From 4729ec056ffe7d819df2db3b9338d431d268896f Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 21:45:40 +0000 Subject: [PATCH] lkm: guard avc_has_perm patches behind selinux_state readback Only patch avc_has_perm/avc_has_perm_noaudit when the WRITE_ONCE to selinux_state was a no-op (CONFIG_SECURITY_SELINUX_DEVELOP=n kernels). On kernels where the write takes effect, unconditionally patching these functions leaves SELinux enforcement silently bypassed after KernelSU restores enforce=1, which root detection tools can fingerprint. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01WeRC3qhtCwaNW2CCE9V4p4 --- lkm/dfroot.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/lkm/dfroot.c b/lkm/dfroot.c index 4c388792..facb9685 100644 --- a/lkm/dfroot.c +++ b/lkm/dfroot.c @@ -106,20 +106,22 @@ static int __nocfi __init dfroot_init(void) // Some kernels ship CONFIG_SECURITY_SELINUX_DEVELOP=n, so the selinux_state // write above is a no-op there — patch the SELinux checks themselves instead // (both: most denials surface through the noaudit path first). - avc_fn = (void *)get_addr("avc_has_perm"); - if (!avc_fn) - pr_err("dfroot: avc_has_perm not found, skipping\n"); - else { - patch_fn_ret_zero(avc_fn); - pr_info("dfroot: avc_has_perm patched\n"); - } - - avc_noaudit_fn = (void *)get_addr("avc_has_perm_noaudit"); - if (!avc_noaudit_fn) - pr_err("dfroot: avc_has_perm_noaudit not found, skipping\n"); - else { - patch_fn_ret_zero(avc_noaudit_fn); - pr_info("dfroot: avc_has_perm_noaudit patched\n"); + if (READ_ONCE(*selinux_state)) { + avc_fn = (void *)get_addr("avc_has_perm"); + if (!avc_fn) + pr_err("dfroot: avc_has_perm not found, skipping\n"); + else { + patch_fn_ret_zero(avc_fn); + pr_info("dfroot: avc_has_perm patched\n"); + } + + avc_noaudit_fn = (void *)get_addr("avc_has_perm_noaudit"); + if (!avc_noaudit_fn) + pr_err("dfroot: avc_has_perm_noaudit not found, skipping\n"); + else { + patch_fn_ret_zero(avc_noaudit_fn); + pr_info("dfroot: avc_has_perm_noaudit patched\n"); + } } // Oppo/OnePlus