REGS_PARM1(regs);
-				if (current->pid != 1 && is_init(get_current_cred())) {
-					ksu_handle_init_mark_tracker(filename_user);
-				} else {
-                    ksu_handle_execve_sucompat(filename_user, NULL, NULL, NULL);
-                }
-				return;
-			}
-		}
-#endif
-
-        // Handle setresuid
-		if (id == __NR_setresuid) {
-			uid_t ruid = (uid_t)PT_REGS_PARM1(regs);
-			uid_t euid = (uid_t)PT_REGS_PARM2(regs);
-			uid_t suid = (uid_t)PT_REGS_PARM3(regs);
-			ksu_handle_setresuid(ruid, euid, suid);
-			return;
-		}
-
-#ifdef CONFIG_KSU_MANUAL_SU
-		// Handle task_alloc via clone/fork
-    	if (id == __NR_clone || id == __NR_clone3)
-        	return ksu_handle_task_alloc(regs);
-#endif
-	}
-}
-#endif
-
-void ksu_syscall_hook_manager_init(void)
-{
-	int ret;
-	pr_info("hook_manager: ksu_hook_manager_init called\n");
-
-#ifdef CONFIG_KRETPROBES
-	// Register kretprobe for syscall_regfunc
-	syscall_regfunc_rp = init_kretprobe("syscall_regfunc", syscall_regfunc_handler);
-	// Register kretprobe for syscall_unregfunc
-	syscall_unregfunc_rp = init_kretprobe("syscall_unregfunc", syscall_unregfunc_handler);
-#endif
-
-#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
-	ret = register_trace_sys_enter(ksu_sys_enter_handler, NULL);
-#ifndef CONFIG_KRETPROBES
-	ksu_mark_running_process_locked();
-#endif
-	if (ret) {
-		pr_err("hook_manager: failed to register sys_enter tracepoint: %d\n", ret);
-	} else {
-		pr_info("hook_manager: sys_enter tracepoint registered\n");
-	}
-#endif
-
-	ksu_setuid_hook_init();
-	ksu_sucompat_init();
-}
-
-void ksu_syscall_hook_manager_exit(void)
-{
-	pr_info("hook_manager: ksu_hook_manager_exit called\n");
-#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
-	unregister_trace_sys_enter(ksu_sys_enter_handler, NULL);
-	tracepoint_synchronize_unregister();
-	pr_info("hook_manager: sys_enter tracepoint unregistered\n");
-#endif
-
-#ifdef CONFIG_KRETPROBES
-	destroy_kretprobe(&syscall_regfunc_rp);
-	destroy_kretprobe(&syscall_unregfunc_rp);
-#endif
-
-	ksu_sucompat_exit();
-	ksu_setuid_hook_exit();
-}

kernel/syscall_hook_manager.h

@@ -1,47 +0,0 @@
-#ifndef __KSU_H_HOOK_MANAGER
-#define __KSU_H_HOOK_MANAGER
-
-#include <linux/version.h>
-#include <linux/sched.h>
-#include <linux/thread_info.h>
-#include <linux/init.h>
-#include <linux/binfmts.h>
-#include <linux/tty.h>
-#include <linux/fs.h>
-#include "selinux/selinux.h"
-
-// Hook manager initialization and cleanup
-void ksu_syscall_hook_manager_init(void);
-void ksu_syscall_hook_manager_exit(void);
-
-// Process marking for tracepoint
-void ksu_mark_all_process(void);
-void ksu_unmark_all_process(void);
-void ksu_mark_running_process(void);
-
-// Per-task mark operations
-int ksu_get_task_mark(pid_t pid);
-int ksu_set_task_mark(pid_t pid, bool mark);
-
-
-static inline void ksu_set_task_tracepoint_flag(struct task_struct *t)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-    set_task_syscall_work(t, SYSCALL_TRACEPOINT);
-#else
-    set_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-#endif
-}
-
-static inline void ksu_clear_task_tracepoint_flag(struct task_struct *t)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-    clear_task_syscall_work(t, SYSCALL_TRACEPOINT);
-#else
-    clear_tsk_thread_flag(t, TIF_SYSCALL_TRACEPOINT);
-#endif
-}
-
-void ksu_clear_task_tracepoint_flag_if_needed(struct task_struct *t);
-
-#endif