upstream

.github/workflows/build-manager.yml

@@ -16,14 +16,15 @@ on:
   workflow_call:
 
 jobs:
-  generate-key:
+  prepare:
     runs-on: ubuntu-latest
     outputs:
       expected_size: ${{ steps.extract.outputs.expected_size }}
       expected_hash: ${{ steps.extract.outputs.expected_hash }}
       keystore: ${{ steps.gen.outputs.keystore }}
       keystore_password: ${{ steps.gen.outputs.keystore_password }}
       key_password: ${{ steps.gen.outputs.key_password }}
+      spoofed_package_name: ${{ steps.pkg.outputs.spoofed_package_name }}
     steps:
       - name: Generate temporary keystore
         if: github.event_name == 'pull_request'
@@ -71,12 +72,21 @@ jobs:
           echo "Certificate size: $SIZE_HEX ($SIZE_DEC bytes)"
           echo "Certificate hash: $HASH"
 
+      - name: Generate package name for spoofed manager
+        id: pkg
+        run: |
+          word1=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          word2=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          word3=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          SPOOFED_PACKAGE_NAME="${word1}.${word2}.${word3}"
+          echo "spoofed_package_name=$SPOOFED_PACKAGE_NAME" >> $GITHUB_OUTPUT
+
   build-lkm:
-    needs: generate-key
+    needs: prepare
     uses: ./.github/workflows/build-lkm.yml
     with:
-      expected_pr_build_size: ${{ needs.generate-key.outputs.expected_size || '' }}
-      expected_pr_build_hash: ${{ needs.generate-key.outputs.expected_hash || '' }}
+      expected_pr_build_size: ${{ needs.prepare.outputs.expected_size || '' }}
+      expected_pr_build_hash: ${{ needs.prepare.outputs.expected_hash || '' }}
     secrets: inherit
 
   build-ksuinit:
@@ -86,22 +96,20 @@ jobs:
     needs: [build-lkm, build-ksuinit]
     strategy:
       matrix:
-        include:
-          - target: aarch64-linux-android
-            os: ubuntu-latest
-          - target: x86_64-linux-android
-            os: ubuntu-latest
-          - target: armv7-linux-androideabi
-            os: ubuntu-latest
+        target:
+          - aarch64-linux-android
+          - x86_64-linux-android
+          - armv7-linux-androideabi
+        os: [ubuntu-latest]
     uses: ./.github/workflows/ksud.yml
     with:
       target: ${{ matrix.target }}
       os: ${{ matrix.os }}
 
   build-manager:
-    needs: [generate-key]
+    needs: [prepare]
     runs-on: ubuntu-latest
-    if: always() && needs.generate-key.result == 'success'
+    if: always() && needs.prepare.result == 'success'
     strategy:
       fail-fast: false
       matrix:
@@ -141,12 +149,6 @@ jobs:
             echo "title=Manager" >> $GITHUB_OUTPUT
           fi
 
-      - name: Run randomizer
-        if: ${{ matrix.manager_type == 'spoofed' }}
-        run: |
-          chmod +x randomizer
-          ./randomizer
-
       - name: Write key
         if: ${{ github.event_name == 'workflow_dispatch' || ( github.event_name != 'pull_request') || github.ref_type == 'tag' }}
         run: |
@@ -163,9 +165,9 @@ jobs:
       - name: Write PR key
         if: github.event_name == 'pull_request'
         env:
-          PR_KEYSTORE: ${{ needs.generate-key.outputs.keystore }}
-          PR_KEYSTORE_PASSWORD: ${{ needs.generate-key.outputs.keystore_password }}
-          PR_KEY_PASSWORD: ${{ needs.generate-key.outputs.key_password }}
+          PR_KEYSTORE: ${{ needs.prepare.outputs.keystore }}
+          PR_KEYSTORE_PASSWORD: ${{ needs.prepare.outputs.keystore_password }}
+          PR_KEY_PASSWORD: ${{ needs.prepare.outputs.key_password }}
         run: |
           echo "$PR_KEYSTORE" | base64 -d > pr-key.jks
           {
@@ -184,15 +186,25 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
 
