-
-
Notifications
You must be signed in to change notification settings - Fork 3k
kernel, ksud, manager: Remove enhanced security feature #3123
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR removes the enhanced_security feature from KernelSU due to its incompatibility with the current tracepoint hook implementation. The feature was designed for the old LSM hook-based approach but cannot be reliably implemented with tracepoint hooks without introducing security side channels, particularly because setresuid is not hooked for apps outside the allowlist.
- Removes the
EnhancedSecurityfeature enum and all related code from kernel, userspace daemon, and manager app - Removes UI controls and localized strings for the enhanced security toggle across all supported languages
- Updates documentation to remove references to
enhanced_securityfrom the list of supported module features
Reviewed changes
Copilot reviewed 31 out of 31 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
kernel/feature.h |
Removes KSU_FEATURE_ENHANCED_SECURITY enum value |
kernel/setuid_hook.c |
Removes enhanced security handler registration, security checks, and related static variables |
userspace/ksud/src/feature.rs |
Removes EnhancedSecurity variant from FeatureId enum and related match arms |
manager/app/src/main/cpp/ksu.h |
Removes KSU_FEATURE_ENHANCED_SECURITY enum definition |
manager/app/src/main/cpp/ksu.cc |
Removes set_enhanced_security_enabled() and is_enhanced_security_enabled() functions |
manager/app/src/main/cpp/jni.cc |
Removes JNI bindings for enhanced security native methods |
manager/app/src/main/java/me/weishu/kernelsu/Natives.kt |
Removes enhanced security native method declarations |
manager/app/src/main/java/me/weishu/kernelsu/ui/screen/Settings.kt |
Removes enhanced security UI dropdown control and state management |
manager/app/src/main/res/values*/strings.xml |
Removes settings_enable_enhanced_security strings from 18 language resource files |
website/docs/*/guide/module-config.md |
Removes enhanced_security from supported features list in 8 localized documentation files |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Signed-off-by: rsuntk <[email protected]>
…SU#3123) This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users.
kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123)
kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123)
kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123)
kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123)
kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123)
….7 (#1047) * KSU-Next: Debloat Signed-off-by: Sorayukii <[email protected]> * kernel: fix Wcalloc-transposed-args (tiann/KernelSU#3121) * Merge pull request #1035 from pershoot/dev1 kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123) * kernel: extras: avc log spoofing * kernel: extras: base implementation of avc log spoofing * kernel: extras: properly version out slow_avc_audit_pre_handler * kernel: extras: add avc spoof to feature this is a rebase of: KOWX712/KernelSU@4b6f76d * kernel/extra: replace sensitive context with priv_app ref: aviraxp/ZN-AuditPatch@a0a46bd Co-Authored-By: backslashxx <[email protected]> Co-Authored-By: Wang Han <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: ksud: migrate init.rc handling to security_file_permission LSM devlog backslashxx/KernelSU@5ba658b...8a6ae25 backslashxx/KernelSU@b7df5d1...754bbd5 Signed-off-by: backslashxx <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: Try to fix CONFIG_KSU_ALLOWLIST_WORKAROUND ../drivers/kernelsu/lsm_hooks.c:145:32: error: use of undeclared identifier 'ksu_key_permission'; did you mean 'ksu_inode_permission'? 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ | ksu_inode_permission ../include/linux/lsm_hooks.h:2060:57: note: expanded from macro 'LSM_HOOK_INIT' 2060 | { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } | ^~~~ ../drivers/kernelsu/lsm_hooks.c:107:5: note: 'ksu_inode_permission' declared here 107 | int ksu_inode_permission(struct inode inode, int mask) | ^ ../drivers/kernelsu/lsm_hooks.c:145:32: error: incompatible function pointer types initializing 'int ()(key_ref_t, const struct cred , unsigned int)' (aka 'int ()(struct __key_reference_with_attributes *, const struct cred *, unsigned int)') with an expression of type 'int (struct inode *, int)' [-Wincompatible-function-pointer-types] 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: Sorayukii <[email protected]> --------- Signed-off-by: Sorayukii <[email protected]> Signed-off-by: backslashxx <[email protected]> Co-authored-by: libingxuan <[email protected]> Co-authored-by: pershoot <[email protected]> Co-authored-by: KOWX712 <[email protected]> Co-authored-by: backslashxx <[email protected]> Co-authored-by: Wang Han <[email protected]>
