SukiSU-Ultra/kernel/sulog.c

#include <linux/fs.h>
#include <linux/kernel.h>
#include <linux/printk.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/time.h>
#include <linux/types.h>
#include <linux/uaccess.h>
#include <linux/workqueue.h>
#include <linux/cred.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/mutex.h>
#include <linux/spinlock.h>
#include <linux/crc32.h>

#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0)
#include <linux/rtc.h>

static inline void time64_to_tm(time64_t totalsecs, int offset, struct tm *result)
{
    struct rtc_time rtc_tm;
    rtc_time64_to_tm(totalsecs, &rtc_tm);

    result->tm_sec  = rtc_tm.tm_sec;
    result->tm_min  = rtc_tm.tm_min;
    result->tm_hour = rtc_tm.tm_hour;
    result->tm_mday = rtc_tm.tm_mday;
    result->tm_mon  = rtc_tm.tm_mon;
    result->tm_year = rtc_tm.tm_year;
}
#endif

#include "klog.h"
#include "kernel_compat.h"
#include "sulog.h"
#include "ksu.h"

#if __SULOG_GATE
struct dedup_entry dedup_tbl[SULOG_COMM_LEN];
DEFINE_SPINLOCK(dedup_lock);
static LIST_HEAD(sulog_queue);
static DEFINE_MUTEX(sulog_mutex);
static struct workqueue_struct *sulog_workqueue;
static struct work_struct sulog_work;
static bool sulog_enabled = true;

static void get_timestamp(char *buf, size_t len)
{
	struct timespec64 ts;
	struct tm tm;

	ktime_get_real_ts64(&ts);

	time64_to_tm(ts.tv_sec - sys_tz.tz_minuteswest * 60, 0, &tm);

	snprintf(buf, len,
		 "%04ld-%02d-%02d %02d:%02d:%02d",
		 tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
		 tm.tm_hour, tm.tm_min, tm.tm_sec);
}

static void ksu_get_cmdline(char *full_comm, const char *comm, size_t buf_len)
{
	char *kbuf;

	if (!full_comm || buf_len <= 0)
		return;

	if (comm && strlen(comm) > 0) {
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
		strscpy(full_comm, comm, buf_len);
#else
		strlcpy(full_comm, comm, buf_len);
#endif
	} else {
		kbuf = kmalloc(buf_len, GFP_ATOMIC);
		if (!kbuf) {
			pr_err("sulog: failed to allocate memory for kbuf\n");
			return;
		}

		int n = get_cmdline(current, kbuf, buf_len);

		if (n <= 0) {
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
			strscpy(full_comm, current->comm, buf_len);
#else
			strlcpy(full_comm, current->comm, buf_len);
#endif
		} else {
			for (int i = 0; i < n; i++) {
				if (kbuf[i] == '\0') kbuf[i] = ' ';
			}
			kbuf[n < buf_len ? n : buf_len - 1] = '\0';
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
			strscpy(full_comm, kbuf, buf_len);
#else
			strlcpy(full_comm, kbuf, buf_len);
#endif
		}

		kfree(kbuf);
	}
}

static bool dedup_should_print(uid_t uid, u8 type,
							   const char *content, size_t len)
{
	struct dedup_key key = {
		.crc  = dedup_calc_hash(content, len),
		.uid  = uid,
		.type = type,
	};
	u64 now = ktime_get_ns();
	u64 delta_ns = DEDUP_SECS * NSEC_PER_SEC;

	u32 idx = key.crc & (SULOG_COMM_LEN - 1);
	spin_lock(&dedup_lock);

	struct dedup_entry *e = &dedup_tbl[idx];
	if (e->key.crc == key.crc &&
		e->key.uid == key.uid &&
		e->key.type == key.type &&
		(now - e->ts_ns) < delta_ns) {
		spin_unlock(&dedup_lock);
		return false;
	}

	e->key = key;
	e->ts_ns = now;
	spin_unlock(&dedup_lock);
	return true;
}

static void sulog_work_handler(struct work_struct *work)
{
	struct file *fp;
	struct sulog_entry *entry, *tmp;
	LIST_HEAD(local_queue);
	loff_t pos = 0;
	
	mutex_lock(&sulog_mutex);
	list_splice_init(&sulog_queue, &local_queue);
	mutex_unlock(&sulog_mutex);
	
	if (list_empty(&local_queue))
		return;
	
	fp = ksu_filp_open_compat(SULOG_PATH, O_WRONLY | O_CREAT | O_APPEND, 0640);
	if (IS_ERR(fp)) {
		pr_err("sulog: failed to open log file: %ld\n", PTR_ERR(fp));
		goto cleanup;
	}
	
