upstream

.github/workflows/build-manager.yml

@@ -16,14 +16,15 @@ on:
   workflow_call:
 
 jobs:
-  generate-key:
+  prepare:
     runs-on: ubuntu-latest
     outputs:
       expected_size: ${{ steps.extract.outputs.expected_size }}
       expected_hash: ${{ steps.extract.outputs.expected_hash }}
       keystore: ${{ steps.gen.outputs.keystore }}
       keystore_password: ${{ steps.gen.outputs.keystore_password }}
       key_password: ${{ steps.gen.outputs.key_password }}
+      spoofed_package_name: ${{ steps.pkg.outputs.spoofed_package_name }}
     steps:
       - name: Generate temporary keystore
         if: github.event_name == 'pull_request'
@@ -71,12 +72,21 @@ jobs:
           echo "Certificate size: $SIZE_HEX ($SIZE_DEC bytes)"
           echo "Certificate hash: $HASH"
 
+      - name: Generate package name for spoofed manager
+        id: pkg
+        run: |
+          word1=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          word2=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          word3=$(tr -dc 'a-z' </dev/urandom | head -c6)
+          SPOOFED_PACKAGE_NAME="${word1}.${word2}.${word3}"
+          echo "spoofed_package_name=$SPOOFED_PACKAGE_NAME" >> $GITHUB_OUTPUT
+
   build-lkm:
-    needs: generate-key
+    needs: prepare
     uses: ./.github/workflows/build-lkm.yml
     with:
-      expected_pr_build_size: ${{ needs.generate-key.outputs.expected_size || '' }}
-      expected_pr_build_hash: ${{ needs.generate-key.outputs.expected_hash || '' }}
+      expected_pr_build_size: ${{ needs.prepare.outputs.expected_size || '' }}
+      expected_pr_build_hash: ${{ needs.prepare.outputs.expected_hash || '' }}
     secrets: inherit
 
   build-ksuinit:
@@ -86,22 +96,20 @@ jobs:
     needs: [build-lkm, build-ksuinit]
     strategy:
       matrix:
-        include:
-          - target: aarch64-linux-android
-            os: ubuntu-latest
-          - target: x86_64-linux-android
-            os: ubuntu-latest
-          - target: armv7-linux-androideabi
-            os: ubuntu-latest
+        target:
+          - aarch64-linux-android
+          - x86_64-linux-android
+          - armv7-linux-androideabi
+        os: [ubuntu-latest]
     uses: ./.github/workflows/ksud.yml
     with:
       target: ${{ matrix.target }}
       os: ${{ matrix.os }}
 
   build-manager:
-    needs: [generate-key]
+    needs: [prepare]
     runs-on: ubuntu-latest
-    if: always() && needs.generate-key.result == 'success'
+    if: always() && needs.prepare.result == 'success'
     strategy:
       fail-fast: false
       matrix:
@@ -141,12 +149,6 @@ jobs:
             echo "title=Manager" >> $GITHUB_OUTPUT
           fi
 
-      - name: Run randomizer
-        if: ${{ matrix.manager_type == 'spoofed' }}
-        run: |
-          chmod +x randomizer
-          ./randomizer
-
       - name: Write key
         if: ${{ github.event_name == 'workflow_dispatch' || ( github.event_name != 'pull_request') || github.ref_type == 'tag' }}
         run: |
@@ -163,9 +165,9 @@ jobs:
       - name: Write PR key
         if: github.event_name == 'pull_request'
         env:
-          PR_KEYSTORE: ${{ needs.generate-key.outputs.keystore }}
-          PR_KEYSTORE_PASSWORD: ${{ needs.generate-key.outputs.keystore_password }}
-          PR_KEY_PASSWORD: ${{ needs.generate-key.outputs.key_password }}
+          PR_KEYSTORE: ${{ needs.prepare.outputs.keystore }}
+          PR_KEYSTORE_PASSWORD: ${{ needs.prepare.outputs.keystore_password }}
+          PR_KEY_PASSWORD: ${{ needs.prepare.outputs.key_password }}
         run: |
           echo "$PR_KEYSTORE" | base64 -d > pr-key.jks
           {
@@ -184,15 +186,25 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
 
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
-
       - name: Build APK
         run: |
+          export BUILD_EXTRA_ARGS=""
+          if [ "${{ matrix.manager_type }}" == "spoofed" ]; then
+            export KSU_PACKAGE_NAME="${{ needs.prepare.outputs.spoofed_package_name }}"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME -PIS_SPOOFED_BUILD=true"
+          elif [ "${{ github.event_name }}" == "pull_request" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.pr${{github.event.pull_request.number}}"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME"
+          elif [ "${{ github.ref_type }}" != "tag" ] && [ "${{ github.ref_name }}" != "main" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.dev"
+            export KSU_NAME="ReSukiSU-DEV"
+            export BUILD_EXTRA_ARGS="-PKSU_PACKAGE_NAME=$KSU_PACKAGE_NAME -PKSU_NAME=$KSU_NAME"
+          fi
+
           if [ "${{ github.event_name }}" == "pull_request" ]; then
-            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} -PIS_PR_BUILD=true
+            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} -PIS_PR_BUILD=true $BUILD_EXTRA_ARGS
           else
-            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }}
+            ./gradlew assemble${{ matrix.build_type }} -Pcommit=${{ steps.commit.outputs.COMMIT_SHA }} $BUILD_EXTRA_ARGS
           fi
 