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
-
       - name: Build APK
         run: |
+          export BUILD_EXTRA_ARGS=""
+          if [ "${{ matrix.manager_type }}" == "spoofed" ]; then
+            export KSU_PACKAGE_NAME="${{ needs.prepare.outputs.spoofed_package_name }}"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME -PIS_SPOOFED_BUILD=true"
+          elif [ "${{ github.event_name }}" == "pull_request" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.pr${{github.event.pull_request.number}}"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME"
+          elif [ "${{ github.ref_type }}" != "tag" ] && [ "${{ github.ref_name }}" != "main" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.dev"
+            export KSU_NAME="ReSukiSU-DEV"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME -PKSU_NAME=$KSU_NAME"
+          fi
+
           if [ "${{ github.event_name }}" == "pull_request" ]; then
-            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} -PIS_PR_BUILD=true
+            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} -PIS_PR_BUILD=true $BUILD_EXTRA_ARGS
           else
-            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }}
+            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} $BUILD_EXTRA_ARGS
           fi
 
       - name: Upload artifact
@@ -212,7 +224,7 @@ jobs:
 
   repack-manager:
     if: always() && needs.build-manager.result == 'success' && needs.build-ksud.result == 'success'
-    needs: [build-manager, build-ksud, generate-key]
+    needs: [build-manager, build-ksud, prepare]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -286,9 +298,9 @@ jobs:
 
       - name: Prepare signing inputs
         env:
-          PR_KEYSTORE: ${{ needs.generate-key.outputs.keystore }}
-          PR_KEYSTORE_PASSWORD: ${{ needs.generate-key.outputs.keystore_password }}
-          PR_KEY_PASSWORD: ${{ needs.generate-key.outputs.key_password }}
+          PR_KEYSTORE: ${{ needs.prepare.outputs.keystore }}
+          PR_KEYSTORE_PASSWORD: ${{ needs.prepare.outputs.keystore_password }}
+          PR_KEY_PASSWORD: ${{ needs.prepare.outputs.key_password }}
           PROD_KEYSTORE: ${{ secrets.KEYSTORE }}
           PROD_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           PROD_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}

.github/workflows/codeql.yml

@@ -75,9 +75,6 @@ jobs:
           build-scan-publish: false
           cache-read-only: true
 
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
-
       - name: Grant execute permission for gradlew
         run: chmod +x ./gradlew
 

.github/workflows/ksud.yml

@@ -72,6 +72,12 @@ jobs:
 
       - name: Build ksud
         run: |
+          if [ "${{github.event_name}}" == "pull_request" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.pr${{github.event.pull_request.number}}"
+          elif [ "${{github.ref_type}}" != "tag" ] && [ "${{github.ref_name}}" != "main" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.dev"
+          fi
+
           cd userspace/ksud/
           cargo ndk b -P 26 -t ${{ inputs.target }} -r -Z build-std-features="optimize_for_size" -Z trim-paths
 

.github/workflows/lints-check.yml

@@ -123,9 +123,6 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
 
       - name: Check Manager Lint
         run: |

kernel/compat/kernel_compat.c

@@ -9,9 +9,11 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <linux/errno.h>
 
 #include "klog.h" // IWYU pragma: keep
 #include "kernel_compat.h"
+#include "ksu.h"
 
 ssize_t ksu_kernel_read_compat(struct file *p, void *buf, size_t count, loff_t *pos)
 {
@@ -195,42 +197,22 @@ void ksu_run_in_init_if_possible(void (*callback)(void *), void *data)
 #endif
 }
 
