KernelSU#

1
#ifndef __KSU_H_ALLOWLIST
2
#define __KSU_H_ALLOWLIST
3

4
#include <linux/types.h>
5
#include <linux/uidgid.h>
6
#include "app_profile.h"
7

8
#define PER_USER_RANGE 100000
9
#define FIRST_APPLICATION_UID 10000
10
#define LAST_APPLICATION_UID 19999
11
#define FIRST_ISOLATED_UID 99000
12
#define LAST_ISOLATED_UID 99999
13

14
void ksu_allowlist_init(void);//初始化allowlist链表
15

16
void ksu_allowlist_exit(void);//清理allowlist链表
17

18
void ksu_load_allow_list(void);//加载allowlist文件到链表，路径：/data/adb/ksu/.allowlist
19

20
void ksu_show_allow_list(void);//打印allowlist链表内容到日志
21

22
// Check if the uid is in allow list
23
bool __ksu_is_allow_uid(uid_t uid);
24
#define ksu_is_allow_uid(uid) unlikely(__ksu_is_allow_uid(uid))
25

26
// Check if the uid is in allow list, or current is ksu domain root
27
bool __ksu_is_allow_uid_for_current(uid_t uid);
28
#define ksu_is_allow_uid_for_current(uid) unlikely(__ksu_is_allow_uid_for_current(uid))
29

30
bool ksu_get_allow_list(int *array, int *length, bool allow);
31

32
void ksu_prune_allowlist(bool (*is_uid_exist)(uid_t, char *, void *), void *data);//清理无用的allowlist条目
33

34
bool ksu_get_app_profile(struct app_profile *);//获取指定uid的app profile
35
bool ksu_set_app_profile(struct app_profile *, bool persist);//设置指定uid的app profile
36

37
bool ksu_uid_should_umount(uid_t uid);//是否执行umount操作
38
struct root_profile *ksu_get_root_profile(uid_t uid);//获取授予root权限的app的app profile
39

40
static inline bool is_appuid(uid_t uid)
41
{
42
    uid_t appid = uid % PER_USER_RANGE;
43
    return appid >= FIRST_APPLICATION_UID && appid <= LAST_APPLICATION_UID;
44
}
45

46
static inline bool is_isolated_process(uid_t uid)
47
{
48
    uid_t appid = uid % PER_USER_RANGE;
49
    return appid >= FIRST_ISOLATED_UID && appid <= LAST_ISOLATED_UID;
50
}
51
#endif

1
struct perm_data {
2
    struct list_head list;
3
    struct app_profile profile;
4
};
5
static struct list_head allow_list;
6

7
static uint8_t allow_list_bitmap[PAGE_SIZE] __read_mostly __aligned(PAGE_SIZE);
8

9
static int allow_list_arr[PAGE_SIZE / sizeof(int)] __read_mostly;

1
#ifndef __KSU_H_APK_V2_SIGN
2
#define __KSU_H_APK_V2_SIGN
3

4
#include <linux/types.h>
5

6
bool is_manager_apk(char *path);
7

8
#endif

1
bool is_manager_apk(char *path)
2
{
3
    return check_v2_signature(path, EXPECTED_SIZE, EXPECTED_HASH);
4
}

1
static __always_inline bool check_v2_signature(char *path,
2
                           unsigned expected_size,
3
                           const char *expected_sha256)
4
{
5
    unsigned char buffer[0x11] = { 0 };
6
    u32 size4;
7
    u64 size8, size_of_block;
8

9
    loff_t pos;
10

11
    bool v2_signing_valid = false;
12
    int v2_signing_blocks = 0;
13
    bool v3_signing_exist = false;
14
    bool v3_1_signing_exist = false;
15
  /*
16
    ............
17
  */
18

19
    if (v2_signing_valid) {
20
        int has_v1_signing = has_v1_signature_file(fp);
21
        if (has_v1_signing) {
22
            pr_err("Unexpected v1 signature scheme found!\n");
23
            filp_close(fp, 0);
24
            return false;
25
        }
26
    }
27
clean:
28
    filp_close(fp, 0);
29

30
    if (v3_signing_exist || v3_1_signing_exist) {
31
#ifdef CONFIG_KSU_DEBUG
32
        pr_err("Unexpected v3 signature scheme found!\n");
33
#endif
34
        return false;
35
    }
36

37
    return v2_signing_valid;
38
}

1
#ifndef __KSU_H_APP_PROFILE
2
#define __KSU_H_APP_PROFILE
3

4
#include <linux/types.h>
5

6
// Forward declarations
7
struct cred;
8

9
#define KSU_APP_PROFILE_VER 2
10
#define KSU_MAX_PACKAGE_NAME 256
11
// NGROUPS_MAX for Linux is 65535 generally, but we only supports 32 groups.
12
#define KSU_MAX_GROUPS 32
13
#define KSU_SELINUX_DOMAIN 64
14