….7 (KernelSU-Next#1047) * KSU-Next: Debloat Signed-off-by: Sorayukii <[email protected]> * kernel: fix Wcalloc-transposed-args (tiann/KernelSU#3121) * Merge pull request KernelSU-Next#1035 from pershoot/dev1 kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123) * kernel: extras: avc log spoofing * kernel: extras: base implementation of avc log spoofing * kernel: extras: properly version out slow_avc_audit_pre_handler * kernel: extras: add avc spoof to feature this is a rebase of: KOWX712/KernelSU@4b6f76d * kernel/extra: replace sensitive context with priv_app ref: aviraxp/ZN-AuditPatch@a0a46bd Co-Authored-By: backslashxx <[email protected]> Co-Authored-By: Wang Han <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: ksud: migrate init.rc handling to security_file_permission LSM devlog backslashxx/KernelSU@5ba658b...8a6ae25 backslashxx/KernelSU@b7df5d1...754bbd5 Signed-off-by: backslashxx <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: Try to fix CONFIG_KSU_ALLOWLIST_WORKAROUND ../drivers/kernelsu/lsm_hooks.c:145:32: error: use of undeclared identifier 'ksu_key_permission'; did you mean 'ksu_inode_permission'? 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ | ksu_inode_permission ../include/linux/lsm_hooks.h:2060:57: note: expanded from macro 'LSM_HOOK_INIT' 2060 | { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } | ^~~~ ../drivers/kernelsu/lsm_hooks.c:107:5: note: 'ksu_inode_permission' declared here 107 | int ksu_inode_permission(struct inode inode, int mask) | ^ ../drivers/kernelsu/lsm_hooks.c:145:32: error: incompatible function pointer types initializing 'int ()(key_ref_t, const struct cred , unsigned int)' (aka 'int ()(struct __key_reference_with_attributes *, const struct cred *, unsigned int)') with an expression of type 'int (struct inode *, int)' [-Wincompatible-function-pointer-types] 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: Sorayukii <[email protected]> --------- Signed-off-by: Sorayukii <[email protected]> Signed-off-by: backslashxx <[email protected]> Co-authored-by: libingxuan <[email protected]> Co-authored-by: pershoot <[email protected]> Co-authored-by: KOWX712 <[email protected]> Co-authored-by: backslashxx <[email protected]> Co-authored-by: Wang Han <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
….7 (KernelSU-Next#1047) * KSU-Next: Debloat Signed-off-by: Sorayukii <[email protected]> * kernel: fix Wcalloc-transposed-args (tiann/KernelSU#3121) * Merge pull request KernelSU-Next#1035 from pershoot/dev1 kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123) * kernel: extras: avc log spoofing * kernel: extras: base implementation of avc log spoofing * kernel: extras: properly version out slow_avc_audit_pre_handler * kernel: extras: add avc spoof to feature this is a rebase of: KOWX712/KernelSU@4b6f76d * kernel/extra: replace sensitive context with priv_app ref: aviraxp/ZN-AuditPatch@a0a46bd Co-Authored-By: backslashxx <[email protected]> Co-Authored-By: Wang Han <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: ksud: migrate init.rc handling to security_file_permission LSM devlog backslashxx/KernelSU@5ba658b...8a6ae25 backslashxx/KernelSU@b7df5d1...754bbd5 Signed-off-by: backslashxx <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: Try to fix CONFIG_KSU_ALLOWLIST_WORKAROUND ../drivers/kernelsu/lsm_hooks.c:145:32: error: use of undeclared identifier 'ksu_key_permission'; did you mean 'ksu_inode_permission'? 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ | ksu_inode_permission ../include/linux/lsm_hooks.h:2060:57: note: expanded from macro 'LSM_HOOK_INIT' 2060 | { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } | ^~~~ ../drivers/kernelsu/lsm_hooks.c:107:5: note: 'ksu_inode_permission' declared here 107 | int ksu_inode_permission(struct inode inode, int mask) | ^ ../drivers/kernelsu/lsm_hooks.c:145:32: error: incompatible function pointer types initializing 'int ()(key_ref_t, const struct cred , unsigned int)' (aka 'int ()(struct __key_reference_with_attributes *, const struct cred *, unsigned int)') with an expression of type 'int (struct inode *, int)' [-Wincompatible-function-pointer-types] 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: Sorayukii <[email protected]> --------- Signed-off-by: Sorayukii <[email protected]> Signed-off-by: backslashxx <[email protected]> Co-authored-by: libingxuan <[email protected]> Co-authored-by: pershoot <[email protected]> Co-authored-by: KOWX712 <[email protected]> Co-authored-by: backslashxx <[email protected]> Co-authored-by: Wang Han <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