-#ifdef KSU_COMPAT_REQUIRE_SESSION_KEYRING
-#include <linux/key.h>
-#include <linux/errno.h>
-#include <linux/cred.h>
-#include "ksu.h"
-
-static inline struct key *ksu_get_session_keyring(const struct cred *cred)
-{
-// https://github.com/torvalds/linux/commit/3a50597de8635cd05133bd12c95681c82fe7b878
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-    return rcu_dereference(cred->session_keyring);
-#else
-    return rcu_dereference(current->cred->tgcred->session_keyring);
-#endif
-}
-
+struct key *init_session_keyring = NULL;
 extern int install_session_keyring_to_cred(struct cred *, struct key *);
 
-// WARNING! Make sure caller in init!!!
-// https://github.com/torvalds/linux/commit/5c7e372caa35d303e414caeb64ee2243fd3cac3d
-// in our target kernel version, it are protected by rcu, so let's rcu_dereference here
 void setup_ksu_cred_session_keyring(void)
 {
     if (ksu_get_session_keyring(ksu_cred)) {
         // if we have session_keyring, skip
         return;
     }
 
-    if (strcmp(current->comm, "init")) {
-        // we are only interested in `init` process
+    if (init_session_keyring == NULL) {
+        // if init_session_keyring is null, skip
         return;
     }
 
-    install_session_keyring_to_cred(ksu_cred, ksu_get_session_keyring(current_cred()));
+    install_session_keyring_to_cred(ksu_cred, init_session_keyring);
 
     pr_info("kernel_compat: %s: install init_session_keyring to ksu_cred\n", __func__);
 }
-
-#endif

kernel/compat/kernel_compat.h

@@ -5,7 +5,7 @@
 #include <linux/version.h>
 #include <linux/fdtable.h>
 #include "ss/policydb.h"
-#include "linux/key.h"
+#include <linux/key.h>
 
 /*
  * Leagcy Huawei Hisi Devices info Start
@@ -276,11 +276,18 @@ static inline u64 ksu_ktime_get_ns(void)
 
 extern void ksu_run_in_init_if_possible(void (*callback)(void *), void *data);
 
-#if defined(CONFIG_KEYS) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0) || defined(KSU_COMPAT_IS_HISI_LEGACY) ||    \
-                             defined(KSU_COMPAT_IS_HISI_LEGACY_HM2))
-#define KSU_COMPAT_REQUIRE_SESSION_KEYRING
+extern struct key *init_session_keyring;
 extern void setup_ksu_cred_session_keyring(void);
+
+static inline struct key *ksu_get_session_keyring(const struct cred *cred)
+{
+// https://github.com/torvalds/linux/commit/3a50597de8635cd05133bd12c95681c82fe7b878
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
+    return rcu_dereference(cred->session_keyring);
+#else
+    return rcu_dereference(current->cred->tgcred->session_keyring);
 #endif
+}
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 3, 0) || defined(KSU_HAS_MODERN_STATIC_KEY_INTERFACE)
 #define KSU_COMPAT_USE_STATIC_KEY

kernel/core/init.c

@@ -141,9 +141,11 @@ static inline void __exit ksu_hook_exit(void)
 void setup_ksu_cred(void)
 {
     setup_ksu_cred_selinux();
-#ifdef KSU_COMPAT_REQUIRE_SESSION_KEYRING
+    if (init_session_keyring == NULL) {
+        init_session_keyring = ksu_get_session_keyring(current_cred());
+    }
+
     setup_ksu_cred_session_keyring();
-#endif
 }
 
 #ifdef CONFIG_KSU_DEBUG
@@ -155,6 +157,11 @@ bool allow_shell = false;
 bool ksu_no_custom_rc = false;
 module_param_named(norc, ksu_no_custom_rc, bool, 0);
 
