feat(ksu): add KSU_IOCTL_DISABLE_KSU to drop KSU capability per process - #3609
Open
superturtlee wants to merge 1 commit into
Open
feat(ksu): add KSU_IOCTL_DISABLE_KSU to drop KSU capability per process#3609superturtlee wants to merge 1 commit into
superturtlee wants to merge 1 commit into
Conversation
Add KSU_IOCTL_DISABLE_KSU (_IO('K', 22), perm only_root) letting a process irrevocably drop all KSU capabilities for itself and its fork/exec children, via a new per-task thread flag TIF_KSU_DISABLE_KSU (bit 62), mirroring the existing TIF_KSU_DISABLE_ESCAPE_WITH_ROOT mechanism.
Once set: is_manager() always false (blocks manager-uid impersonation); __ksu_is_allow_uid_for_current() always false (blocks GRANT_ROOT and execve-su); ksu_supercall_handle_ioctl() rejects every ioctl with -EPERM unconditionally; reboot_handler_pre() no longer installs a [ksu_driver] fd; ksu_handle_setresuid() skips fd install / seccomp cache so setresuid to the manager appid cannot auto-install an fd.
The flag is fork-inherited via thread_info.flags memcpy and never cleared, so the restriction is permanent for the whole process tree.
Co-Authored-By: Claude <noreply@anthropic.com>
Author
|
this will also cause root with low permission(selinux/seccomp) get ksu context and no secomp |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add KSU_IOCTL_DISABLE_KSU (_IO('K', 22), perm only_root) letting a process irrevocably drop all KSU capabilities for itself and its fork/exec children, via a new per-task thread flag TIF_KSU_DISABLE_KSU (bit 62), mirroring the existing TIF_KSU_DISABLE_ESCAPE_WITH_ROOT mechanism.
It disables supercall in addition to TIF_KSU_DISABLE_ESCAPE_WITH_ROOT. (All the ksu features)
It can help solve some container escape bugs of container software without userns(they use seccomp for isolation) such as Droidspaces(ravindu644/Droidspaces-OSS#257)
Once set: is_manager() always false (blocks manager-uid impersonation); __ksu_is_allow_uid_for_current() always false (blocks GRANT_ROOT and execve-su); ksu_supercall_handle_ioctl() rejects every ioctl with -EPERM unconditionally; reboot_handler_pre() no longer installs a [ksu_driver] fd; ksu_handle_setresuid() skips fd install / seccomp cache so setresuid to the manager appid cannot auto-install an fd.
The flag is fork-inherited via thread_info.flags memcpy and never cleared, so the restriction is permanent for the whole process tree.