….7 (KernelSU-Next#1047) * KSU-Next: Debloat Signed-off-by: Sorayukii <[email protected]> * kernel: fix Wcalloc-transposed-args (tiann/KernelSU#3121) * Merge pull request KernelSU-Next#1035 from pershoot/dev1 kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123) * kernel: extras: avc log spoofing * kernel: extras: base implementation of avc log spoofing * kernel: extras: properly version out slow_avc_audit_pre_handler * kernel: extras: add avc spoof to feature this is a rebase of: KOWX712/KernelSU@4b6f76d * kernel/extra: replace sensitive context with priv_app ref: aviraxp/ZN-AuditPatch@a0a46bd Co-Authored-By: backslashxx <[email protected]> Co-Authored-By: Wang Han <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: ksud: migrate init.rc handling to security_file_permission LSM devlog backslashxx/KernelSU@5ba658b...8a6ae25 backslashxx/KernelSU@b7df5d1...754bbd5 Signed-off-by: backslashxx <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: Try to fix CONFIG_KSU_ALLOWLIST_WORKAROUND ../drivers/kernelsu/lsm_hooks.c:145:32: error: use of undeclared identifier 'ksu_key_permission'; did you mean 'ksu_inode_permission'? 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ | ksu_inode_permission ../include/linux/lsm_hooks.h:2060:57: note: expanded from macro 'LSM_HOOK_INIT' 2060 | { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } | ^~~~ ../drivers/kernelsu/lsm_hooks.c:107:5: note: 'ksu_inode_permission' declared here 107 | int ksu_inode_permission(struct inode inode, int mask) | ^ ../drivers/kernelsu/lsm_hooks.c:145:32: error: incompatible function pointer types initializing 'int ()(key_ref_t, const struct cred , unsigned int)' (aka 'int ()(struct __key_reference_with_attributes *, const struct cred *, unsigned int)') with an expression of type 'int (struct inode *, int)' [-Wincompatible-function-pointer-types] 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: Sorayukii <[email protected]> --------- Signed-off-by: Sorayukii <[email protected]> Signed-off-by: backslashxx <[email protected]> Co-authored-by: libingxuan <[email protected]> Co-authored-by: pershoot <[email protected]> Co-authored-by: KOWX712 <[email protected]> Co-authored-by: backslashxx <[email protected]> Co-authored-by: Wang Han <[email protected]>
….7 (KernelSU-Next#1047) * KSU-Next: Debloat Signed-off-by: Sorayukii <[email protected]> * kernel: fix Wcalloc-transposed-args (tiann/KernelSU#3121) * Merge pull request KernelSU-Next#1035 from pershoot/dev1 kernel, ksud, manager: Remove enhanced security feature (tiann/KernelSU#3123) * kernel: extras: avc log spoofing * kernel: extras: base implementation of avc log spoofing * kernel: extras: properly version out slow_avc_audit_pre_handler * kernel: extras: add avc spoof to feature this is a rebase of: KOWX712/KernelSU@4b6f76d * kernel/extra: replace sensitive context with priv_app ref: aviraxp/ZN-AuditPatch@a0a46bd Co-Authored-By: backslashxx <[email protected]> Co-Authored-By: Wang Han <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: ksud: migrate init.rc handling to security_file_permission LSM devlog backslashxx/KernelSU@5ba658b...8a6ae25 backslashxx/KernelSU@b7df5d1...754bbd5 Signed-off-by: backslashxx <[email protected]> Signed-off-by: Sorayukii <[email protected]> * kernel: Try to fix CONFIG_KSU_ALLOWLIST_WORKAROUND ../drivers/kernelsu/lsm_hooks.c:145:32: error: use of undeclared identifier 'ksu_key_permission'; did you mean 'ksu_inode_permission'? 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ | ksu_inode_permission ../include/linux/lsm_hooks.h:2060:57: note: expanded from macro 'LSM_HOOK_INIT' 2060 | { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } | ^~~~ ../drivers/kernelsu/lsm_hooks.c:107:5: note: 'ksu_inode_permission' declared here 107 | int ksu_inode_permission(struct inode inode, int mask) | ^ ../drivers/kernelsu/lsm_hooks.c:145:32: error: incompatible function pointer types initializing 'int ()(key_ref_t, const struct cred , unsigned int)' (aka 'int ()(struct __key_reference_with_attributes *, const struct cred *, unsigned int)') with an expression of type 'int (struct inode *, int)' [-Wincompatible-function-pointer-types] 145 | LSM_HOOK_INIT(key_permission, ksu_key_permission), | ^~~~~~~~~~~~~~~~~~ 2 errors generated. Signed-off-by: Sorayukii <[email protected]> --------- Signed-off-by: Sorayukii <[email protected]> Signed-off-by: backslashxx <[email protected]> Co-authored-by: libingxuan <[email protected]> Co-authored-by: pershoot <[email protected]> Co-authored-by: KOWX712 <[email protected]> Co-authored-by: backslashxx <[email protected]> Co-authored-by: Wang Han <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users. Co-authored-by: Wang Han <[email protected]> Signed-off-by: u9521 <[email protected]>
This feature does not work with tracepoint hook because setresuid is not even hooked for apps not in allowlist. It was invented when we still use task_fix_setuid LSM hook, but since it is inlined in oplus kernel and we switched to tracepoint hook, we don't have a reliable way to implement this feature without introducing side channels. Remove it and avoid confuse users.