1
commit b5853fb7cefdc8a2e160cb73512dc6b51569fa66
2
Author: OnlyTomInSecond <q2781273965@gmail.com>
3
Date:   Wed Apr 5 11:05:12 2023 +0800
4

5
    kernelsu: allow init exec ksud under nosuid
6

7
    Change-Id: I8aa6e6d3cbee1addd5da9bb48b4c08ce91f9db81
8

9
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
10
index 4abba0e1674d..693f2ac03352 100644
11
--- a/security/selinux/hooks.c
12
+++ b/security/selinux/hooks.c
13
@@ -2320,7 +2320,10 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
14
 {
15
        int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
16
        int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
17
       int rc;
18
       int rc, error;
19
    static u32 ksu_sid;
20
       char *secdata;
21
    u32 seclen;
22

23
        if (!nnp && !nosuid)
24
      return 0; /* neither NNP nor nosuid */
25
@@ -2328,6 +2331,18 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
26
        if (new_tsec->sid == old_tsec->sid)
27
      return 0; /* No change in credentials */
28

29
    if(!ksu_sid){
30
     security_secctx_to_secid("u:r:su:s0", strlen("u:r:su:s0"), &ksu_sid);
31
       }
32
       error = security_secid_to_secctx(old_tsec->sid, &secdata, &seclen);
33
       if (!error) {
34
     rc = strcmp("u:r:init:s0",secdata);
35
     security_release_secctx(secdata, seclen);
36
     if(rc == 0 && new_tsec->sid == ksu_sid){
37
   return 0;
38
     }
39
       }
40

41
        /*
42
         * The only transitions we permit under NNP or nosuid
43
         * are transitions to bounded SIDs, i.e. SIDs that are

1
commit 8bfe4d4de25650505798cba0a5a20db4b2ab7dd6
2
Author: OnlyTomInSecond <q2781273965@gmail.com>
3
Date:   Thu Oct 19 17:55:23 2023 +0800
4

5
    Kernelsu: add path_umount implementation.
6

7
    Change-Id: I3b0273e9857c51cc3215afab0d2cebe0dff38cfb
8

9
diff --git a/fs/namespace.c b/fs/namespace.c
10
index 21fd423b19cf..219a501337b0 100644
11
--- a/fs/namespace.c
12
+++ b/fs/namespace.c
13
@@ -1711,6 +1711,38 @@ static inline bool may_mandlock(void)
14
 }
15
 #endif
16

17
static int can_umount(const struct path *path, int flags)
18
{
19
       struct mount *mnt = real_mount(path->mnt);
20

21
       if (!may_mount())
22
     return -EPERM;
23
       if (path->dentry != path->mnt->mnt_root)
24
     return -EINVAL;
25
       if (!check_mnt(mnt))
26
     return -EINVAL;
27
       if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
28
     return -EINVAL;
29
       if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
30
     return -EPERM;
31
       return 0;
32
}
33

34
// caller is responsible for flags being sane
35
int path_umount(struct path *path, int flags)
36
{
37
       struct mount *mnt = real_mount(path->mnt);
38
       int ret;
39

40
       ret = can_umount(path, flags);
41
       if (!ret)
42
     ret = do_umount(mnt, flags);
43

44
       /* we mustn't call path_put() as that would clear mnt_expiry_mark */
45
       dput(path->dentry);
46
       mntput_no_expire(mnt);
47
       return ret;
48
}
49
 /*
50
  * Now umount can handle mount points as well as block devices.
51
  * This is important for filesystems which use unnamed block devices.

