Add NO_ROOT, MANAGER and AUTOLOAD_KPM build mode options - #305
Open
Yervant7 wants to merge 9 commits into
Open
Conversation
Introduce a NO_ROOT build mode and OFFICIAL_MANAGER toggle: update CI to produce no-root artifacts and docs to document build flags. Extend kernel/Makefile to add ENABLE_ROOT/ENABLE_OFFICIAL_MANAGER, add CONFIG_KP_NO_ROOT and CONFIG_KP_NO_OFFICIAL_MANAGER compile-time guards, and exclude root/manager sources when disabled. Add stubs and conditional logic across patch sources (android/userd.c, supercall.c, supercmd.c, sucompat.h, accctl.h) to safely build/run without built-in root or official manager. Also add input validation fixes in kstorage.c, include/symbol adjustments, and a one-shot kernel init guard (xchg) to prevent double initialization.
Introduce AUTOLOAD_KPM support: docs updated (en/zh-CN) and Makefile flags (AUTOLOAD_KPM, CONFIG_KP_AUTOLOAD_KPM) to enable compile-time/runtime autoloading. Implement scanning/loading helpers in userd.c (file_exists_privileged, scan_and_load_kpm_dir), support both flat and directory KPM layouts, disable markers, and autoload_kpm_modules guarded by CONFIG_KP_AUTOLOAD_KPM. Adjust initialization to trigger autoload on first app/process exec paths. Refactor trusted-manager and root-only code with proper CONFIG_KP_NO_OFFICIAL_MANAGER / CONFIG_KP_NO_ROOT guards, add unhook_bypass_selinux, and update headers and prototypes accordingly.
Author
|
global_pkg_pos was removed, is that okay? |
Yervant7
changed the title
This change fixes the KPM autoload flow by guarding privileged directory access, ensuring post-fs-data detection runs only once, and avoiding the disabled-directory false-positive path. It also corrects the write_op symbol cast in selinux_hide so the hook resolves cleanly on modern builds.
Normalize the /data/adb paths used by the Android user daemon and avoid duplicate KPM autoload attempts. The autoload logic now uses atomic xchg guards and only treats positive return codes as successful module loads, preventing redundant scans and incorrect loaded-state tracking. The mounted /data check was also clarified to account for the adb directory layout.
Update the Android no-root build job to compile kpimg with AUTOLOAD_KPM=1. This ensures the generated artifact includes KPM auto-loading support, matching the intended runtime behavior for Android no root builds.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The global KPM disable marker path is built incorrectly ("%sdisable"), which prevents detection of the intended <kpm_dir>/disable file and breaks the disable mechanism.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds new build-mode toggles to support producing “no-root” artifacts while optionally keeping official manager package monitoring and/or enabling automatic KPM autoloading. This is implemented via new Makefile flags, compile-time guards/stubs, and small runtime guards to keep one-shot lifecycle events and init behaviors safe across varying vendor kernels.
Changes:
- Introduce build flags/macros for NO_ROOT, OFFICIAL_MANAGER (manager enable/disable), and AUTOLOAD_KPM, and update CI + docs accordingly.
- Add compile-time guards and stub implementations so the patch can build/run without built-in root and/or without official manager logic.
- Improve robustness: add kstorage input validation and a one-shot guard around kernel init lifecycle events.
File summaries
| File | Description |
|---|---|
| kernel/patch/patch.c | Adds an SMP-safe one-shot guard (xchg) for pre/post kernel init events; gates su compat init when NO_ROOT. |
| kernel/patch/include/userd.h | Adds optional declaration for KPM autoload; hides trusted-manager UID getter when official manager is disabled. |
| kernel/patch/include/sucompat.h | Adds NO_ROOT stubs returning -ENOSYS for root-related APIs; exports errno for stub returns. |
| kernel/patch/include/accctl.h | Adds NO_ROOT stubs for su/accctl APIs; adds conditional unhook API for bypass_selinux. |
| kernel/patch/common/supercmd.c | Avoids Android-only trusted-manager checks when not building for Android. |
| kernel/patch/common/supercall.c | Moves Android-only calls out of root-only sections; adds NO_ROOT behavior gates and exports is_su_allow_uid. |
| kernel/patch/common/selinux_hide.c | Adds explicit cast for resolved function pointer lookup result. |
| kernel/patch/common/kstorage.c | Adds offset/len validation for read/write paths. |
| kernel/patch/common/accctl.c | Gates root-only su helpers; adjusts SELinux bypass logic for NO_ROOT; adds optional unhook for “no root + no manager” mode. |
| kernel/patch/android/userd.c | Adds KPM directory scanning improvements, optional autoload logic, and conditional official-manager/root behaviors. |
| kernel/Makefile | Adds build-time toggles and source exclusion logic for NO_ROOT / manager / autoload features. |
| doc/zh-CN/build.md | Documents new build flags and example build invocations. |
| doc/en/build.md | Documents new build flags and example build invocations. |
| .github/workflows/build.yml | Produces an additional android no-root artifact in CI. |
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce a NO_ROOT build mode and OFFICIAL_MANAGER toggle: update CI to produce no-root artifacts and docs to document build flags. Extend kernel/Makefile to add ENABLE_ROOT/ENABLE_OFFICIAL_MANAGER, add CONFIG_KP_NO_ROOT and CONFIG_KP_NO_OFFICIAL_MANAGER compile-time guards, and exclude root/manager sources when disabled. Add stubs and conditional logic across patch sources (android/userd.c, supercall.c, supercmd.c, sucompat.h, accctl.h) to safely build/run without built-in root or official manager. Also add input validation fixes in kstorage.c, include/symbol adjustments, and a one-shot kernel init guard (xchg) to prevent double/multiple initialization.