+#ifdef MODULE
+bool ksu_bundled = false;
+module_param_named(bundled, ksu_bundled, bool, 0);
+#endif
+
 char ksu_block_modules[256];
 module_param_string(block_modules, ksu_block_modules, sizeof(ksu_block_modules), 0);
 MODULE_PARM_DESC(block_modules, "Comma-separated preset module names to acknowledge without loading");

kernel/feature/adb_root.c

@@ -8,6 +8,12 @@
 #include <linux/ptrace.h>
 #include <linux/static_key.h>
 #include <linux/slab.h>
+#include <linux/version.h>
+
+// https://github.com/torvalds/linux/commit/68db0cf10678630d286f4bbbbdfa102951a35faa
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
+#include <linux/sched/task_stack.h>
+#endif
 
 #include "adb_root.h"
 #include "arch.h"

kernel/feature/kernel_umount.c

@@ -2,7 +2,6 @@
 #include <linux/slab.h>
 #include <linux/version.h>
 #include <linux/cred.h>
-#include <linux/compiler.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -31,7 +30,6 @@
 #include "feature/sucompat.h"
 
 static bool ksu_kernel_umount_enabled = true;
-bool ksu_webview_zygote_umount_enabled = false;
 
 static int kernel_umount_feature_get(u64 *value)
 {
@@ -54,27 +52,6 @@ static const struct ksu_feature_handler kernel_umount_handler = {
     .set_handler = kernel_umount_feature_set,
 };
 
-static int webview_zygote_umount_feature_get(u64 *value)
-{
-    *value = ksu_webview_zygote_umount_enabled ? 1 : 0;
-    return 0;
-}
-
-static int webview_zygote_umount_feature_set(u64 value)
-{
-    bool enable = value != 0;
-    ksu_webview_zygote_umount_enabled = enable;
-    pr_info("webview_zygote_umount: set to %d\n", enable);
-    return 0;
-}
-
-static const struct ksu_feature_handler webview_zygote_umount_handler = {
-    .feature_id = KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT,
-    .name = "webview_zygote_umount",
-    .get_handler = webview_zygote_umount_feature_get,
-    .set_handler = webview_zygote_umount_feature_set,
-};
-
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0) || defined(KSU_HAS_PATH_UMOUNT)
 extern int path_umount(struct path *path, int flags);
 static void ksu_umount_mnt(const char *mnt, struct path *path, int flags)
@@ -152,7 +129,7 @@ int ksu_handle_umount(uid_t old_uid, uid_t new_uid)
     // 1. Normal app: zygote -> appuid
     // 2. Isolated process forked from zygote: zygote -> isolated_process
     // 3. App zygote forked from zygote: zygote -> appuid
-    // 4. Webview zygote forked from zygote: zygote -> webview_zygote (controlled by feature policy)
+    // 4. Webview zygote forked from zygote: zygote -> webview_zygote
     // 5. Isolated process forked from app zygote: appuid -> isolated_process (already handled by 3)
     // 6. Isolated process forked from webview zygote (already handled by 4)
     if (!is_appuid(new_uid) && new_uid != WEBVIEW_ZYGOTE_UID && !is_isolated_process(new_uid)) {
@@ -205,13 +182,9 @@ void __init ksu_kernel_umount_init(void)
     if (ksu_register_feature_handler(&kernel_umount_handler)) {
         pr_err("Failed to register kernel_umount feature handler\n");
     }
-    if (ksu_register_feature_handler(&webview_zygote_umount_handler)) {
-        pr_err("Failed to register webview_zygote_umount feature handler\n");
-    }
 }
 
 void __exit ksu_kernel_umount_exit(void)
 {
-    ksu_unregister_feature_handler(KSU_FEATURE_WEBVIEW_ZYGOTE_UMOUNT);
     ksu_unregister_feature_handler(KSU_FEATURE_KERNEL_UMOUNT);
 }

kernel/feature/kernel_umount.h

@@ -7,7 +7,6 @@
 
 void ksu_kernel_umount_init(void);
 void ksu_kernel_umount_exit(void);
-extern bool ksu_webview_zygote_umount_enabled;
 
 // Handler function to be called from setresuid hook
 int ksu_handle_umount(uid_t old_uid, uid_t new_uid);