Skip to content

FolkPatch (115357)

Choose a tag to compare

View all tags
@matsuzaka-yuki matsuzaka-yuki released this 12 Oct 12:03
115357
a843c52

中文 本次更新修复了模块 WebUI 每执行一条命令就泄漏一个 root shell 的问题，并用最新源码重新打包了随应用分发的 KernelPatch 内核产物。

English This update fixes module WebUI leaking a root shell per command, and repackages the KernelPatch kernel artifacts bundled with the app from the latest source.

一、管理器 · WebUI root shell 泄漏 / Manager — WebUI root shell leak

在模块 WebUI 里，每次 exec()、exec(cmd, options, callback) 与 spawn() 都会新建一个 root shell 且从不回收，跑几十条命令就会在后台留下几十个 root 进程；每打开一次 WebUI 还会额外泄漏一个给静态资源加载用的 shell。

  • 三条执行路径改为命令结束即释放 shell；spawn() 在 enqueue() 同步抛异常时同样会关闭。
  • 静态资源加载器持有的 shell 现在随页面销毁释放，页面重开时会先关掉上一个。
    • Each exec(), exec(cmd, options, callback) and spawn() call opened a root shell and never reclaimed it, so a few dozen commands left dozens of root processes behind; every WebUI open also leaked an extra shell for the static asset loader. All three paths now release the shell as soon as the command finishes, spawn() also closes it when enqueue() throws synchronously, and the asset loader's shell is released when the page is destroyed (closing the previous one before a replacement is created).

二、内核 · KernelPatch 重新打包 / Kernel — repackaged KernelPatch

内置的 kpimg、kptools 与 7 个 KMI 的 kernelpatch.ko 全部重新构建，包含 V6 Sol 之后合并的 5 项上游修复：

  • rename 钩子：当内核通过 LTO 把 security_inode_rename 内联进 vfs_rename 时，改为挂载 selinux_inode_rename，修复这类内核上重命名拦截失效的问题。
  • 模块卸载：修复 unload_module() 在 rcu_read_lock() 内调用模块退出回调引发的 RCU 自死锁，以及 get_module_info() 错误路径漏掉的 rcu_read_unlock()；同样的问题也修到了 KPM loader。
  • 旧内核兼容：selinux_hide 在 4.19 之前的内核上明确提示不支持，并补齐 security_context_to_sid 相关兼容路径。
  • 版本判断收敛：selinux_hide 的版本门槛统一收敛到 selinux_hide.h（最低 4.19、新版本 5.0、无 sepolicy state 6.6）。
    • The bundled kpimg, kptools and the kernelpatch.ko for all 7 KMIs are rebuilt, carrying the five upstream fixes merged since V6 Sol: the rename hook now attaches to selinux_inode_rename when the kernel inlines security_inode_rename into vfs_rename through LTO; the module unload path no longer self-deadlocks by calling the exit callback under rcu_read_lock() (and the missing rcu_read_unlock() on get_module_info()'s error path is fixed, in the KPM loader as well); selinux_hide now reports unsupported clearly on kernels older than 4.19 with the security_context_to_sid compatibility path restored; and its version gates are consolidated into selinux_hide.h.
Assets 3
Loading