       - name: Upload artifact
@@ -212,7 +224,7 @@ jobs:
 
   repack-manager:
     if: always() && needs.build-manager.result == 'success' && needs.build-ksud.result == 'success'
-    needs: [build-manager, build-ksud, generate-key]
+    needs: [build-manager, build-ksud, prepare]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -286,9 +298,9 @@ jobs:
 
       - name: Prepare signing inputs
         env:
-          PR_KEYSTORE: ${{ needs.generate-key.outputs.keystore }}
-          PR_KEYSTORE_PASSWORD: ${{ needs.generate-key.outputs.keystore_password }}
-          PR_KEY_PASSWORD: ${{ needs.generate-key.outputs.key_password }}
+          PR_KEYSTORE: ${{ needs.prepare.outputs.keystore }}
+          PR_KEYSTORE_PASSWORD: ${{ needs.prepare.outputs.keystore_password }}
+          PR_KEY_PASSWORD: ${{ needs.prepare.outputs.key_password }}
           PROD_KEYSTORE: ${{ secrets.KEYSTORE }}
           PROD_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
           PROD_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}

.github/workflows/codeql.yml

@@ -75,9 +75,6 @@ jobs:
           build-scan-publish: false
           cache-read-only: true
 
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
-
       - name: Grant execute permission for gradlew
         run: chmod +x ./gradlew
 

.github/workflows/ksud.yml

@@ -72,6 +72,12 @@ jobs:
 
       - name: Build ksud
         run: |
+          if [ "${{github.event_name}}" == "pull_request" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.pr${{github.event.pull_request.number}}"
+          elif [ "${{github.ref_type}}" != "tag" ] && [ "${{github.ref_name}}" != "main" ]; then
+            export KSU_PACKAGE_NAME="com.resukisu.resukisu.dev"
+          fi
+
           cd userspace/ksud/
           cargo ndk b -P 26 -t ${{ inputs.target }} -r -Z build-std-features="optimize_for_size" -Z trim-paths
 

.github/workflows/lints-check.yml

@@ -123,9 +123,6 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
-
-      - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
 
       - name: Check Manager Lint
         run: |

kernel/Kbuild

@@ -112,6 +112,10 @@ endif
 else
 KERNEL_TYPE := GKI 2.0
 endif
+
+ifneq ($(shell test $(VERSION) -ge 4; echo $$?),0)
+KERNEL_TYPE := Non-GKI (Legacy)
+endif
 $(info -- KERNEL_VERSION: $(KERNEL_VERSION))
 $(info -- KERNEL_TYPE: $(KERNEL_TYPE))
 

kernel/compat/kernel_compat.c

@@ -9,9 +9,11 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
+#include <linux/errno.h>
 
 #include "klog.h" // IWYU pragma: keep
 #include "kernel_compat.h"
+#include "ksu.h"
 
 ssize_t ksu_kernel_read_compat(struct file *p, void *buf, size_t count, loff_t *pos)
 {
@@ -195,42 +197,43 @@ void ksu_run_in_init_if_possible(void (*callback)(void *), void *data)
 #endif
 }
 
-#ifdef KSU_COMPAT_REQUIRE_SESSION_KEYRING
-#include <linux/key.h>
-#include <linux/errno.h>
-#include <linux/cred.h>
-#include "ksu.h"
-
-static inline struct key *ksu_get_session_keyring(const struct cred *cred)
-{
-// https://github.com/torvalds/linux/commit/3a50597de8635cd05133bd12c95681c82fe7b878
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 8, 0)
-    return rcu_dereference(cred->session_keyring);
-#else
-    return rcu_dereference(current->cred->tgcred->session_keyring);
-#endif
-}
-
+struct key *init_session_keyring = NULL;
 extern int install_session_keyring_to_cred(struct cred *, struct key *);
 
-// WARNING! Make sure caller in init!!!
-// https://github.com/torvalds/linux/commit/5c7e372caa35d303e414caeb64ee2243fd3cac3d
-// in our target kernel version, it are protected by rcu, so let's rcu_dereference here
 void setup_ksu_cred_session_keyring(void)
 {
     if (ksu_get_session_keyring(ksu_cred)) {
         // if we have session_keyring, skip
         return;
     }
 
-    if (strcmp(current->comm, "init")) {
-        // we are only interested in `init` process
+    if (init_session_keyring == NULL) {
+        // if init_session_keyring is null, skip
         return;
     }
 
-    install_session_keyring_to_cred(ksu_cred, ksu_get_session_keyring(current_cred()));
+    install_session_keyring_to_cred(ksu_cred, init_session_keyring);
 
     pr_info("kernel_compat: %s: install init_session_keyring to ksu_cred\n", __func__);
 }
 
-#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 9, 0)
+__weak int path_umount(struct path *path, int flags)
+{
+    char buf[256];
+    int ret = -ENOENT;
+
+    char *usermnt = d_path(path, buf, sizeof(buf) - 1);
+    if (IS_ERR(usermnt) || usermnt == buf)
+        goto out;
+
+    mm_segment_t old_fs = get_fs();
+    set_fs(KERNEL_DS);
+    ret = ksu_sys_umount((char __user *)usermnt, flags);
+    set_fs(old_fs);
+
+out: // release ref here! user_path_at increases it then only cleans for itself
+    path_put(path);
+    return ret;
+}
+#endif // < 5.9