process tagging bullshit

for: tiann#3378

https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h
https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h

Author: backslashxx

kernel/feature/sucompat.c

@@ -66,11 +66,15 @@ static __always_inline bool is_su_allowed(const void **ptr_to_check)
 	if (likely(!!current->seccomp.mode))
 		return false;
 
+	if (test_thread_flag(TIF_KSU_MANAGED))
+		goto skip_uid_check;
+
 	// with seccomp check above, we can make this neutral
 	kuid_t current_uid = current_uid();
 	if (!ksu_is_allow_uid_for_current( ksu_get_uid_t(current_uid) ))
 		return false;
 
+skip_uid_check:
 	// first check the pointer-to-pointer
 	if (unlikely(!ptr_to_check))
 		return false;

kernel/hook/core_hook.c

@@ -63,11 +63,13 @@ LSM_HANDLER_TYPE ksu_handle_setuid(struct cred *new, const struct cred *old)
 		disable_seccomp();
 		pr_info("install fd for: %d\n", new_uid);
 		ksu_install_fd();
+		set_thread_flag(TIF_KSU_MANAGED);
 		return 0;
 	}
 
 	if (unlikely(ksu_is_allow_uid_for_current(new_uid))) {
 		disable_seccomp();
+		set_thread_flag(TIF_KSU_MANAGED);
 		return 0;
 	}
 
@@ -81,6 +83,9 @@ LSM_HANDLER_TYPE ksu_bprm_check(struct linux_binprm *bprm)
 		ksu_sulog_emit_bprm((const char *)bprm->filename);
 #endif
 
+	if (unlikely(test_thread_flag(TIF_KSU_MANAGED)))
+		pr_info("%s: ksu managed task found with pid: %d comm: %s \n", __func__, current->pid, current->comm);
+
 	if (likely(!ksu_execveat_hook))
 		return 0;
 

kernel/kernel_compat.h

@@ -278,4 +278,19 @@ static inline u64 ksu_ktime_get_ns(void) { return ktime_to_ns(ktime_get()); }
 
 static inline void ksu_kfree_byref(void *buf) { kfree(*(void **)buf); }
 
+// its free real estate, this is ulong so wordsize.
+// https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h
+// https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h
+#if defined(CONFIG_64BIT)
+#define TIF_KSU_MANAGED		60
+#define TIF_KSU_RESERVED_61	61
+#define TIF_KSU_RESERVED_62	62
+#define TIF_KSU_RESERVED_63	63
+#else
+#define TIF_KSU_MANAGED		28
+#define TIF_KSU_RESERVED_29	29
+#define TIF_KSU_RESERVED_30	30
+#define TIF_KSU_RESERVED_31	31
+#endif
+
 #endif