15
struct root_profile {
16
  int32_t uid;
17
  int32_t gid;
18

19
  int32_t groups_count;
20
  int32_t groups[KSU_MAX_GROUPS];
21

22
  // kernel_cap_t is u32[2] for capabilities v3
23
  struct {
24
    u64 effective;
25
    u64 permitted;
26
    u64 inheritable;
27
  } capabilities;
28

29
  char selinux_domain[KSU_SELINUX_DOMAIN];
30

31
  int32_t namespaces;
32
};
33

34
struct non_root_profile {
35
  bool umount_modules;
36
};
37

38
struct app_profile {
39
  // It may be utilized for backward compatibility, although we have never explicitly made any promises regarding this.
40
  u32 version;
41

42
  // this is usually the package of the app, but can be other value for special apps
43
  char key[KSU_MAX_PACKAGE_NAME];
44
  int32_t current_uid;
45
  bool allow_su;
46

47
  union {
48
    struct {
49
      bool use_default;
50
      char template_name[KSU_MAX_PACKAGE_NAME];
51

52
      struct root_profile profile;
53
    } rp_config;
54

55
    struct {
56
      bool use_default;
57

58
      struct non_root_profile profile;
59
    } nrp_config;
60
  };
61
};
62

63
// Escalate current process to root with the appropriate profile
64
void escape_with_root_profile(void);
65

66
#endif

1
void escape_with_root_profile(void)
2
{
3
  struct cred *cred;
4
  struct task_struct *p = current;
5
  struct task_struct *t;
6

7
  cred = prepare_creds();
8
  if (!cred) {
9
    pr_warn("prepare_creds failed!\n");
10
    return;
11
  }
12

13
  if (cred->euid.val == 0) {
14
    pr_warn("Already root, don't escape!\n");
15
    abort_creds(cred);
16
    return;
17
  }
18

19
  struct root_profile *profile = ksu_get_root_profile(cred->uid.val);
20

21
  cred->uid.val = profile->uid;
22
  cred->suid.val = profile->uid;
23
  cred->euid.val = profile->uid;
24
  cred->fsuid.val = profile->uid;
25

26
  cred->gid.val = profile->gid;
27
  cred->fsgid.val = profile->gid;
28
  cred->sgid.val = profile->gid;
29
  cred->egid.val = profile->gid;
30
  cred->securebits = 0;
31

32
  BUILD_BUG_ON(sizeof(profile->capabilities.effective) !=
33
         sizeof(kernel_cap_t));
34

35
  // setup capabilities
36
  // we need CAP_DAC_READ_SEARCH becuase `/data/adb/ksud` is not accessible for non root process
37
  // we add it here but don't add it to cap_inhertiable, it would be dropped automaticly after exec!
38
  u64 cap_for_ksud = profile->capabilities.effective | CAP_DAC_READ_SEARCH;
39
  memcpy(&cred->cap_effective, &cap_for_ksud, sizeof(cred->cap_effective));
40
  memcpy(&cred->cap_permitted, &profile->capabilities.effective,
41
         sizeof(cred->cap_permitted));
42
  memcpy(&cred->cap_bset, &profile->capabilities.effective,
43
         sizeof(cred->cap_bset));
44

45
  setup_groups(profile, cred);
46

47
  commit_creds(cred);
48

49
  // Refer to kernel/seccomp.c: seccomp_set_mode_strict
50
  // When disabling Seccomp, ensure that current->sighand->siglock is held during the operation.
51
  spin_lock_irq(&current->sighand->siglock);
52
  disable_seccomp();
53
  spin_unlock_irq(&current->sighand->siglock);
54

55
  setup_selinux(profile->selinux_domain);
56

57
  for_each_thread (p, t) {
58
    ksu_set_task_tracepoint_flag(t);
59
  }
60
}

1
#ifndef __KSU_H_FEATURE
2
#define __KSU_H_FEATURE
3

4
#include <linux/types.h>
5

6
enum ksu_feature_id {
7
    KSU_FEATURE_SU_COMPAT = 0,
8
    KSU_FEATURE_KERNEL_UMOUNT = 1,
9
    KSU_FEATURE_ENHANCED_SECURITY = 2,
10

11
    KSU_FEATURE_MAX
12
};
13

14
typedef int (*ksu_feature_get_t)(u64 *value);
15
typedef int (*ksu_feature_set_t)(u64 value);
16