	if (fp->f_inode->i_size > SULOG_MAX_SIZE) {
		pr_info("sulog: log file exceeds maximum size, clearing...\n");
		if (vfs_truncate(&fp->f_path, 0)) {
			pr_err("sulog: failed to truncate log file\n");
		}
		pos = 0;
	} else {
		pos = fp->f_inode->i_size;
	}
	
	list_for_each_entry(entry, &local_queue, list) {
		ksu_kernel_write_compat(fp, entry->content, strlen(entry->content), &pos);
	}
	
	vfs_fsync(fp, 0);
	filp_close(fp, 0);
	
cleanup:
	list_for_each_entry_safe(entry, tmp, &local_queue, list) {
		list_del(&entry->list);
		kfree(entry);
	}
}

static void sulog_add_entry(const char *content)
{
	struct sulog_entry *entry;
	
	if (!sulog_enabled || !content)
		return;
	
	entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
	if (!entry) {
		pr_err("sulog: failed to allocate memory for log entry\n");
		return;
	}
	
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
		strscpy(entry->content, content, SULOG_ENTRY_MAX_LEN - 1);
#else
		strlcpy(entry->content, content, SULOG_ENTRY_MAX_LEN - 1);
#endif
	
	mutex_lock(&sulog_mutex);
	list_add_tail(&entry->list, &sulog_queue);
	mutex_unlock(&sulog_mutex);
	
	if (sulog_workqueue)
		queue_work(sulog_workqueue, &sulog_work);
}

void ksu_sulog_report_su_grant(uid_t uid, const char *comm, const char *method)
{
	char *timestamp, *full_comm, *log_buf;
	
	if (!sulog_enabled)
		return;
	
	timestamp = kmalloc(32, GFP_ATOMIC);
	full_comm = kmalloc(SULOG_COMM_LEN, GFP_ATOMIC);
	log_buf = kmalloc(SULOG_ENTRY_MAX_LEN, GFP_ATOMIC);
	
	if (!timestamp || !full_comm || !log_buf) {
		pr_err("sulog: failed to allocate memory for su_grant log\n");
		goto cleanup;
	}
	
	get_timestamp(timestamp, 32);
	
	ksu_get_cmdline(full_comm, comm, SULOG_COMM_LEN);
	
	snprintf(log_buf, SULOG_ENTRY_MAX_LEN,
		"[%s] SU_GRANT: UID=%d COMM=%s METHOD=%s PID=%d\n",
		timestamp, uid, full_comm, 
		method ? method : "unknown", current->pid);

	if (!dedup_should_print(uid, DEDUP_SU_GRANT, log_buf, strlen(log_buf)))
		goto cleanup;
	
	sulog_add_entry(log_buf);
	
cleanup:
	if (timestamp) kfree(timestamp);
	if (full_comm) kfree(full_comm);
	if (log_buf) kfree(log_buf);
}

void ksu_sulog_report_su_attempt(uid_t uid, const char *comm, const char *target_path, bool success)
{
	char *timestamp, *full_comm, *log_buf;
	
	if (!sulog_enabled)
		return;
	
	timestamp = kmalloc(32, GFP_ATOMIC);
	full_comm = kmalloc(SULOG_COMM_LEN, GFP_ATOMIC);
	log_buf = kmalloc(SULOG_ENTRY_MAX_LEN, GFP_ATOMIC);
	
	if (!timestamp || !full_comm || !log_buf) {
		pr_err("sulog: failed to allocate memory for su_attempt log\n");
		goto cleanup;
	}
	
	get_timestamp(timestamp, 32);
	
	ksu_get_cmdline(full_comm, comm, SULOG_COMM_LEN);
	
	snprintf(log_buf, SULOG_ENTRY_MAX_LEN,
		"[%s] SU_EXEC: UID=%d COMM=%s TARGET=%s RESULT=%s PID=%d\n",
		timestamp, uid, full_comm,
		target_path ? target_path : "unknown",
		success ? "SUCCESS" : "DENIED", current->pid);

	if (!dedup_should_print(uid, DEDUP_SU_ATTEMPT, log_buf, strlen(log_buf)))
		goto cleanup;
	
	sulog_add_entry(log_buf);
	
cleanup:
	if (timestamp) kfree(timestamp);
	if (full_comm) kfree(full_comm);
	if (log_buf) kfree(log_buf);
}

void ksu_sulog_report_permission_check(uid_t uid, const char *comm, bool allowed)
{
	char *timestamp, *full_comm, *log_buf;
	
	if (!sulog_enabled)
		return;
	
	timestamp = kmalloc(32, GFP_ATOMIC);
	full_comm = kmalloc(SULOG_COMM_LEN, GFP_ATOMIC);
	log_buf = kmalloc(SULOG_ENTRY_MAX_LEN, GFP_ATOMIC);
	
	if (!timestamp || !full_comm || !log_buf) {
		pr_err("sulog: failed to allocate memory for permission_check log\n");
		goto cleanup;
	}
	
