br0kenpixel/Zygisk-Assistant
1
0
Fork 0
mirror of https://github.com/snake-4/Zygisk-Assistant.git synced 2025-09-06 06:37:02 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

Moved headers to includes, various changes...

Browse Source 
+ Added better UID checks.
+ Added MS_SLAVE root mount in the new mount namespace.
This commit is contained in:
snake-4
2024-03-26 15:37:07 +01:00
parent ba80d6d181
commit 916558491a
6 changed files with 260 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
module/jni/main.cpp
View File

@@ -1,8 +1,11 @@
#include <unistd.h>
#include <sched.h>
#include <sys/mount.h>
#include "zygisk.hpp"
#include "logging.hpp"
#include "android_filesystem_config.h"
using zygisk::Api;
using zygisk::AppSpecializeArgs;
@@ -10,6 +13,16 @@ using zygisk::ServerSpecializeArgs;
void do_unmount();
static int shouldSkipUid(int uid)
{
int appid = uid % AID_USER_OFFSET;
if (appid >= AID_APP_START && appid <= AID_APP_END)
return false;
if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END)
return false;
return true;
}
class ZygiskModule : public zygisk::ModuleBase
{
public:
@@ -26,25 +39,35 @@ public:
uint32_t flags = api->getFlags();
bool isRoot = (flags & zygisk::StateFlag::PROCESS_GRANTED_ROOT) != 0;
bool isOnDenylist = (flags & zygisk::StateFlag::PROCESS_ON_DENYLIST) != 0;
if (!isRoot && isOnDenylist && args->uid > 1000)
if (isRoot || !isOnDenylist || shouldSkipUid(args->uid))
{
LOGD("Unmounting in preAppSpecialize for pid=%d uid=%d", getpid(), args->uid);
/*
* preAppSpecialize is before ensureInAppMountNamespace.
* postAppSpecialize is after seccomp setup.
* So we unshare here to create a pseudo app mount namespace
*/
if (unshare(CLONE_NEWNS) == 0)
{
LOGD("unshare(CLONE_NEWNS) returned 0");
do_unmount();
}
else
{
LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno));
}
return;
}
LOGD("Unmounting in preAppSpecialize for pid=%d uid=%d", getpid(), args->uid);
/*
* preAppSpecialize is before ensureInAppMountNamespace.
* postAppSpecialize is after seccomp setup.
* So we unshare here to create a pseudo app mount namespace
*/
if (unshare(CLONE_NEWNS) == -1)
{
LOGE("unshare(CLONE_NEWNS) returned -1: %d (%s)", errno, strerror(errno));
// Don't unmount anything in global namespace
return;
}
/*
* Mount the pseudo app mount namespace's root as MS_SLAVE, so every mount/umount from
* Zygote shared pre-specialization mountspace is propagated to this one.
*/
if (mount("rootfs", "/", NULL, (MS_SLAVE | MS_REC), NULL) == -1)
{
LOGE("mount(\"rootfs\", \"/\", NULL, (MS_SLAVE | MS_REC), NULL) returned -1");
}
do_unmount();
}
private: