kernel, ksud: refactor sucompat

[5ec1cff]

• Execute ksud by opening fd with ksu cred and redirecting to execveat, remove READ_SEARCH capability from effective caps.
• Redirect newfstatat/faccessat's su path to ksud .
• Now sucompat requires /data/adb/ksud to exist in caller's root, so chrooted process won't be affected unexpectedly.
• Remove fallback to sh. User should install manager and open it after first installation to install ksud to enable sucompat after first installation.

[Copilot]

Pull request overview

This PR refactors KernelSU’s sucompat flow in the kernel (centralizing syscall handling and switching su execution to an execveat-based path), while aligning ksud’s userspace install/restorecon labeling to use the KernelSU SELinux file context.

Changes:

• Userspace: relabel /data/adb/ksud to u:object_r:ksu_file:s0 during install and restorecon.
• Kernel: refactor sucompat hooks so handlers perform the original syscall invocation internally (and implement su -> ksud redirection using execveat with AT_EMPTY_PATH).
• Kernel: introduce a ksu_close_fd helper header and adopt it in a couple of call sites to simplify kernel-version conditionals.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
userspace/ksud/src/utils.rs	Updates install-time SELinux relabeling for ksud to use the KernelSU file context.
userspace/ksud/src/restorecon.rs	Renames/updates the SELinux context constant used when labeling the daemon path.
kernel/supercall/supercall.c	Switches fd-close logic to use the new ksu_close_fd helper.
kernel/policy/app_profile.c	Simplifies capability setup by mirroring the profile’s effective caps directly.
kernel/infra/su_mount_ns.c	Switches fd-close logic to use the new ksu_close_fd helper.
kernel/include/util.h	Adds a helper intended to abstract fd closing across kernel versions.
kernel/hook/syscall_event_bridge.c	Routes newfstatat/faccessat through the new sucompat handler entry points.
kernel/feature/sucompat.h	Updates exported handler APIs to accept (orig_nr, pt_regs*) style entry points.
kernel/feature/sucompat.c	Implements the refactored sucompat logic, including su -> ksud redirection via execveat.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.