Skip to content

kernel: bump app profile version, migrate selinux domain #3363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aviraxp merged 3 commits into from
Mar 30, 2026
Merged

kernel: bump app profile version, migrate selinux domain #3363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d07c9d2
kernel: bump app profile version, migrate selinux domain
5ec1cff Mar 29, 2026
822449a
more check
5ec1cff Mar 29, 2026
e4f9809
group_count s32 -> u32
5ec1cff Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 25 additions & 5 deletions kernel/policy/allowlist.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,22 +131,42 @@ static bool profile_valid(struct app_profile *profile)
return false;
}

bool need_migrate_su_domain = false;

if (unlikely(profile->version == 2)) {
profile->version = KSU_APP_PROFILE_VER;
need_migrate_su_domain = true;
}

if (strnlen(profile->key, sizeof(profile->key)) >= sizeof(profile->key)) {
pr_err("invalid app_profile key\n");
return false;
}

if (profile->version < KSU_APP_PROFILE_VER) {
Comment thread
5ec1cff marked this conversation as resolved.
pr_info("Unsupported profile version: %d\n", profile->version);
return false;
}

if (profile->allow_su) {
#ifndef CONFIG_KSU_DISABLE_POLICY
if (profile->rp_config.use_default) {
return true;
}

if (profile->rp_config.profile.groups_count > KSU_MAX_GROUPS) {
Comment thread
5ec1cff marked this conversation as resolved.
pr_err("invalid groups_count in app_profile: %s\n", profile->key);
return false;
}
Comment thread
5ec1cff marked this conversation as resolved.

if (strlen(profile->rp_config.profile.selinux_domain) == 0) {
char *domain = profile->rp_config.profile.selinux_domain;
static const size_t domain_len = sizeof(profile->rp_config.profile.selinux_domain);
if (unlikely(need_migrate_su_domain)) {
if (strncmp(domain, "u:r:su:s0", domain_len) == 0) {
strscpy_pad(domain, KSU_DEFAULT_SELINUX_DOMAIN, domain_len);
pr_info("migrated profile domain: %s\n", profile->key);
}
}
size_t len = strnlen(domain, domain_len);

if (len == 0 || len >= domain_len) {
pr_err("invalid selinux_domain in app_profile: %s\n", profile->key);
return false;
}
#endif
Expand Down
4 changes: 2 additions & 2 deletions uapi/app_profile.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

#include <linux/types.h>

#define KSU_APP_PROFILE_VER 2
#define KSU_APP_PROFILE_VER 3
#define KSU_MAX_PACKAGE_NAME 256
/* NGROUPS_MAX for Linux is 65535 generally, but we only supports 32 groups. */
#define KSU_MAX_GROUPS 32
Expand All @@ -13,7 +13,7 @@ struct root_profile {
__s32 uid;
__s32 gid;

__s32 groups_count;
__u32 groups_count;
__s32 groups[KSU_MAX_GROUPS];

/* kernel_cap_t is u32[2] for capabilities v3 */
Expand Down