kernel: core_hook: automate and refactor umount #2531
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
yes it is incomplete, it doesnt have sys_mount kprobe hook for LKM, but I cant really test this. |
backslashxx
force-pushed
the
umount-1
branch
2 times, most recently
from
f9156b0 to
e38a41f
Compare
backslashxx
changed the title
|
What is the root cause of #2386 (comment), and how does it fix the issue? |
That I don't really have an idea, I suspect it has something to do with mount order and then unmount order.
maybe need to follow if its not that, then maybe it has something to do with the use of fsopen + move_mount. |
backslashxx
force-pushed
the
umount-1
branch
4 times, most recently
from
0825348 to
94b6be6
Compare
cherry pick from `Add fallback to mount syscall (tiann#1349)` upstream: tiann@abf0dac Signed-off-by: backslashxx <[email protected]>
[ 12.751262] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: bin [ 12.754232] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: etc [ 12.760778] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: etc [ 12.767372] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: app [ 12.770883] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: media [ 12.773800] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: overlay [ 12.779962] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: app [ 12.783207] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: priv-app [ 12.790585] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: bin [ 12.794018] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: etc [ 12.796985] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: firmware [ 12.799988] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: lib [ 12.803699] KernelSU: security_sb_mount: devicename pattern fstype: overlay path: lib64 [ 25.033029] KernelSU: umount lib64 failed: -22 [ 25.033032] KernelSU: umount lib failed: -22 [ 25.033033] KernelSU: umount firmware failed: -22 [ 25.033034] KernelSU: umount etc failed: -22 [ 25.033035] KernelSU: umount bin failed: -22 [ 25.033036] KernelSU: umount priv-app failed: -22 [ 25.033037] KernelSU: umount app failed: -22 [ 25.033038] KernelSU: umount overlay failed: -22 [ 25.033039] KernelSU: umount media failed: -22 [ 25.033040] KernelSU: umount app failed: -22 [ 25.033041] KernelSU: umount etc failed: -22 [ 25.033043] KernelSU: umount etc failed: -22 [ 25.033043] KernelSU: umount bin failed: -22 Revert "Update core_hook.c" This reverts commit d93f20526cef320996c86e038ea308d74d1e563e. Update core_hook.c
DNM: debugging core_hook: ksu_umount_mnt: tweak Update core_hook.c Update core_hook.c Update core_hook.c
we just de-struct the damn thing anyway. and with this we can also probably reuse the function for hooking sys_mount or security_move_mount eventually
automate this if tiann#2510 ever happens check dirname
backslashxx
force-pushed
the
umount-1
branch
4 times, most recently
from
ad02d1b to
dbe3881
Compare
TheSakshamSingla
approved these changes
Mar 29, 2025
aviraxp
reviewed
Mar 29, 2025
aviraxp
reviewed
Mar 29, 2025
backslashxx
force-pushed
the
umount-1
branch
2 times, most recently
from
fefc2e6 to
094a7ff
Compare
backslashxx
force-pushed
the
umount-1
branch
5 times, most recently
from
b992e8e to
594d366
Compare
/** * d_path - return the path of a dentry * @path: path to report * @buf: buffer to return value in * @buflen: buffer length * * Convert a dentry into an ASCII path name. If the entry has been deleted * the string " (deleted)" is appended. Note that this is ambiguous. * * Returns a pointer into the buffer or an error code if the path was * too long. Note: Callers should use the returned pointer, not the passed * in buffer, to use the name! The implementation often starts at an offset * into the buffer, and may leave 0 bytes at the start. * * "buflen" should be positive. */
backslashxx
force-pushed
the
umount-1
branch
6 times, most recently
from
1705016 to
3d4254f
Compare
backslashxx
force-pushed
the
umount-1
branch
2 times, most recently
from
809c623 to
fba601e
Compare
|
I'm not really sure on the kprobe hook |
I cant test this, but this is how it goes right?
this assumes that workdir starts with /dev/workdir
This reverts commit 70e230f.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
monitors and lists all incoming mounts by hooking security_sb_mount or alternatively, sys_mount / do_mount.
this requires ksud to go back and use sys_mount instead of fsopen + move_mount
this also fixes that MNT_DETACH issue. (#2386 (comment))
Modules also can create an overlay with KSU devname and it will be added to the list.
This will also restore pre 5.2 manager support.
Those might be a bit questionable, so it is a take it or reject it kind of situation.
sys_mount hook looks like
ref: backslashxx/mojito_krenol@ac020b0
sys_mount / do_mount compatibility is for LKM and 6.8+ where you cant just do LSM hooks as is.
torvalds/linux@9285c5a#diff-3b35df76d1c4627ed97cc307a957850d57b85e77917c19ac0813286c46b4ace2R556
Context: aviraxp@c7facef#commitcomment-153941502