v4.3.0

What's changed in v4.3.0 (v4.2.7..HEAD)

• manager: Revamp Settings page with Bento Grid (735b1ce)
• manager: add Origin Curtain panel for HMA-OSS (4712b55)
• manager: harden Origin Curtain status and update gating (e08d9de)
• originzygisk: step aside for external providers and add a boot guard (33c350a)
• ksud: add the built-in Origin Sui (Shizuku) backend and payload build (f1d2d07)
• manager: add the Origin Sui panel and permission management (51f6d72)
• fix: resolve Sui port CI failures (4b8b45b)
• fix: green up ShellCheck and Clippy for the Sui port (8401667)
• fix: resolve Android lint LocalContextGetResourceValueCall in Origin Lab (58ab067)
• audit: stop OriginGuard blocking normal modules on rm wildcards (2384d0a)
• manager: clean AnyKernel3 flash output and add the install card (f74621f)
• manager: add native Origin Curtain config UI (4245c03)
• ksud: accept numeric OriginZygisk state flags (f4baa75)
• manager: bento Origin Lab and Sui permission screens (3201eff)
• manager: bootstrap Origin Curtain config and guide the reboot (d8dcdbc)
• manager: pass lambdas to SettingsJumpPageWidget onClick (459d553)
• manager: align Origin Sui/Curtain with app chrome and app lists (0793cc4)
• theme: add AMOLED dark mode toggle (c1bff1f)
• fix: restore su prompt/toast after boot and request notifications (a16ee7e)
• docs: Revise README.md for improved clarity and structure (4deca03)
• docs: clean tree (3f17bda)
• originmount: add built-in NoMount provider (70331c5)
• manager: add a built-in root terminal (3a4bf4c)
• originmount: move Magic Mount into OriginMount (98096aa)
• originmount: add a hero card for the current mount setup (eba4bca)
• manager: read WebUI module info directly (9c8e6ef)
• userspace: block vklp_smaps_rollup and export ORIGINSU (df5e13b)
• manager: read module archives with commons-compress (e636ed1)
• kernel: drop noisy logs and fix file wrapper reference leak (71c44e2)
• clean tree (again) (7d2e9c0)
• docs: Revise Readme (Again) (d25f48f)

Full Changelog: v4.2.7...v4.3.0

v4.2.7

What's changed in v4.2.7 (v4.2.6..HEAD)

