ApexSU is a security-focused Android root management project based on KernelSU, with a Rust-first userspace, stricter kernel ABI checks, safer module handling, and audit-focused release practices.
ApexSU targets transparent, maintainable, device-owner root management. The project prioritizes kernel safety, explicit authorization checks, and verifiable build/test evidence over stealth claims.
- Latest builds and assets: GitHub Releases
- Release artifacts include APK and per-KMI
kernelsu.kovariants.
- Kernel-integrated root management for Android.
- A KernelSU-derived codebase with ApexSU-specific hardening and tooling.
- A mixed C (kernel) + Rust (userspace tooling/daemon) + Kotlin (manager UI) architecture.
- Not a banking/anti-cheat/DRM bypass project.
- Not a stealth/evasion framework.
- Not a malware or unauthorized-access tool.
- Not release-ready.
- Kernel hardening is in progress.
- Android/GKI target build evidence is still required.
- KUnit and runtime stress verification are not yet complete.
- Closed tester rollout is not open by default.
kernel/: privileged kernel logic, hooks, policy enforcement, ioctl handling.userspace/ksud: Rust daemon and policy/module processing.userspace/ksuinit: boot handoff/init path helpers.manager/: Android manager app and JNI bridge.
- Fail-closed checks for manager identity and privileged operations.
- Strict input validation for ABI-facing structures and module metadata.
- Security-sensitive behavior is documented and tested where feasible.
ABI contracts are defined in kernel headers and mirrored in Rust:
- Kernel ioctl structures and command IDs must remain layout-compatible.
kernel/rust/abi_checkerprovides host-side ABI parity tests.
The manager app is the user-facing control plane for root policy decisions, diagnostics, and operational visibility. Kernel enforcement remains in kernel/userspace backends.
Module handling is supported with explicit validation. Invalid ZIP entries (for example symlink/special-file abuse paths) are rejected during validation.
ApexSU includes diagnostic paths in userspace and manager flows to aid reproducible bug reporting and recovery-oriented testing.
Compatibility claims are conservative:
- No claim of WSA/ChromeOS/container support without build + smoke evidence.
- No claim of real-device support without verified target-device testing.
See kernel/docs/BUILD_VERIFICATION.md. Host builds are weak evidence; Android/GKI target builds are required for strong kernel verification.
Current matrix includes Rust unit tests and ABI checker tests. Remaining blockers include target-kernel module builds and runtime stress/KUnit execution evidence.
- Complete kernel hardening review cycle.
- Expand target-kernel validation and stress testing.
- Improve CI/release gating and documentation accuracy.
See CONTRIBUTING.md. Keep changes scoped, include verification commands, and avoid unrelated refactors in security patches.
See SECURITY.md. Do not report vulnerabilities in public issues.
ApexSU builds on the KernelSU project. We retain attribution to upstream KernelSU where applicable while developing ApexSU-specific hardening, tooling, and documentation.
GPL-2.0. See LICENSE.