kernel: merge TIF_KSU_DISABLE_KSU into TIF_KSU_DISABLE_ESCAPE_WITH_ROOT - #10
Merged
Conversation
DISABLE_KSU (ioctl 22) had no userspace callers anywhere, while DISABLE_ESCAPE_TO_ROOT (ioctl 21) is already wired up: ksud calls it for --ksu-no-new-privs, and container runtimes (Droidspaces) call it in the container init before applying their seccomp filter. Merge the two thread flags so ioctl 21 becomes the single full kill switch: once set (fork-inherited via thread_info.flags, irreversible), escape_with_ root_profile() aborts, is_manager()/is_allow_uid() are always false, every supercall ioctl returns -EPERM, the reboot magic fd-install is skipped, and setresuid no longer installs/caches anything. This closes the container setresuid fd-injection path for process trees that already declared "disable escape": they can no longer receive the [ksu_driver] fd via the manager-uid setresuid injection, nor get __NR_reboot punched into their seccomp allow-cache by that hook. KSU_IOCTL_DISABLE_KSU (cmd 22), do_disable_ksu() and the TIF_KSU_DISABLE_KSU bit assignments (61/29) are removed. No userspace code referenced them. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DISABLE_KSU (ioctl 22) had no userspace callers anywhere, while DISABLE_ESCAPE_TO_ROOT (ioctl 21) is already wired up: ksud calls it for --ksu-no-new-privs, and container runtimes (Droidspaces) call it in the container init before applying their seccomp filter. Merge the two thread flags so ioctl 21 becomes the single full kill switch: once set (fork-inherited via thread_info.flags, irreversible), escape_with_ root_profile() aborts, is_manager()/is_allow_uid() are always false, every supercall ioctl returns -EPERM, the reboot magic fd-install is skipped, and setresuid no longer installs/caches anything.
This closes the container setresuid fd-injection path for process trees that already declared "disable escape": they can no longer receive the [ksu_driver] fd via the manager-uid setresuid injection, nor get __NR_reboot punched into their seccomp allow-cache by that hook.
KSU_IOCTL_DISABLE_KSU (cmd 22), do_disable_ksu() and the TIF_KSU_DISABLE_KSU bit assignments (61/29) are removed. No userspace code referenced them.