• feat(veil): replace Origin Veil with independent 2.0 stack (b0347b1)
• fix(zygisk): advertise standard ZYGISK_ENABLED and surface engine status (7e30604)
• fix(zygisk): tolerate trailing commas in engine state.json (2da65cd)
• fix(zygisk): show engine errors even when the monitor is down (2370976)
• fix(zygisk): require the engine binaries before advertising Zygisk (f4917c7)
• fix(zygisk): keep manager deployment checks in sync with the boot hook (8a0121d)
• chore(zygisk): refresh engine payload with valid atomic state.json (fd454f4)
• fix(kernel): include Veil UAPI header in supercall dispatch (51fa19e)
• chore(zygisk): refresh engine payload with upstream ReZygisk merge (26bea2b)
• chore(zygisk): refresh payload from BreZygisk upstream merge (d21eaf5)
• feat(zygisk): add native control panel and engine diagnostics (f35aaf8)
• fix(kernel): correct hlist_for_each_entry_safe iterator type in veil (152dd05)
• feat(manager): add LKM temporary uninstall (408b6e3)
• feat(manager): add SuSFS guard LKM manager (3834807)
• feat(manager): add guard LKM removal to the LKM screen (3c8c35f)
• feat(susfs): add guard KMI asset picker (3e3c16b)
• feat(manager): edit autoload fallback KMI (ccf6b89)
• feat(manager): add SuSFS LKM preflight diagnostics (6671054)
• feat(susfs): expose guard module diagnostics (d0b8c13)
• feat(manager): refresh SuSFS LKM status from Home (59365a1)
• feat(manager): confirm sensitive SuSFS LKM actions (42d4e3b)
• feat(manager): recover from SuSFS autoload boot loops (9caabb2)
• test(manager): cover SuSFS LKM diagnostics (518d9fd)
• fix(manager): improve SuSFS LKM accessibility (b2553cd)
• fix(manager): fix SuSFS LKM build errors (e96578b)
• docs: revamp README for users (9970bbe)
• fix(magic-mount): rebuild overlay and bind engines from a merged tree (2864e5d)
• feat(manager): re-enable Magic Mount and document it (443d4bf)
• feat(mount): detect the active mount engine and hand off Magic Mount (9a7ba3f)
• fix(manager): only require a metamodule when no mount provider is active (ea3b5e8)
• fix(manager): keep the selected hook flavor when KMI is auto-detected (6022756)
• feat(manager): revamp the updater screen (a491aaf)
• feat(manager): revamp the SuSFS manager status screen (29499af)
• ci(manager): post manager builds to @OriginKSU topics with new captions (c459fd0)
• feat(ci): post a changelog since the last tag to the changelog topic (c5615e1)
• ci(manager): default the changelog topic to 112 (7f1b908)
• kernel: don't path_put when 3.6- in dentry_open (cd9ddc2)
• manager: don't offer kernel install in late-load mode (a6b419d)
• manager: don't mark prevent_background_refresh (7c2542a)
• kernel: move ksys_unshare to ksyscall (tiann/KernelSU#3916) (ab96a7f)
• manager: remove DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION (tiann/KernelSU#3927) (831dff0)
• fix ksud cache (afabbca)
• kernel: remove useless code (tiann/KernelSU#3945) (1572f7f)
• manager: animate a per-flow flash completion card (25b8a9e)
• ci: publish the changelog only for a pushed release tag (d842807)
• manager: add the flash card background switch (18c960e)
• manager: idle background sampling and gate blur to Android 13 (184ef3d)

Full Changelog: v4.2.6...v4.2.7

v4.2.6

What's changed in v4.2.6 (v4.2.5..HEAD)

• ci(manager): skip Telegram posts for UPSTREAM mirror branch builds (88c523c)
• ci(release): post full commit changelog in tag release body (442c7d4)
• docs: Update Readme (09f6e9a)
• feat(manager): Tapping Unofficial manager warning open GitHub release page (e575140)
• feat(manager): add toggle to show/hide update manager card on home (71fec9c)
• feat(manager): grey out magic mount backend selector while WIP (db78292)
• feat(manager): hide install KPM tab without root (90132eb)
• feat(manager): fix KPM boot-image patch and flash flow (0af7ea4)
• docs: add Installation section with curl one-liners; fix kernel/setup.sh repo URL and robustness (ff84584)
• fix(kernel): validate syscall table slots before tamper patching (8942b99)
• feat: add SELinux enforcing/permissive switch (fd3dbc9)
• docs: add VitePress website with GitHub Pages deployment (b7df15e)
• feat(manager): support other KernelSU forks in compat mode (8a39088)
• feat(manager): add settings search (edbfea0)
• kernel: Add Android riscv64 support with LKM (tiann/KernelSU#3750) (cd940e3)
• ksud: use waitsys to wait when soft reboot (tiann/KernelSU#3754) (ef07f4f)
• ci,ksubot: use self-host bot API (12ae49b)
• ci: refine rust cache (9aabd4f)
• ksubot: split commit with ------ (3fc3cad)
• refactor(ksud): update waitsys and refactor logic (tiann/KernelSU#3755) (8cc2758)
• ksubot: fix commit msg (e24ef0b)
• ksud: fix waitsys not avaliable in arm (083fde5)
• ksud: remove multithread analysing boot in slot_info (6a1ff0a)
• kernel: synchronization for track_throne in pkg_observer (a77aff9)
• ksud: bail directly when boot image is empty or parse failed (0c9e92d)
• ksud: fmt (fa29c56)
• manager: revamp update card like KernelSU Next (3d98c7b)
• manager: add app lock and haptic feedback (0e7cc95)
• manager: auto-detect zip kind in pickers (98b759e)
• manager: add Veil exclude app list (0b9fb37)
• feat(ksud): add timeout for boot stage scripts(tiann/KernelSU#3797) (0319eaf)
• fix(kernel): Fix avtab removal length calculation and xperms update (e68ccf6)
• fix(kernel): Avoid repeatedly triggering service stage (tiann/KernelSU#3800) (ca8aaa5)
• kernel: escape to root when reading allowlist (b9e1be5)
• ksud: Scan APK comments up to the ZIP length limit (tiann/KernelSU#3802) (4b6d56d)
• ksud: Skip KMI detection for config-only patches(tiann/KernelSU#3803) (6ebf3a8)
• kernel: fix sidtab detection (tiann/KernelSU#3873) (c223a99)
• kernel: pkg_observer: defer track_throne to task_work (tiann/KernelSU#3871) (ddef4aa)
• fix(kernel): Keep original permission check sequence (42dae91)
• kernel: fix time side-channel detection in selinux hide (tiann/KernelSU#3877) (e8a246d)
• kernel: don't process execve for su when ksud does not exist (#597) (bd50bb1)
• kernel: check context_add_hash before operate sidtab when possible (#623) (5ddc23c)
• fix(ksud): harden APK Signing Block offset arithmetic (checked_sub) (#1591) (f62b7ca)
• ksud: Accept empty and long kallsyms tokens (tiann/KernelSU#3804) (6b3060d)
• test(ksud): remove stale LOADING_MODULE conflict test (#1587) (550ddcd)
• manager: guard parseKernelVersion against non-Int version fields (tiann/KernelSU#3593) (6ffadb1)
• kernel: sepolicy: sync policydb.len before publishing a modified policy (6dacc25)
• manager: give ksu_ops a free_mark, and drain fsnotify marks before dropping the group (4125911)
• Update README.md (9541388)
• susfs: integrate susfs lkm driver (sync-upstream: kernel/susfs: inforcqb/susfs4ksu-for-lkm@faf696a) (55b33f8)
• kernel: susfs (LKM): Implement a dead man's switch (d491549)
• kernel: susfs (LKM): open_redirect: scheme 4 is the umount answer alone, as upstream has it (85e3d37)
• kernel: susfs (LKM): kstat, sus_path: drive the stat and dirent post-checks from sys_call_table entries (7846544)
• kernel: susfs (LKM): kbuild: no stack protector below 5.11, where the module would reference __stack_chk_guard (9b62ba6)
• kernel: susfs (LKM): sus_path: release inode holds at filesystem shutdown (187c56e)
• kernel: susfs (LKM): susfs_fp: accept PAC call landing pads (c996cc4)
• kernel: susfs (LKM): opath: file_close_fd returns the file, not a status - one pointer per name (23c1092)
• kernel: susfs (LKM): sus_path: tolerate missing BTF lifetime support (0c7f436)
• kernel: susfs (LKM): docs: clarify O_PATH close helper ABI (2c3284a)
• kernel: susfs (LKM): patch_memory: resolve the cache-flush helper by name at run time (207eb79)