17
struct ksu_feature_handler {
18
    u32 feature_id;
19
    const char *name;
20
    ksu_feature_get_t get_handler;
21
    ksu_feature_set_t set_handler;
22
};
23
//注册功能
24
int ksu_register_feature_handler(const struct ksu_feature_handler *handler);
25
//注销功能
26
int ksu_unregister_feature_handler(u32 feature_id);
27
//获取功能状态
28
int ksu_get_feature(u32 feature_id, u64 *value, bool *supported);
29
//设置功能状态
30
int ksu_set_feature(u32 feature_id, u64 value);
31

32
void ksu_feature_init(void);
33

34
void ksu_feature_exit(void);
35

36
#endif // __KSU_H_FEATURE

1
int ksu_handle_umount(uid_t old_uid, uid_t new_uid)
2
{
3
    struct umount_tw *tw;
4

5
    // if there isn't any module mounted, just ignore it!
6
    if (!ksu_module_mounted) {
7
        return 0;
8
    }
9

10
    if (!ksu_kernel_umount_enabled) {
11
        return 0;
12
    }
13

14
    // There are 5 scenarios:
15
    // 1. Normal app: zygote -> appuid
16
    // 2. Isolated process forked from zygote: zygote -> isolated_process
17
    // 3. App zygote forked from zygote: zygote -> appuid
18
    // 4. Isolated process froked from app zygote: appuid -> isolated_process (already handled by 3)
19
    // 5. Isolated process froked from webview zygote (no need to handle, app cannot run custom code)
20
    if (!is_appuid(new_uid) && !is_isolated_process(new_uid)) {
21
        return 0;
22
    }
23

24
    if (!ksu_uid_should_umount(new_uid) && !is_isolated_process(new_uid)) {
25
        return 0;
26
    }
27

28
    // check old process's selinux context, if it is not zygote, ignore it!
29
    // because some su apps may setuid to untrusted_app but they are in global mount namespace
30
    // when we umount for such process, that is a disaster!
31
    // also handle case 4 and 5
32
    bool is_zygote_child = is_zygote(get_current_cred());
33
    if (!is_zygote_child) {
34
        pr_info("handle umount ignore non zygote child: %d\n", current->pid);
35
        return 0;
36
    }
37
    // umount the target mnt
38
    pr_info("handle umount for uid: %d, pid: %d\n", new_uid, current->pid);
39

40
    tw = kzalloc(sizeof(*tw), GFP_ATOMIC);
41
    if (!tw)
42
        return 0;
43

44
    tw->old_cred = get_current_cred();
45
    tw->cb.func = umount_tw_func;
46

47
    int err = task_work_add(current, &tw->cb, TWA_RESUME);
48
    if (err) {
49
        if (tw->old_cred) {
50
            put_cred(tw->old_cred);
51
        }
52
        kfree(tw);
53
        pr_warn("unmount add task_work failed\n");
54
    }
55

56
    return 0;
57
}

1
static void umount_tw_func(struct callback_head *cb)
2
{
3
    struct umount_tw *tw = container_of(cb, struct umount_tw, cb);
4
    const struct cred *saved = NULL;
5
    if (tw->old_cred) {
6
        saved = override_creds(tw->old_cred);
7
    }
8

9
    struct mount_entry *entry;
10
    down_read(&mount_list_lock);
11
    list_for_each_entry(entry, &mount_list, list) {
12
        pr_info("%s: unmounting: %s flags 0x%x\n", __func__, entry->umountable, entry->flags);
13
        try_umount(entry->umountable, entry->flags);
14
    }
15
    up_read(&mount_list_lock);
16

17
    if (saved)
18
        revert_creds(saved);
19

20
    if (tw->old_cred)
21
        put_cred(tw->old_cred);
22

23
    kfree(tw);
24
}

1
#include <linux/export.h>
2
#include <linux/fs.h>
3
#include <linux/kobject.h>
4
#include <linux/module.h>
5
#include <linux/workqueue.h>
6

7
#include "allowlist.h"
8
#include "feature.h"
9
#include "klog.h" // IWYU pragma: keep
10
#include "throne_tracker.h"
11
#include "syscall_hook_manager.h"
12
#include "ksud.h"
13
#include "supercalls.h"
14

15
int __init kernelsu_init(void)
16
{
17
#ifdef CONFIG_KSU_DEBUG
18
    pr_alert("*************************************************************");
19
    pr_alert("**     NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE    **");
20
    pr_alert("**                                                         **");
21
    pr_alert("**         You are running KernelSU in DEBUG mode          **");
22
    pr_alert("**                                                         **");
23
    pr_alert("**     NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE NOTICE    **");
24
    pr_alert("*************************************************************");
25
#endif
26