	get_timestamp(timestamp, 32);
	
	ksu_get_cmdline(full_comm, comm, SULOG_COMM_LEN);
	
	snprintf(log_buf, SULOG_ENTRY_MAX_LEN,
		"[%s] PERM_CHECK: UID=%d COMM=%s RESULT=%s PID=%d\n",
		timestamp, uid, full_comm,
		allowed ? "ALLOWED" : "DENIED", current->pid);

	if (!dedup_should_print(uid, DEDUP_PERM_CHECK, log_buf, strlen(log_buf)))
		goto cleanup;
	
	sulog_add_entry(log_buf);
	
cleanup:
	if (timestamp) kfree(timestamp);
	if (full_comm) kfree(full_comm);
	if (log_buf) kfree(log_buf);
}

void ksu_sulog_report_manager_operation(const char *operation, uid_t manager_uid, uid_t target_uid)
{
	char *timestamp, *full_comm, *log_buf;
	
	if (!sulog_enabled)
		return;
	
	timestamp = kmalloc(32, GFP_ATOMIC);
	full_comm = kmalloc(SULOG_COMM_LEN, GFP_ATOMIC);
	log_buf = kmalloc(SULOG_ENTRY_MAX_LEN, GFP_ATOMIC);
	
	if (!timestamp || !full_comm || !log_buf) {
		pr_err("sulog: failed to allocate memory for manager_operation log\n");
		goto cleanup;
	}
	
	get_timestamp(timestamp, 32);

	ksu_get_cmdline(full_comm, NULL, SULOG_COMM_LEN);
	
	snprintf(log_buf, SULOG_ENTRY_MAX_LEN,
		"[%s] MANAGER_OP: OP=%s MANAGER_UID=%d TARGET_UID=%d COMM=%s PID=%d\n",
		timestamp, operation ? operation : "unknown",
		manager_uid, target_uid, full_comm, current->pid);

	if (!dedup_should_print(manager_uid, DEDUP_MANAGER_OP, log_buf, strlen(log_buf)))
		goto cleanup;
	
	sulog_add_entry(log_buf);
	
cleanup:
	if (timestamp) kfree(timestamp);
	if (full_comm) kfree(full_comm);
	if (log_buf) kfree(log_buf);
}

void ksu_sulog_report_syscall(uid_t uid, const char *comm,
				  const char *syscall, const char *args)
{
	char *timestamp, *full_comm, *log_buf;

	if (!sulog_enabled)
		return;

	timestamp = kmalloc(32, GFP_ATOMIC);
	full_comm = kmalloc(SULOG_COMM_LEN, GFP_ATOMIC);
	log_buf   = kmalloc(SULOG_ENTRY_MAX_LEN, GFP_ATOMIC);

	if (!timestamp || !full_comm || !log_buf) {
		pr_err("sulog: failed to allocate memory for syscall log\n");
		goto cleanup;
	}

	get_timestamp(timestamp, 32);
	
	ksu_get_cmdline(full_comm, comm, SULOG_COMM_LEN);

	snprintf(log_buf, SULOG_ENTRY_MAX_LEN,
		 "[%s] SYSCALL: UID=%d COMM=%s SYSCALL=%s ARGS=%s PID=%d\n",
		 timestamp, uid, full_comm,
		 syscall  ? syscall  : "unknown",
		 args	 ? args	 : "none",
		 current->pid);

	if (!dedup_should_print(uid, DEDUP_SYSCALL, log_buf, strlen(log_buf)))
		goto cleanup;

	sulog_add_entry(log_buf);

cleanup:
	if (timestamp) kfree(timestamp);
	if (full_comm) kfree(full_comm);
	if (log_buf) kfree(log_buf);
}

int ksu_sulog_init(void)
{
	sulog_workqueue = alloc_workqueue("ksu_sulog", WQ_UNBOUND | WQ_HIGHPRI, 1);
	if (!sulog_workqueue) {
		pr_err("sulog: failed to create workqueue\n");
		return -ENOMEM;
	}
	
	INIT_WORK(&sulog_work, sulog_work_handler);
	
	pr_info("sulog: initialized successfully\n");
	return 0;
}

void ksu_sulog_exit(void)
{
	struct sulog_entry *entry, *tmp;
	
	sulog_enabled = false;
	
	if (sulog_workqueue) {
		flush_workqueue(sulog_workqueue);
		destroy_workqueue(sulog_workqueue);
		sulog_workqueue = NULL;
	}
	
	mutex_lock(&sulog_mutex);
	list_for_each_entry_safe(entry, tmp, &sulog_queue, list) {
		list_del(&entry->list);
		kfree(entry);
	}
	mutex_unlock(&sulog_mutex);
	
	pr_info("sulog: cleaned up successfully\n");
}
#endif // __SULOG_GATE