Skip to content

Commit

Permalink
Merge branch 'master' of https://github.com/itsshashanksp/KernelSU in…
Browse files Browse the repository at this point in the history 
…to sleepy

Signed-off-by: Shashank Patil <[email protected]>
  • Loading branch information
@itsshashanksp
itsshashanksp committed Jun 1, 2024
1 parent 61a5dc7 commit 45b34cd
Show file tree
Hide file tree
Showing 4 changed files with 128 additions and 57 deletions.
8 changes: 8 additions & 0 deletions drivers/kernelsu/core_hook.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,14 @@ int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3,
return 0;
}

// TODO: find it in throne tracker!
uid_t current_uid_val = current_uid().val;
uid_t manager_uid = ksu_get_manager_uid();
if (current_uid_val != manager_uid &&
current_uid_val % 100000 == manager_uid) {
ksu_set_manager_uid(current_uid_val);
}

bool from_root = 0 == current_uid().val;
bool from_manager = is_manager();

Expand Down
2 changes: 1 addition & 1 deletion drivers/kernelsu/ksu.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
#include <linux/types.h>
#include <linux/workqueue.h>

#define KERNEL_SU_VERSION 11838
#define KERNEL_SU_VERSION 11872
#define KERNEL_SU_OPTION 0xDEADBEEF

#define CMD_GRANT_ROOT 0
Expand Down
24 changes: 12 additions & 12 deletions drivers/kernelsu/sucompat.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -187,12 +187,11 @@ int ksu_handle_devpts(struct inode *inode)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
struct inode_security_struct *sec = selinux_inode(inode);
#else
struct inode_security_struct *sec = (struct inode_security_struct *) inode->i_security;
struct inode_security_struct *sec =
(struct inode_security_struct *)inode->i_security;
#endif
if (sec) {
sec->sid = ksu_devpts_sid;
inode->i_uid.val = 0;
inode->i_gid.val = 0;
}
}

Expand Down Expand Up @@ -321,22 +320,23 @@ static struct kprobe execve_kp = {
};
#endif

static int devpts_get_priv_pre(struct kprobe *p, struct pt_regs *regs)
static int pts_unix98_lookup_pre(struct kprobe *p, struct pt_regs *regs)
{
struct inode *inode;
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 6, 0)
struct dentry *dentry = (struct dentry *)PT_REGS_PARM1(regs);
inode = dentry->d_inode;
struct file *file = (struct file *)PT_REGS_PARM2(regs);
inode = file->f_path.dentry->d_inode;
#else
inode = (struct inode *)PT_REGS_PARM1(real_regs);
inode = (struct inode *)PT_REGS_PARM2(regs);
#endif

return ksu_handle_devpts(inode);
}

static struct kprobe devpts_get_priv_kp = { .symbol_name = "devpts_get_priv",
.pre_handler =
devpts_get_priv_pre };
static struct kprobe pts_unix98_lookup_kp = { .symbol_name =
"pts_unix98_lookup",
.pre_handler =
pts_unix98_lookup_pre };

#endif

Expand All @@ -351,7 +351,7 @@ void ksu_sucompat_init()
pr_info("sucompat: newfstatat_kp: %d\n", ret);
ret = register_kprobe(&faccessat_kp);
pr_info("sucompat: faccessat_kp: %d\n", ret);
ret = register_kprobe(&devpts_get_priv_kp);
ret = register_kprobe(&pts_unix98_lookup_kp);
pr_info("sucompat: devpts_kp: %d\n", ret);
#endif
}
Expand All @@ -362,6 +362,6 @@ void ksu_sucompat_exit()
unregister_kprobe(&execve_kp);
unregister_kprobe(&newfstatat_kp);
unregister_kprobe(&faccessat_kp);
unregister_kprobe(&devpts_get_priv_kp);
unregister_kprobe(&pts_unix98_lookup_kp);
#endif
}
151 changes: 107 additions & 44 deletions drivers/kernelsu/throne_tracker.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@
#include <linux/string.h>
#include <linux/types.h>
#include <linux/version.h>
#include <linux/workqueue.h>

#include "allowlist.h"
#include "klog.h" // IWYU pragma: keep
Expand All @@ -16,8 +15,7 @@

uid_t ksu_manager_uid = KSU_INVALID_UID;

#define SYSTEM_PACKAGES_LIST_PATH "/data/system/packages.list"
static struct work_struct ksu_update_uid_work;
#define SYSTEM_PACKAGES_LIST_PATH "/data/system/packages.list.tmp"

struct uid_data {
struct list_head list;
Expand Down Expand Up @@ -94,8 +92,25 @@ static void crown_manager(const char *apk, struct list_head *uid_data)
}
}

#define DATA_PATH_LEN 384 // 384 is enough for /data/app/<package>/base.apk

struct data_path {
char dirpath[DATA_PATH_LEN];
int depth;
struct list_head list;
};

struct apk_path_hash {
unsigned int hash;
bool exists;
struct list_head list;
};

static struct list_head apk_path_hash_list = LIST_HEAD_INIT(apk_path_hash_list);

struct my_dir_context {
struct dir_context ctx;
struct list_head *data_path_list;
char *parent_dir;
void *private_data;
int depth;
Expand All @@ -119,8 +134,7 @@ FILLDIR_RETURN_TYPE my_actor(struct dir_context *ctx, const char *name,
{
struct my_dir_context *my_ctx =
container_of(ctx, struct my_dir_context, ctx);
struct file *file;
char dirpath[384]; // 384 is enough for /data/app/<package>/base.apk
char dirpath[DATA_PATH_LEN];

if (!my_ctx) {
pr_err("Invalid context\n");
Expand All @@ -134,38 +148,57 @@ FILLDIR_RETURN_TYPE my_actor(struct dir_context *ctx, const char *name,
if (!strncmp(name, "..", namelen) || !strncmp(name, ".", namelen))
return FILLDIR_ACTOR_CONTINUE; // Skip "." and ".."

if (snprintf(dirpath, sizeof(dirpath), "%s/%.*s", my_ctx->parent_dir,
namelen, name) >= sizeof(dirpath)) {
if (snprintf(dirpath, DATA_PATH_LEN, "%s/%.*s", my_ctx->parent_dir,
namelen, name) >= DATA_PATH_LEN) {
pr_err("Path too long: %s/%.*s\n", my_ctx->parent_dir, namelen,
name);
return FILLDIR_ACTOR_CONTINUE;
}

if (d_type == DT_DIR && my_ctx->depth > 0 &&
(my_ctx->stop && !*my_ctx->stop)) {
struct my_dir_context sub_ctx = { .ctx.actor = my_actor,
.parent_dir = dirpath,
.private_data =
my_ctx->private_data,
.depth = my_ctx->depth - 1,
.stop = my_ctx->stop };
file = ksu_filp_open_compat(dirpath, O_RDONLY | O_NOFOLLOW, 0);
if (IS_ERR(file)) {
pr_err("Failed to open directory: %s, err: %ld\n",
dirpath, PTR_ERR(file));
struct data_path *data = kmalloc(sizeof(struct data_path), GFP_ATOMIC);

if (!data) {
pr_err("Failed to allocate memory for %s\n", dirpath);
return FILLDIR_ACTOR_CONTINUE;
}

iterate_dir(file, &sub_ctx.ctx);
filp_close(file, NULL);
strscpy(data->dirpath, dirpath, DATA_PATH_LEN);
data->depth = my_ctx->depth - 1;
list_add_tail(&data->list, my_ctx->data_path_list);
} else {
if ((namelen == 8) && (strncmp(name, "base.apk", namelen) == 0)) {
struct apk_path_hash *pos, *n;
#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0)
unsigned int hash = full_name_hash(dirpath, strlen(dirpath));
#else
unsigned int hash = full_name_hash(NULL, dirpath, strlen(dirpath));
#endif
list_for_each_entry(pos, &apk_path_hash_list, list) {
if (hash == pos->hash) {
pos->exists = true;
return FILLDIR_ACTOR_CONTINUE;
}
}

bool is_manager = is_manager_apk(dirpath);
pr_info("Found base.apk at path: %s, is_manager: %d\n",
pr_info("Found new base.apk at path: %s, is_manager: %d\n",
dirpath, is_manager);
if (is_manager) {
crown_manager(dirpath, my_ctx->private_data);
*my_ctx->stop = 1;

// Manager found, clear APK cache list
list_for_each_entry_safe(pos, n, &apk_path_hash_list, list) {
list_del(&pos->list);
kfree(pos);
}
} else {
struct apk_path_hash *apk_data = kmalloc(sizeof(struct apk_path_hash), GFP_ATOMIC);
apk_data->hash = hash;
apk_data->exists = true;
list_add_tail(&apk_data->list, &apk_path_hash_list);
}
}
}
Expand All @@ -175,22 +208,58 @@ FILLDIR_RETURN_TYPE my_actor(struct dir_context *ctx, const char *name,

void search_manager(const char *path, int depth, struct list_head *uid_data)
{
struct file *file;
int stop = 0;
struct my_dir_context ctx = { .ctx.actor = my_actor,
.parent_dir = (char *)path,
.private_data = uid_data,
.depth = depth,
.stop = &stop };

file = ksu_filp_open_compat(path, O_RDONLY | O_NOFOLLOW, 0);
if (IS_ERR(file)) {
pr_err("Failed to open directory: %s\n", path);
return;
int i, stop = 0;
struct list_head data_path_list;
INIT_LIST_HEAD(&data_path_list);

// Initialize APK cache list
struct apk_path_hash *pos, *n;
list_for_each_entry(pos, &apk_path_hash_list, list) {
pos->exists = false;
}

// First depth
struct data_path data;
strscpy(data.dirpath, path, DATA_PATH_LEN);
data.depth = depth;
list_add_tail(&data.list, &data_path_list);

for (i = depth; i > 0; i--) {
struct data_path *pos, *n;

list_for_each_entry_safe(pos, n, &data_path_list, list) {
struct my_dir_context ctx = { .ctx.actor = my_actor,
.data_path_list = &data_path_list,
.parent_dir = pos->dirpath,
.private_data = uid_data,
.depth = pos->depth,
.stop = &stop };
struct file *file;

if (!stop) {
file = ksu_filp_open_compat(pos->dirpath, O_RDONLY | O_NOFOLLOW, 0);
if (IS_ERR(file)) {
pr_err("Failed to open directory: %s, err: %ld\n", pos->dirpath, PTR_ERR(file));
return;
}

iterate_dir(file, &ctx.ctx);
filp_close(file, NULL);
}

list_del(&pos->list);
if (pos != &data)
kfree(pos);
}
}

iterate_dir(file, &ctx.ctx);
filp_close(file, NULL);
// Remove stale cached APK entries
list_for_each_entry_safe(pos, n, &apk_path_hash_list, list) {
if (!pos->exists) {
list_del(&pos->list);
kfree(pos);
}
}
}

static bool is_uid_exist(uid_t uid, char *package, void *data)
Expand All @@ -209,14 +278,13 @@ static bool is_uid_exist(uid_t uid, char *package, void *data)
return exist;
}

static void do_update_uid(struct work_struct *work)
void track_throne()
{
struct file *fp =
ksu_filp_open_compat(SYSTEM_PACKAGES_LIST_PATH, O_RDONLY, 0);
if (IS_ERR(fp)) {
pr_err("do_update_uid, open " SYSTEM_PACKAGES_LIST_PATH
" failed: %ld\n",
PTR_ERR(fp));
pr_err("%s: open " SYSTEM_PACKAGES_LIST_PATH " failed: %ld\n",
__func__, PTR_ERR(fp));
return;
}

Expand Down Expand Up @@ -303,14 +371,9 @@ static void do_update_uid(struct work_struct *work)
}
}

void track_throne()
{
ksu_queue_work(&ksu_update_uid_work);
}

void ksu_throne_tracker_init()
{
INIT_WORK(&ksu_update_uid_work, do_update_uid);
// nothing to do
}

void ksu_throne_tracker_exit()
Expand Down

0 comments on commit 45b34cd

Please sign in to comment.