27
    ksu_feature_init();
28

29
    ksu_supercalls_init();
30

31
    ksu_syscall_hook_manager_init();
32

33
    ksu_allowlist_init();
34

35
    ksu_throne_tracker_init();
36

37
    ksu_ksud_init();
38

39
#ifdef MODULE
40
#ifndef CONFIG_KSU_DEBUG
41
    kobject_del(&THIS_MODULE->mkobj.kobj);
42
#endif
43
#endif
44
    return 0;
45
}
46

47
extern void ksu_observer_exit(void);
48
void kernelsu_exit(void)
49
{
50
    ksu_allowlist_exit();
51

52
    ksu_throne_tracker_exit();
53

54
    ksu_observer_exit();
55

56
    ksu_ksud_exit();
57

58
    ksu_syscall_hook_manager_exit();
59

60
    ksu_supercalls_exit();
61

62
    ksu_feature_exit();
63
}
64

65
module_init(kernelsu_init);
66
module_exit(kernelsu_exit);
67

68
MODULE_LICENSE("GPL");
69
MODULE_AUTHOR("weishu");
70
MODULE_DESCRIPTION("Android KernelSU");
71
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0)
72
MODULE_IMPORT_NS("VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver");
73
#else
74
MODULE_IMPORT_NS(VFS_internal_I_am_really_a_filesystem_and_am_NOT_a_driver);
75
#endif

1
#ifdef MODULE
2
#ifndef CONFIG_KSU_DEBUG
3
    kobject_del(&THIS_MODULE->mkobj.kobj);
4
#endif
5
#endif

1
#ifndef __KSU_H_KSUD
2
#define __KSU_H_KSUD
3

4
#include <linux/types.h>
5

6
#define KSUD_PATH "/data/adb/ksud"
7

8
void ksu_ksud_init();
9
void ksu_ksud_exit();
10

11
void on_post_fs_data(void);
12
void on_module_mounted(void);
13
void on_boot_completed(void);
14

15
bool ksu_is_safe_mode(void);
16

17
int nuke_ext4_sysfs(const char* mnt);
18

19
extern u32 ksu_file_sid;
20
extern bool ksu_module_mounted;
21
extern bool ksu_boot_completed;
22

23
#endif

1
#define MASK_SYSTEM (FS_CREATE | FS_MOVE | FS_EVENT_ON_CHILD)
2

3
static struct watch_dir g_watch = { .path = "/data/system",
4
                    .mask = MASK_SYSTEM };
5

6
static int ksu_handle_inode_event(struct fsnotify_mark *mark, u32 mask,
7
                  struct inode *inode, struct inode *dir,
8
                  const struct qstr *file_name, u32 cookie)
9
{
10
    if (!file_name)
11
        return 0;
12
    if (mask & FS_ISDIR)
13
        return 0;
14
    if (file_name->len == 13 &&
15
        !memcmp(file_name->name, "packages.list", 13)) {
16
        pr_info("packages.list detected: %d\n", mask);
17
        track_throne(false);
18
    }
19
    return 0;
20
}
21

22
static const struct fsnotify_ops ksu_ops = {
23
    .handle_inode_event = ksu_handle_inode_event,
24
};
25

26

27
int ksu_observer_init(void)
28
{
29
    int ret = 0;
30

31
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)
32
    g = fsnotify_alloc_group(&ksu_ops, 0);
33
#else
34
    g = fsnotify_alloc_group(&ksu_ops);
35
#endif
36
    if (IS_ERR(g))
37
        return PTR_ERR(g);
38

39
    ret = watch_one_dir(&g_watch);
40
    pr_info("observer init done\n");
41
    return 0;
42
}

1
#ifndef __KSU_H_KERNEL_COMPAT
2
#define __KSU_H_KERNEL_COMPAT
3

4
#include <linux/fs.h>
5
#include <linux/version.h>
6

7
extern void ksu_seccomp_clear_cache(struct seccomp_filter *filter, int nr);
8
extern void ksu_seccomp_allow_cache(struct seccomp_filter *filter, int nr);
9

10
#endif

1
static bool ksu_enhanced_security_enabled = false;
2

3
static int enhanced_security_feature_get(u64 *value)
4
{
5
    *value = ksu_enhanced_security_enabled ? 1 : 0;
6
    return 0;
7
}
8

9
static int enhanced_security_feature_set(u64 value)
10
{
11
    bool enable = value != 0;
12
    ksu_enhanced_security_enabled = enable;
13
    pr_info("enhanced_security: set to %d\n", enable);
14
    return 0;
15
}
16

17
static const struct ksu_feature_handler enhanced_security_handler = {
18
    .feature_id = KSU_FEATURE_ENHANCED_SECURITY,
19
    .name = "enhanced_security",
20
    .get_handler = enhanced_security_feature_get,
21
    .set_handler = enhanced_security_feature_set,
22
};