1
CONFIG_KPROBES=y
2
CONFIG_HAVE_KPROBES=y
3
CONFIG_KPROBE_EVENTS=y

1
commit 3b46e03e0ffdd52bbb3f51b45b0ff649a407d1a5
2
Author: KaguraiYoRoy <3363384229@qq.com>
3
Date:   Sat Sep 9 02:41:54 2023 +0000
4

5
    anykernel.sh: modify for equuleus
6

7
diff --git a/anykernel.sh b/anykernel.sh
8
old mode 100755
9
new mode 100644
10
index 367d29f..c950ce7
11
--- a/anykernel.sh
12
+++ b/anykernel.sh
13
@@ -4,23 +4,17 @@
14
 ### AnyKernel setup
15
 # global properties
16
 properties() { '
17
kernel.string=ExampleKernel by osm0sis @ xda-developers
18
kernel.string=Xiaomi 8 Pro Kernel by Kagura iYoRoy @ iYoRoy Studio
19
 do.devicecheck=1
20
 do.modules=0
21
do.systemless=1
22
do.systemless=0
23
 do.cleanup=1
24
 do.cleanuponabort=0
25
device.name1=maguro
26
device.name2=toro
27
device.name3=toroplus
28
device.name4=tuna
29
device.name5=
30
supported.versions=
31
device.name1=equuleus
32
supported.versions=13
33
 supported.patchlevels=
34
supported.vendorpatchlevels=
35
 '; } # end properties
36

37

38
 ### AnyKernel install
39
 ## boot files attributes
40
 boot_attributes() {
41
@@ -29,7 +23,7 @@ set_perm_recursive 0 0 750 750 $ramdisk/init* $ramdisk/sbin;
42
 } # end attributes
43

44
 # boot shell variables
45
block=/dev/block/platform/omap/omap_hsmmc.0/by-name/boot;
46
block=/dev/block/bootdevice/by-name/boot;
47
 is_slot_device=0;
48
 ramdisk_compression=auto;
49
 patch_vbmeta_flag=auto;
50
@@ -41,32 +35,26 @@ patch_vbmeta_flag=auto;
51
 dump_boot; # use split_boot to skip ramdisk unpack, e.g. for devices with init_boot ramdisk
52

53
 # init.rc
54
backup_file init.rc;
55
replace_string init.rc "cpuctl cpu,timer_slack" "mount cgroup none /dev/cpuctl cpu" "mount cgroup none /dev/cpuctl cpu,timer_slack";
56
#backup_file init.rc;
57
#replace_string init.rc "cpuctl cpu,timer_slack" "mount cgroup none /dev/cpuctl cpu" "mount cgroup none /dev/cpuctl cpu,timer_slack";
58

59
 # init.tuna.rc
60
backup_file init.tuna.rc;
61
insert_line init.tuna.rc "nodiratime barrier=0" after "mount_all /fstab.tuna" "\tmount ext4 /dev/block/platform/omap/omap_hsmmc.0/by-name/userdata /data remount nosuid nodev noatime nodiratime barrier=0";
62
append_file init.tuna.rc "bootscript" init.tuna;
63
#backup_file init.tuna.rc;
64
#insert_line init.tuna.rc "nodiratime barrier=0" after "mount_all /fstab.tuna" "\tmount ext4 /dev/block/platform/omap/omap_hsmmc.0/by-name/userdata /data remount nosuid nodev noatime nodiratime barrier=0";
65
#append_file init.tuna.rc "bootscript" init.tuna;
66

67
 # fstab.tuna
68
backup_file fstab.tuna;
69
patch_fstab fstab.tuna /system ext4 options "noatime,barrier=1" "noatime,nodiratime,barrier=0";
70
patch_fstab fstab.tuna /cache ext4 options "barrier=1" "barrier=0,nomblk_io_submit";
71
patch_fstab fstab.tuna /data ext4 options "data=ordered" "nomblk_io_submit,data=writeback";
72
append_file fstab.tuna "usbdisk" fstab;
73
#backup_file fstab.tuna;
74
#patch_fstab fstab.tuna /system ext4 options "noatime,barrier=1" "noatime,nodiratime,barrier=0";
75
#patch_fstab fstab.tuna /cache ext4 options "barrier=1" "barrier=0,nomblk_io_submit";
76
#patch_fstab fstab.tuna /data ext4 options "data=ordered" "nomblk_io_submit,data=writeback";
77
#append_file fstab.tuna "usbdisk" fstab;
78

79
 write_boot; # use flash_boot to skip ramdisk repack, e.g. for devices with init_boot ramdisk
80
 ## end boot install
81

82

83
## init_boot files attributes
84
#init_boot_attributes() {
85
#set_perm_recursive 0 0 755 644 $ramdisk/*;
86
#set_perm_recursive 0 0 750 750 $ramdisk/init* $ramdisk/sbin;
87
#} # end attributes
88

