e382a83895
Kernel has few information about which isolated process belongs to which application, so there is actually no good choice if we don't implement a userspace daemon. One choice is to access cmdline memory from kernel, but cmdline is __user, and it is likely to trigger detections. Before we have more good ideas, use this.
58 lines
1.5 KiB
C
58 lines
1.5 KiB
C
#ifndef __KSU_H_ALLOWLIST
|
|
#define __KSU_H_ALLOWLIST
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/uidgid.h>
|
|
#include "app_profile.h"
|
|
|
|
#define PER_USER_RANGE 100000
|
|
#define FIRST_APPLICATION_UID 10000
|
|
#define LAST_APPLICATION_UID 19999
|
|
#define FIRST_ISOLATED_UID 99000
|
|
#define LAST_ISOLATED_UID 99999
|
|
|
|
void ksu_allowlist_init(void);
|
|
|
|
void ksu_allowlist_exit(void);
|
|
|
|
void ksu_load_allow_list(void);
|
|
|
|
void ksu_show_allow_list(void);
|
|
|
|
// Check if the uid is in allow list
|
|
bool __ksu_is_allow_uid(uid_t uid);
|
|
#define ksu_is_allow_uid(uid) unlikely(__ksu_is_allow_uid(uid))
|
|
|
|
// Check if the uid is in allow list, or current is ksu domain root
|
|
bool __ksu_is_allow_uid_for_current(uid_t uid);
|
|
#define ksu_is_allow_uid_for_current(uid) unlikely(__ksu_is_allow_uid_for_current(uid))
|
|
|
|
bool ksu_get_allow_list(int *array, int *length, bool allow);
|
|
|
|
void ksu_prune_allowlist(bool (*is_uid_exist)(uid_t, char *, void *), void *data);
|
|
|
|
bool ksu_get_app_profile(struct app_profile *);
|
|
bool ksu_set_app_profile(struct app_profile *, bool persist);
|
|
|
|
bool ksu_uid_should_umount(uid_t uid);
|
|
struct root_profile *ksu_get_root_profile(uid_t uid);
|
|
|
|
static inline bool is_appuid(uid_t uid)
|
|
{
|
|
uid_t appid = uid % PER_USER_RANGE;
|
|
return appid >= FIRST_APPLICATION_UID && appid <= LAST_APPLICATION_UID;
|
|
}
|
|
|
|
static inline bool is_isolated_process(uid_t uid)
|
|
{
|
|
uid_t appid = uid % PER_USER_RANGE;
|
|
return appid >= FIRST_ISOLATED_UID && appid <= LAST_ISOLATED_UID;
|
|
}
|
|
|
|
#ifdef CONFIG_KSU_MANUAL_SU
|
|
bool ksu_temp_grant_root_once(uid_t uid);
|
|
void ksu_temp_revoke_root_once(uid_t uid);
|
|
#endif
|
|
|
|
#endif
|