Repository navigation
lkm: guard avc_has_perm patches behind selinux_state readback - #172
Merged
Merged
Conversation
Only patch avc_has_perm/avc_has_perm_noaudit when the WRITE_ONCE to selinux_state was a no-op (CONFIG_SECURITY_SELINUX_DEVELOP=n kernels). On kernels where the write takes effect, unconditionally patching these functions leaves SELinux enforcement silently bypassed after KernelSU restores enforce=1, which root detection tools can fingerprint. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WeRC3qhtCwaNW2CCE9V4p4
mitschud
added a commit
to mitschud/DirtyFrag
that referenced
this pull request
Oct 31, 2026
The tracked modules were the last 1.16-era binaries in the tree. The replacements come from the build-lkms artifacts of run 41225580416 - the merge of zero-androidx, so the same source now on master - and went into app/src/main/jni/ko/ the way d9c8861 did for 1.16. Building them here is not possible: the ghcr.io/ylarod/ddk-min images need a container runtime this machine does not have. Checked per module, old against new: - .note.gnu.build-id is present in all eight new ones and in none of the old ones (readelf -n). The old copies predate fa7380b dropping the second llvm-objcopy pass in the workflow, and a module with no build-id is exactly what fails to load on the Galaxy A34 - the committed binaries were carrying a loading regression the 1.16 notes claimed was fixed. - avc_has_perm and avc_has_perm_noaudit now appear in them, the SELinux fallback from upstream diabl0w#172. The old android15-6.6 copy names neither. - vermagic unchanged per KMI: 5.10.252-dirty, 5.10.245, 5.15.202-android13-5.15.202_r00-dirty, 5.15.202-dirty, 6.1.166-dirty, 6.6.127-4k-g46a034eca005-dirty, 6.12.76-4k and 6.18.32-4k-g47cc22554442-dirty. Same DDK images, same toolchain. - Sizes: 13976 -> 14496, 12904 -> 13032, 13144 -> 13504, 13144 -> 13504, 9880 -> 10112, 10328 -> 10560, 11024 -> 11032, 10792 -> 11040. Verified by building :app:assembleRelease over the refreshed tree and taking libdfroot.so back out of the APK: all eight committed files sit inside it byte for byte, at 0x1480 through 0x16560, 97,280 of the 124,136 bytes in that .so. That is how the modules ship - the .incbin block in exp.c - so there are no ko/ entries in an APK to look at, and strings on the .so finds eight vermagic lines. CHANGELOG: the item moves out of "Before the tag is cut" into what 1.17 actually did, and the refresh recipe is written down. The only thing still gating the tag is the D2 / Odin writer.
yonggamer
pushed a commit
to yonggamer/DirtyFrag
that referenced
this pull request
Nov 1, 2026
Brings in the eight upstream commits between our 1.16 merge base (d3cd07a) and the v4.7 tag - six of substance, plus two version bumps that resolve to our own: - 6179d57 "Bug fixes and simplification" (mitschud#139). patch_fn_ret_zero no longer decodes a BTI/PACIASP/PACIBSP preamble and no longer picks retaa/retab per SoC: it unconditionally writes three words - BTI C, MOV x0,#0, RET - which is a valid landing pad whether or not BTI is enforced, and RET is correct because we are replacing the whole prologue, not branching into the middle of one. In bootstrap.c the fork() that rewrote /proc/self/attr/current to u:r:init:s0 is gone; the LKM now writes that context through echo -n 'u:r:init:s0' > /proc/self/attr/exec inside the usermodehelper command, so the context switch happens at the exec instead of in a child we then wait on. - 0fed9a8 "Fix kernel compatibility". - 452191a "Fix oppo devices": the section diet moves from an llvm-objcopy pass to the compiler (-Qn -fno-addrsig), and the root Makefile drops its objcopy pass. - ae2ed2b guards the new avc_has_perm / avc_has_perm_noaudit patches behind a readback of selinux_state, for kernels built with CONFIG_SECURITY_SELINUX_DEVELOP=n where writing selinux_state is a no-op (diabl0w#172). - 779b3be makes ExploitRunner stop with an actionable message when persist.log.tag starts with S - Developer Options "Log buffer size = Off" leaves the exploit blind to its own logcat output (diabl0w#173). - 4ec133c adds the GPL-2.0 LICENSE file the upstream maintainer asked for, which lands here too: this fork is GPLv2 from this commit on. Conflict resolutions: - app/build.gradle.kts: keep DirtyFrag versioning rather than upstream's 407 / "4.7" - now versionCode 34, versionName 1.17. - .gitignore: keep our app/keystore.jks, *.log and apk/ and take upstream's .DS_Store. Nothing else conflicted. exp.c carries only fork work and upstream never touched it; bootstrap.c, lkm/dfroot.c and ExploitRunner.java had no fork-side edits after the 1.16 merge, so upstream's versions apply cleanly on top of them. The eight tracked app/src/main/jni/ko/dfroot-<KMI>.ko are deliberately NOT refreshed in this merge: they are still built from the 1.16 (upstream 4.5) tree. Rebuilding them needs the ghcr.io/ylarod/ddk-min containers that the LKM Makefile and the build-lkms CI job drive, and this box has no container runtime. CI rebuilds all eight from source on every push and downloads them into jni/ko/ before the APK is assembled, so a CI-built 1.17 APK does contain the avc, oppo and kernel-compat fixes. Only a locally built 1.17 APK would still ship the 1.16 modules, and the tracked copies should be refreshed from the build-lkms artifacts before the 1.17 tag, the way d9c8861 did for 1.16. minSdk stays 32 - upstream did not change it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Only patch avc_has_perm/avc_has_perm_noaudit when the WRITE_ONCE to selinux_state was a no-op (CONFIG_SECURITY_SELINUX_DEVELOP=n kernels). On kernels where the write takes effect, unconditionally patching these functions leaves SELinux enforcement silently bypassed after KernelSU restores enforce=1, which root detection tools can fingerprint.