Skip to content

[WIP] feat(kernel): Control shared mount propagation during boot - #949

Draft
HSSkyBoy wants to merge 1 commit into
SukiSU-Ultra:mainfrom
HSSkyBoy:mount_propagation
Draft

HSSkyBoy wants to merge 1 commit into
SukiSU-Ultra:mainfrom
HSSkyBoy:mount_propagation

Conversation

@HSSkyBoy

@HSSkyBoy HSSkyBoy commented Aug 27, 2026 •

Copy link
Copy Markdown
Member

Summary

This PR introduces a kprobe-based hook to manage shared mount propagation during the boot process, from the post-fs-data event until boot_complete. The primary goal is to prevent the creation of mount peer groups by KernelSU modules, which can be used as a vector for root detection.

Original implementation by @JingMatrix (from JingMatrix/KernelSU).

Implementation Details

  1. kernel/feature/mount_propagation.{c,h}:
    • Hooks attach_recursive_mnt via kretprobe.
    • Entry: temporarily clears MNT_SHARED flag on destination mounts.
    • Return: restores original flags.
    • Captures module loop device name and transitions to selective mode after Zygote start.
  2. kernel/runtime/boot_event.c:
    • Sets Zygote started flag on on_post_fs_data().
    • Automatically unregisters the hook on on_boot_completed() to minimize runtime footprint.

Credits

  • Author / Idea: @JingMatrix (JingMatrix <jingmatrix@gmail.com>)

Introduces a kprobe-based hook to manage shared mount propagation during boot
(from post-fs-data until boot_complete), preventing the creation of mount peer
groups by KernelSU modules.

The hook operates on attach_recursive_mnt by temporarily clearing the MNT_SHARED
flag on destination mounts and restoring it upon return. Automatically unregisters
upon boot completion.

Co-authored-by: JingMatrix <jingmatrix@gmail.com>
Signed-off-by: JingMatrix <jingmatrix@gmail.com>
@HSSkyBoy

HSSkyBoy commented Oct 9, 2026

Copy link
Copy Markdown
Member Author

[Blocked - do not merge]

Blocking this until the stability concerns below are resolved. Stability comes first; this hook touches mount flags on every mount during early boot, so it needs to be provably safe on every supported kernel.

Must fix

  1. Fallback struct mount is unsafe. If fs/mount.h is not found, the file falls back to a hand-copied struct mount and then writes dest_mnt->mnt.mnt_flags. The layout differs between kernel versions, so a wrong offset silently corrupts kernel memory. Fail the build (or compile the feature out) when the header is unavailable. Nothing else in kernel/ does this.
  2. Probe argument assumptions are unverified. PT_REGS_PARM1/2 are assumed to be source_mnt / dest_mnt. The signature of attach_recursive_mnt changed in newer kernels, and the function may be inlined (so symbol_name fails to resolve). Please list the kernel versions / GKI branches this was actually tested on, and make it a no-op (not an error) where the symbol or signature does not match.
  3. Module loop device capture. "First /dev/block/loop* seen" can be an APEX loop mount rather than the KernelSU modules image, which would make the post-post-fs-data selective mode never match. Please show on a device that the captured name is the modules device.
  4. Scope before post-fs-data. Until ksu_zygote_started is set, every shared destination mount in the system is made private for the duration of the call, including Android's own early mounts. Please describe why this does not break propagation that init/apexd rely on, with test results.

Should fix

  • ksu_set_zygote_started() is called from on_post_fs_data(), when Zygote has not started yet. Rename or move.
  • Use strscpy instead of strncpy (removed from the tree in #3529).
  • Rate-limit or drop the per-mount pr_info spam.
  • Follow the repo's formatting (4 spaces, clang-format).
  • ksu_mount_propagation_registered is a plain bool shared between on_boot_completed() and module exit.

Not built or run on a device by me; the points above come from reading the diff.

@HSSkyBoy HSSkyBoy changed the title feat(kernel): Control shared mount propagation during boot [WIP] feat(kernel): Control shared mount propagation during boot Oct 9, 2026
@HSSkyBoy
HSSkyBoy marked this pull request as draft October 9, 2026 13:27

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant