diff --git a/module/jni/main.cpp b/module/jni/main.cpp index 42d07ae..eae8148 100644 --- a/module/jni/main.cpp +++ b/module/jni/main.cpp @@ -41,22 +41,20 @@ public: bool isOnDenylist = (flags & zygisk::StateFlag::PROCESS_ON_DENYLIST) != 0; if (isRoot || !isOnDenylist || shouldSkipUid(args->uid)) { + LOGD("Skipping pid=%d uid=%d", getpid(), args->uid); return; } LOGD("Unmounting in preAppSpecialize for pid=%d uid=%d", getpid(), args->uid); /* - * preAppSpecialize is before ensureInAppMountNamespace. - * postAppSpecialize is after seccomp setup. - * So we unshare here to create a pseudo app mount namespace + * Create only one namespace per zygote, child Zygotes will inherit it + * But then again, why won't they also inherit the unmounts of the parent? + * Either way, unshare in child Zygote will crash at the open FD sanity check. */ - if (unshare(CLONE_NEWNS) == -1) + if (!*args->is_child_zygote) { - LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno)); - // Don't unmount anything in global namespace - return; - } + LOGD("Creating new mount namespace for parent pid=%d uid=%d", getpid(), args->uid); /* * Mount the pseudo app mount namespace's root as MS_SLAVE, so every mount/umount from @@ -70,6 +68,11 @@ public: do_unmount(); } + void preServerSpecialize(ServerSpecializeArgs *args) override + { + api->setOption(zygisk::Option::DLCLOSE_MODULE_LIBRARY); + } + private: Api *api; JNIEnv *env;