[Feature] selinux hide in legacy branch

[IslamIssa1997]

Is your feature request related to a problem?

iam okay if that detection won't affect my daily use but mada pay is the default paying method in Saudia and it implemented this detection in it's app not to mention that's iam a rider (delivery) and the rider app also detected it so please add it in the legacy branch as it's not a feature for me to be cool or something stupid like that it's a mandatory update for my daily use
thank you

Describe the solution you'd like

please add selinux hide feature in legacy branch

Describe alternatives you've considered

i tried a lsposed module to temporarily hide those policies by @MhmRdd but it make specific apps to crash not all of them so alternatives is not an option here
thanks

Additional context

No response

[IslamIssa1997]

Please note that my module blocks the spawn of app_zygote isolated process for the selected apps, it's not considered a fix but was just a temporary workaround and it's unstable.

bro iam not complaining you did what you could to help the community and i appreciate your work iam not talking any bad about your module it already helped with some apps but not all of it so iam requesting that feature to apply on legacy branch

[itstheCLAW]

I think this one also popped up recently in Duck Detector and it appears to probe for hardcoded context names u:r:ksu:s0 and u:object_r:ksu_file:s0 via raw selinuxfs writes.

#define KERNEL_SU_DOMAIN "ksu"
#define KERNEL_SU_FILE "ksu_file"
#define KERNEL_SU_CONTEXT "u:r:" KERNEL_SU_DOMAIN ":s0"
#define KSU_FILE_CONTEXT "u:object_r:" KERNEL_SU_FILE ":s0"

Could this be fixed just by randomizing these names at build time similar to how the spoofed manager package name gets randomized or is there a detection method beyond name-based probing that would make this ineffective? If they couldn't hardcode the names to check anymore would the strings only need to be internally consistent within a single build for the permissions system to work or would that break module compatibility or anything that references the context names externally?

[IslamIssa1997]

@pershoot

whould you please help me with that

thank you

[fatalcoder524]

I think this one also popped up recently in Duck Detector and it appears to probe for hardcoded context names u:r:ksu:s0 and u:object_r:ksu_file:s0 via raw selinuxfs writes.

#define KERNEL_SU_DOMAIN "ksu" #define KERNEL_SU_FILE "ksu_file" #define KERNEL_SU_CONTEXT "u:r:" KERNEL_SU_DOMAIN ":s0" #define KSU_FILE_CONTEXT "u:object_r:" KERNEL_SU_FILE ":s0"

Could this be fixed just by randomizing these names at build time similar to how the spoofed manager package name gets randomized or is there a detection method beyond name-based probing that would make this ineffective? If they couldn't hardcode the names to check anymore would the strings only need to be internally consistent within a single build for the permissions system to work or would that break module compatibility or anything that references the context names externally?

SELinux context is an important thing, and you cannot randomise it. Even changing it from su to ksu broke a lot of advanced modules like Zygisks, Droidspaces and others. The actual fix is implementing SELinux hide.

[omrxm18]

I implemented selinux_hide already, it's in a PR now awaiting approval