implement userspace

Author: 5ec1cff

kernel/core/init.c

@@ -140,7 +140,7 @@ int __init kernelsu_init(void)
         // with KSU SELinux domain before enforcing SELinux, so it
         // can continue to access /data/app etc. after enforcement.
         escape_to_root_for_init();
-        ksu_process_tag_set(current, PROCESS_TAG_KSUD, "late_load");
+        ksu_process_tag_set(current, PROCESS_TAG_KSUD, "");
 
         ksu_allowlist_init();
         ksu_load_allow_list();

kernel/feature/process_tag.c

@@ -256,6 +256,9 @@ static int process_tag_feature_set(u64 value)
     process_tag_lsm_hooked = true;
     pr_info("process_tag: initialized and enabled\n");
 
+    // mark the feature setter as ksud
+    ksu_process_tag_set(current, PROCESS_TAG_KSUD, "");
+
     return 0;
 }
 

kernel/feature/process_tag.h

@@ -6,13 +6,7 @@
 #include <linux/rcupdate.h>
 #include <linux/types.h>
 
-enum process_tag_type {
-    PROCESS_TAG_NONE = 0,
-    PROCESS_TAG_KSUD = 1,
-    PROCESS_TAG_APP = 2,
-    PROCESS_TAG_MODULE = 3,
-    PROCESS_TAG_MANAGER = 4,
-};
+#include "uapi/process_tag.h"
 
 struct process_tag {
     enum process_tag_type type;

uapi/ksu.h

@@ -6,5 +6,6 @@
 #include "uapi/feature.h"
 #include "uapi/selinux.h"
 #include "uapi/sulog.h"
+#include "uapi/process_tag.h"
 
 #endif // __KSU_UAPI_KSU_H

uapi/process_tag.h

@@ -0,0 +1,14 @@
+#ifndef __KSU_UAPI_PROCESS_TAG_H
+#define __KSU_UAPI_PROCESS_TAG_H
+
+#include <linux/types.h>
+
+enum process_tag_type : __u8 {
+    PROCESS_TAG_NONE = 0,
+    PROCESS_TAG_KSUD = 1,
+    PROCESS_TAG_APP = 2,
+    PROCESS_TAG_MODULE = 3,
+    PROCESS_TAG_MANAGER = 4,
+};
+
+#endif

uapi/supercall.h

@@ -110,13 +110,13 @@ struct ksu_get_wrapper_fd_cmd {
 };
 
 struct ksu_set_process_tag_cmd {
-    __u8 type; /* Input: process_tag_type */
+    __u8 type; /* Input: enum process_tag_type */
     char name[64]; /* Input: tag name (module name / package name) */
 };
 
 struct ksu_get_process_tag_cmd {
     __u32 pid; /* Input: target process pid */
-    __u8 type; /* Output: process_tag_type, PROCESS_TAG_NONE if no tag */
+    __u8 type; /* Output: enum process_tag_type, PROCESS_TAG_NONE if no tag */
     char name[64]; /* Output: tag name */
 };
 

userspace/ksud/src/cli.rs

@@ -214,6 +214,12 @@ enum Debug {
 
     /// Launch sulogd daemon manually
     Sulogd,
+
+    /// Process tag management
+    Tag {
+        #[command(subcommand)]
+        command: ProcessTagCommand,
+    }
 }
 
 #[derive(clap::Subcommand, Debug)]
@@ -243,6 +249,16 @@ enum MarkCommand {
     Refresh,
 }
 
+
+#[derive(clap::Subcommand, Debug)]
+enum ProcessTagCommand {
+    /// Get mark status for a process
+    Get {
+        /// target pid (0 for total count)
+        pid: u32,
+    }
+}
+
 #[derive(clap::Subcommand, Debug)]
 enum Sepolicy {
     /// Patch sepolicy
@@ -700,6 +716,9 @@ pub fn run() -> Result<()> {
                 MarkCommand::Refresh => debug::mark_refresh(),
             },
             Debug::Sulogd => sulog::ensure_sulogd_running(),
+            Debug::Tag { command } => match command {
+                ProcessTagCommand::Get { pid } => debug::get_tag(pid),
+            }
         },
 
         Commands::BootPatch(boot_patch) => crate::boot_patch::patch(boot_patch),

userspace/ksud/src/debug.rs

@@ -6,7 +6,7 @@ use std::{
     process::Command,
 };
 
-use crate::ksucalls;
+use crate::{ksu_uapi, ksucalls};
 
 const KERNEL_PARAM_PATH: &str = "/sys/module/kernelsu";
 
@@ -107,3 +107,20 @@ pub fn mark_refresh() -> Result<()> {
     println!("Refreshed mark for all running processes");
     Ok(())
 }
+
+pub fn get_tag(pid: u32) -> Result<()> {
+    let tag = ksucalls::get_process_tag(pid)?;
+    
+    let tag_type = match tag.tag_type {
+        ksu_uapi::process_tag_type_PROCESS_TAG_NONE => "none".to_owned(),
+        ksu_uapi::process_tag_type_PROCESS_TAG_APP => "app".to_owned(),
+        ksu_uapi::process_tag_type_PROCESS_TAG_KSUD => "ksud".to_owned(),
+        ksu_uapi::process_tag_type_PROCESS_TAG_MODULE => "module".to_owned(),
+        ksu_uapi::process_tag_type_PROCESS_TAG_MANAGER => "manager".to_owned(),
+        _ => format!("{}", tag.tag_type),
+    };
+
+    println!("pid: {pid} type={tag_type} name={}", tag.name);
+
+    Ok(())
+}

userspace/ksud/src/feature.rs

@@ -20,6 +20,7 @@ pub enum FeatureId {
     KernelUmount = 1,
     Sulog = 2,
     AdbRoot = 3,
+    ProcessTag = 4,
 }
 
 impl FeatureId {
@@ -29,6 +30,7 @@ impl FeatureId {
             1 => Some(Self::KernelUmount),
             2 => Some(Self::Sulog),
             3 => Some(Self::AdbRoot),
+            4 => Some(Self::ProcessTag),
             _ => None,
         }
     }
@@ -39,6 +41,7 @@ impl FeatureId {
             Self::KernelUmount => "kernel_umount",
             Self::Sulog => "sulog",
             Self::AdbRoot => "adb_root",
+            Self::ProcessTag => "process_tag",
         }
     }
 
@@ -54,6 +57,7 @@ impl FeatureId {
                 "SU Log - streams kernel sulog events to userspace and persists them to disk"
             }
             Self::AdbRoot => "ADB Root - Enable adbd root",
+            Self::ProcessTag => "Process Tag - Tagging process for audit",
         }
     }
 }
@@ -64,6 +68,7 @@ fn parse_feature_id(name: &str) -> Result<FeatureId> {
         "kernel_umount" | "1" => Ok(FeatureId::KernelUmount),
         "sulog" | "2" => Ok(FeatureId::Sulog),
         "adb_root" | "3" => Ok(FeatureId::AdbRoot),
+        "process_tag" | "4" => Ok(FeatureId::ProcessTag),
         _ => bail!("Unknown feature: {name}"),
     }
 }

userspace/ksud/src/ksucalls.rs

@@ -249,3 +249,39 @@ pub fn set_init_pgrp() -> std::io::Result<()> {
     )?;
     Ok(())
 }
+
+pub fn set_module_tag(tag: &str) -> std::io::Result<()> {
+    let mut cmd = ksu_uapi::ksu_set_process_tag_cmd {
+        type_: ksu_uapi::process_tag_type_PROCESS_TAG_MODULE,
+        name: [0; 64]
+    };
+    let bytes = tag.as_bytes();
+    let len = bytes.len().max(63);
+    cmd.name[..len].copy_from_slice(&bytes[..len]);
+    ksuctl(
+        ksu_uapi::KSU_IOCTL_SET_PROCESS_TAG,
+        &raw mut cmd,
+    )?;
+    Ok(())
+}
+
+pub struct ProcessTag {
+    pub tag_type: u8,
+    pub name: String,
+}
+
+pub fn get_process_tag(pid: u32) -> anyhow::Result<ProcessTag> {
+    let mut cmd = ksu_uapi::ksu_get_process_tag_cmd {
+        pid,
+        type_: ksu_uapi::process_tag_type_PROCESS_TAG_NONE,
+        name: [0; 64]
+    };
+    ksuctl(
+        ksu_uapi::KSU_IOCTL_GET_PROCESS_TAG,
+        &raw mut cmd,
+    )?;
+    Ok(ProcessTag {
+        tag_type: cmd.type_,
+        name: std::ffi::CString::new(cmd.name)?.into_string()?
+    })
+}