89
# init_boot shell variables
90
## init_boot shell variables
91
 #block=init_boot;
92
 #is_slot_device=1;
93
 #ramdisk_compression=auto;
94
@@ -98,13 +86,7 @@ write_boot; # use flash_boot to skip ramdisk repack, e.g. for devices with init_
95
 ## end vendor_kernel_boot install
96

97

98
## vendor_boot files attributes
99
#vendor_boot_attributes() {
100
#set_perm_recursive 0 0 755 644 $ramdisk/*;
101
#set_perm_recursive 0 0 750 750 $ramdisk/init* $ramdisk/sbin;
102
#} # end attributes
103

104
# vendor_boot shell variables
105
## vendor_boot shell variables
106
 #block=vendor_boot;
107
 #is_slot_device=1;
108
 #ramdisk_compression=auto;
109
@@ -118,4 +100,3 @@ write_boot; # use flash_boot to skip ramdisk repack, e.g. for devices with init_
110

111
 #write_boot; # use flash_boot to skip ramdisk repack, e.g. for dtb on devices with hdr v4 but no vendor_kernel_boot
112
 ## end vendor_boot install
113

1
#!/bin/bash
2
ARCH="arm64"
3
CLANG_DIR="$WORKSPACE/clang/clang-r450784d" #Clang directory
4
CC="$CLANG_DIR/bin/clang"
5
export PATH="$CLANG_DIR/bin:$PATH"
6
OUT_DIR="./out"
7
CLANG_TRIPLE="aarch64-linux-gnu-"
8
CROSS_COMPILE="$WORKSPACE/aarch64-linux-android-4.9/bin/aarch64-linux-androidkernel-" #aarch64 GCC
9
CROSS_COMPILE_ARM32="$WORKSPACE/arm-linux-androideabi-4.9/bin/arm-linux-androidkernel-" #arm GCC
10
CC_ADDITION_FLAGS="AR=llvm-ar NM=llvm-nm OBJCOPY=llvm-objcopy OBJDUMP=llvm-objdump STRIP=llvm-strip LLVM_IAS=1 LLVM=1 LD=ld.lld"
11
ANYKERNEL_DIR="$WORKSPACE/AnyKernel3" #Location of your prepared AnyKernel3 directory
12

13
THREAD=$(nproc --all)
14

15
args="-j$THREAD O=$OUT_DIR ARCH=$ARCH CROSS_COMPILE=$CROSS_COMPILE CROSS_COMPILE_ARM32=$CROSS_COMPILE_ARM32 CC=$CC CLANG_TRIPLE=$CLANG_TRIPLE $CC_ADDITION_FLAGS"
16

17
### Compile Kernel ###
18
echo "[+]Args: $args"
19
echo "[+}Generate .config"
20
make equuleus_user_defconfig $args #Here 'equuleus_user_defconfig' is the defconfig file for the equuleus kernel. Replace it with your kernel's config file name.
21
echo "[+]Begin Build"
22
make $args
23
### Compilation Complete ###
24

25
### Create AnyKernel3 Zip ###
26
cd $WORKSPACE/sdm845/KernelSU
27
KSU_VERSION='v0.9.5'
28
TARGET_KERNEL="Mi8Pro-LineageKernel-KernelSU$KSU_VERSION" #Kernel filename
29
echo "[+]KernelSU Version: $KSU_VERSION"
30
echo "[+]Target file: $TARGET_KERNEL"
31
cd $WORKSPACE/AnyKernel3
32
cp $WORKSPACE/sdm845/out/arch/arm64/boot/Image .
33
cp $WORKSPACE/sdm845/out/arch/arm64/boot/Image.gz .
34
cp $WORKSPACE/sdm845/out/arch/arm64/boot/Image.gz-dtb .
35
OUTPUT_FILE=${TARGET_KERNEL}-$(date +"%y.%m.%d").zip
36
echo "[+]Output: $OUTPUT_FILE"
37
zip -r $OUTPUT_FILE *
38
mv $OUTPUT_FILE $WORKSPACE