porting KernelSU to android kernel3.18 failed

[dabao1955]

Describe the bug
A clear and concise description of what the bug is.
porting KernelSU to android kernel3.18 failed
To Reproduce
Steps to reproduce the behavior:make ARCH=arm64
O=../out
CLANG_TRIPLE=aarch64-linux-gnu-
CROSS_COMPILE=$HOME/aarch64-linux-android-4.9>
CROSS_COMPILE_ARM32=$HOME/arm-linux-androidea>

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.
build complete
Screenshots
If applicable, add screenshots to help explain your problem.

Smartphone (please complete the following information):

• Device: OPPO R9S
• OS: lineageos
• Version 14
• kernel version:3.18

Additional context
Add any other context about the problem here.

CC drivers/input/touchscreen/of_touchscreen.o
/home/synaptic/linux-3.18/drivers/kernelsu/ksu.c: In function 'kernelsu_init':
/home/synaptic/linux-3.18/drivers/kernelsu/ksu.c:60:2: warning: #warning ("KPROBES is disabled, KernelSU may not work, please check https://kernelsu.org/guide/how-to-integrate-for-non-gki.html") [-Wcpp]
error, forbidden warning: ksu.c:60
make[3]: *** [/home/synaptic/linux-3.18/scripts/Makefile.build:257: drivers/kernelsu/ksu.o] エラー 1
make[2]: *** [/home/synaptic/linux-3.18/scripts/Makefile.build:402: drivers/kernelsu] エラー 2
make[2]: *** 未完了のジョブを待っています....

CC drivers/irqchip/irq-gic-common.o
/home/synaptic/linux-3.18/drivers/kernelsu/allowlist.c: In function 'do_load_allow_list':
/home/synaptic/linux-3.18/drivers/kernelsu/allowlist.c:175:3: warning: format '%d' expects argument of type 'int', but argument 2 has type 'long int' [-Wformat=]
error, forbidden warning: allowlist.c:175
make[3]: *** [/home/synaptic/linux-3.18/scripts/Makefile.build:257: drivers/kernelsu/allowlist.o] エラー 1
make[2]: *** [/home/synaptic/linux-3.18/scripts/Makefile.build:402: drivers/kernelsu] エラー 2
make[2]: *** 未完了のジョブを待っています....
CC drivers/iommu/iommu-sysfs.o

[tiann]

KernelSU does not support kernels below version 4.4. If you are interested, you can try it on your own, but this requires some kernel-related knowledge, as some features may not be available on lower versions of the kernel. It is not as simple as compiling the source code.

[ananjaser1211]

If anyone in the future is searching for 3.18, i have managed to get it working on my samsung galaxy S7 with 3.18.140

Notes : This only compiles with Werror disabled, there are few casting errors in ksu_handle_prctl , apk_sign check_block and few others i did not have the urge to fix, but i assume they will cause errors later on. Also it works while having Selinux enforcing so thats nice.

I also tested some modules like Zygisk on kernelSU and youtube-revanced-magisk

Thanks @tiann for kernelSU, it is amazing and i have been using it on pretty much all my phones.

EDIT : To be able to use Zygisk / LSPOSED and co, you need to upstream OverlayFS and related vfs/fs : Here

For easier reading, look in this commit range : Here

You mainly need :
kernel: groups: expose groups_sort
configs: exynos8890: Enable overlayfs
syscalls: implement execveat() system call
VFS: Split DCACHE_FILE_TYPE into regular and special types

VFS and friends :

VFS: (Scripted) Convert S_ISLNK/DIR/REG(dentry->d_inode) to d_is_*(de…
VFS: Fix up debugfs to use d_is_dir() in place of S_ISDIR()

The most difficult however is you need LSM_HOOKS which was not in my 3.18 kernel, i was able to pick it from 4.4 kernel source, but it needed some work
You can start at [LSM: Split security.h] (ananjaser1211/Cronos_8890@af0db6c) and go up

From how to implement on non GKI
fs: Add KernelSU calls manually
selinux: Allow init exec ksud under nosuid

FInally i need to edit the fetcher because 3.18 has different headers for input (we dont split input codes) we also needed uaccess header and AIO header for kiocb

# 3.18 Kernel Patches

# Fix pointer error
sed -i 's/PTR_ERR(fp));/ (int)PTR_ERR(fp));/' uid_observer.c

# Add uaccess Header
sed -i '/#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 10, 0)/i #include "linux/uaccess.h"' kernel_compat.c

# Add AIO Header To address kiocb on 3.18
sed -i '/#include "allowlist.h"/i #include "linux/aio.h"' ksud.c

# Use input.h Header instead of input-event-codes.h
sed -i 's/#include "linux\/input-event-codes.h"/#include "linux\/input.h"/' ksud.c

# Remove unsupported cflags
sed -i 's/ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes -Wno-int-conversion -Wno-gcc-compat/ccflags-y += -Wno-implicit-function-declaration -Wno-strict-prototypes/' Makefile

ROOT test

Module

Module after OverlayFS update

[ananjaser1211]

Update, For module support to work on 3.18 (Zygisk for example) it wont initialize properly and would not mount, the solution in my case was upstreaming ovl (overlayfs) and whatever dependencies it needed in FS, i found it easy to cherry-pick directly from 4.4 kernel source.

Range i picked : https://github.com/ananjaser1211/Cronos_8890//compare/3b260b125e3eb9508e9110043d795554215ec8cf...cab7f2b816073fcfe64543b21a44253a1697b7c6

This made zygisk work and made modules like LSposed work, i do notice in log when using Zygisk there is a CMD 12/13 error

<3>[  261.868202]  [3:      zygiskd64:21510] KernelSU: prctl reply error, cmd: 12
<3>[  261.868229]  [3:      zygiskd64:21510] KernelSU: prctl reply error, cmd: 13

I think its something in the REGS but i dont know how to read them yet, works otherwise.

[UDPSendToFailed]

@ananjaser1211 just wanted to say thanks, I picked those commits and even though they needed some modifications for my device's msm kernel, KernelSU Next seems to be working perfectly.

[backslashxx]

let me one up @ananjaser1211 and @UDPSendToFailed

more in this album: https://imgur.com/a/ZRzc3YO

Yup, KernelSU on 3.10

I did NOT upstream overlayfs for this one. I'm just using Magic Mount.
I actually have overlayfs compiled in but its an early rc version, atleast from looking at it,
overlayfs has to be upstreamed up to this torvalds/linux@a78d9f0

[backslashxx]

For people looking for 3.x integration guide, I streamlined it here

• Ultra Legacy Integration guide backslashxx/KernelSU#20

Looks like thread hijacking, but thats just how it is.

I also recommend everyone who picked the old guide to update theirs.

However old guide is still here

show old guide

!! warning this is old and buggy!
!!! YOUVE BEEN WARNED !!!

notes, kernelsu on 3.10

• most things are also applicable on 3.18

the main issue really

• missing lsm_hooks (LSM_HOOK_INIT, security_add_hooks)

detailed list for someone who wants to try.

lsm_hooks is way different/non-existent.

• instead of backporting this, hook the functions itself on security.c.
• manual security hooks v1.5 backslashxx/KernelSU#7
• remove LSM_HOOK_INIT, security_add_hooks and its handlers on ksu code eae4393
• make sure to build with CONFIG_KSU_LSM_SECURITY_HOOKS=n

do_execve / do_execve_common

• used to use char filename which wont work, so your choices are, backport do_execve that uses struct filename on first arg
• backport torvalds/linux@c4ad8f9
• then follow this hook guide scope-minimized manual hooks v1.5 backslashxx/KernelSU#5

OR hook on sys_execve instead with a modified execveat hook

• first line creates the struct for us, struct filename *path = getname(filename); so it is ready.
• reference for struct filename, https://elixir.bootlin.com/linux/v3.10.108/source/include/linux/fs.h#L1983
• so instead of passing &filename, pass &path as shown here https://github.com/backslashxx/android_kernel_zte_msm8952/commit/297fab0
• compatibility is not assured, but it is likely fine.

CONFIG_UIDGID_STRICT_TYPE_CHECKS

• if this is disabled remove .val as uid_t/gid_t wont be struct member
• edit this ksu side
• https://github.com/backslashxx/android_kernel_zte_msm8952/commit/e13328c
• reference: https://elixir.bootlin.com/linux/v3.10.108/source/include/linux/uidgid.h#L20

get_cred_rcu

• just grab this from upstream torvalds/linux@97d0fb2

path_umount, no MNT_LOCKED

• comment out that MNT_LOCKED or backport MNT_LOCKED (optionally)
• path_umount Suggest non-gki kernel users to backport path_umount #1464
• MNT_LOCKED, optional torvalds/linux@5ff9d8a

bin2hex

• missing, just backport this torvalds/linux@53d91c5

strscpy is missing

• throne_tracker needs this
• strncpy seems to fail? null termination issue? (throne tracker gets stuck)
• just use strcpy? (works but very risky)
• can be hardened with a memset to clear destination + strncat (is ok but too much)
• middle ground is strncpy + null terminate. https://github.com/backslashxx/android_kernel_zte_msm8952/commit/069beff

read_iter on file_operations struct is missing

• just put it in. ssize_t (*read_iter) (struct kiocb *, struct iov_iter *); on include/linux/fs.h, struct file_operations
• cherry pick from torvalds/linux@293bc98

groups_sort is not exported

• backport or just cherry pick
• backport, torvalds/linux@bdcf0a4
• cherry-pick, ananjaser1211/Cronos_8890@cd5ac4d

d_is_reg() is missing

• can be adapted using IS_REG, git blame the kernel
• https://github.com/backslashxx/android_kernel_zte_msm8952/commit/a208ce6
• reference: torvalds/linux@e36cb0b

NNP / nosuid exec support

• selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES torvalds/linux@4f18998
• selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. torvalds/linux@7b0d0b4
• then apply allow init exec ksud under nosuid LineageOS/android_kernel_oneplus_msm8998@3df9df4

others

then mostly just compiler issues, will likely just be warnings, depending on your compiler setup

• cast all PTR_ERR to int, so (int)PTR_ERR, %ld to %d on pr_err after that
• copy_to_user, cast all arg to void *, eg, copy_to_user((void __user *)arg3
• https://github.com/backslashxx/android_kernel_zte_msm8952/commit/cda84c2

overlayfs, this is kinda too much to upstream for 3.10

• you have to upstream this to atleast 4.0-rc1
• for official ksu, you need to be atleast on par to this torvalds/linux@a78d9f0
• just adapt MKSU and use magic mount.
• merged in support for legacy android too 5ec1cff@b28789a

ext4_unregister_sysfs() is missing on old ext4

• just revert de29115
• create dummy look-alike function? https://github.com/backslashxx/android_kernel_zte_msm8952/commit/e60f7f0
• not really needed if using magic mount variant, just revert

backporting full do_execveat_common and lsm_hooks split-up from security.h is NOT needed.
while those are GOOD, those are HARDER.

here is a full demo of kernelsu for 3.10
https://github.com/backslashxx/android_kernel_zte_msm8952/commits/ksu-3.10

same one but with heavier emphasis on backports
https://github.com/backslashxx/android_kernel_zte_msm8952/commits/ksu-3.10-backport-heavy

[ananjaser1211]

@backslashxx KernelSU on 3.10! this is incredible, makes me want to pull out my good ol note 4 to try it out, well done!

[backslashxx]

yeah, actually, the lsm security thing, you should take a look.
that one is also applicable for 3.18. this will let you build ksu without backporting LSM_HOOK_INIT and security_add_hooks.

The commits on the repo has some small comments, so they explain themselves.

-- EDIT

a small fix to MKSU so ultra-legacy 3.x kernels with older android can still have some newer stuff.
merged in MKSU: 5ec1cff@b28789a
This is what I recommend if someone wants to avoid backporting overlayfs to be on par to 4.0.

[Megh-Rana]

let me one up @ananjaser1211 and @UDPSendToFailed

more in this album: https://imgur.com/a/ZRzc3YO

Yup, KernelSU on 3.10

I did NOT upstream overlayfs for this one. I'm just using Magic Mount. I actually have overlayfs compiled in but its an early rc version, atleast from looking at it, overlayfs has to be upstreamed up to this torvalds/linux@a78d9f0

@backslashxx Thanks for doing it on 3.10. I Managed to replicate the same for my Oppo A37

[backslashxx]

@Meghthedev finally someone that isnt me running KSU on 3.10

good job man!