• kernel: susfs (LKM): open_redirect: redirect at the name layer, hold nothing (d2c6ac2)
• kernel: susfs (LKM): open_redirect: hand a rule's slot back instead of spending one per add (41a6e21)
• kernel: susfs (LKM): sus_mount: the mount prefix list holds 64 entries instead of 8 (e411548)
• kernel: susfs (LKM): sus_mount: read the prefix list from a snapshot, and keep the cut notice whole (2e884f7)
• kernel: susfs (LKM): sus_path: expose the dirent verdict so it can be asked before emitting (47062ba)
• kernel: susfs (LKM): sus_dirent: a getdents64 that never writes a hidden name to the caller (63d2b5b)
• kernel: susfs (LKM): kstat: ask the pre-emission filter before falling back to the original getdents64 (bef3344)
• kernel: susfs (LKM): opath: two close-fd contracts, one prototype - the 6.1 change was missed (e785e91)
• kernel: susfs (LKM): or_entry: keep the descriptor's O_CLOEXEC, and narrow the flags like the kernel does (f0eadf0)
• kernel: susfs (LKM): opath: declare the out-parameter only where it exists (58fcd63)
• kernel: susfs (LKM): or: scheme 4 asks KernelSU only about the uids KernelSU would umount for (aa8f0d7)
• kernel: susfs (LKM): or_entry, opath: review follow-ups - fsnotify twice on 6.6+, O_TMPFILE vs the narrowing (5937e5b)
• kernel: susfs (LKM): sus_map: take the reference map_files_get_link() left with the caller (37628ee)
• kernel: susfs (LKM): opath: take the file the check inspected, or give the fd back (ba79777)
• kernel: susfs (LKM): sus_dirent: the name it is given is not a C string, and the two gates it skipped (7bf0def)
• kernel: susfs (LKM): or: scheme 4's uid boundary mirrors KernelSU's question, not SUSFS's flag (7391582)
• kernel: susfs (LKM): open_redirect: hook every seq_show, not whichever one kallsyms lists first (be78e57)
• kernel: susfs (LKM): close O_PATH and dirent leak races (a763ea2)
• kernel: susfs (LKM): open_redirect: preserve full-width fdinfo ids (3078e0e)
• kernel: susfs (LKM): sus_path: answer readlink the way the stat family does, by changing the gate itself (2d3b25a)
• kernel: susfs (LKM): sus_map: probe show_map() too, for kernels that inline show_map_vma() (88d869d)
• kernel: susfs (LKM): sus_map: count lines dropped by the show probes (line_hides) (44c54ae)
• kernel: susfs (LKM): sus_map: move the line_hides counter above its first user (bd1f165)
• kernel: susfs (LKM): sus_map: drop the duplicated line_hides declaration (da477c1)
• kernel: susfs (LKM): susfs: control nodes follow the su gate, and carry KernelSU's file label (b6b7a49)
• kernel: susfs (LKM): susfs: put the relabel block before the layer table (it landed inside the struct) (7272f3c)
• kernel: susfs (LKM): susfs: declare susfs_btf_member_offset in the header too (1d8cbb9)
• kernel: susfs (LKM): control nodes: widen the su gate only where the ksu_file label is actually there (f654154)
• feat: add shell_su_adb_only feature to restrict shell root to adb sessions (tiann/KernelSU#3882) (59abd04)
• Support hot installing modules (tiann/KernelSU#3901) (0adf6f5)
• Add module preinit: run actions before SELinux policy loads (tiann/KernelSU#3907) (6c6904b)
• Handle execveat selinux_setup exec on Android 17 QPR3 (tiann/KernelSU#3911) (cedd45b)
• fix func change in 6.19+ (tiann/KernelSU#3917) (d2c3736)
• feat: support forcing feature values via ksu_config (incl. boot-patch-v2) (5e7b458)
• style: make clang-format and clippy checks pass again (33937bd)
• feat: add Root Gate suspension and signature-pinned root grants (810ff30)
• fix: unblock LKM and manager builds, stabilize lint checks (0afee5c)
• feat(ksud): module relations and transactional bootloop rollback (ca29b23)
• feat(manager): show an SU log activity digest (470adf1)
• fix: restore LKM preinit and manager lint builds (79be557)
• fix: import BTreeSet for Android clippy and finish Install lint fixes (692437a)
• fix: use stringResource for repo errors and refresh the ksud cache (bba1ffe)
• fix(manager): read Veil kind labels from configuration-aware resources (b553616)
• feat(manager): add timed root panic, module relations, extended SU digest and signer pin controls (f9d8971)

Full Changelog: v4.2.5...v4.2.6

v4.2.5

Full Changelog: v4.2.4...v4.2.5

v4.2.4

Full Changelog: v4.2.3...v4.2.4

v4.2.3

Full Changelog: v4.2.2...v4.2.3

v4.2.2

Full Changelog: v4.2.1...v4.2.2

v4.2.1

Full Changelog: v4.1.0...v4.2.1