Please tiann!

[krnltrigger]

Could KernelSU add a MagiskSU-style interactive Superuser request dialog while keeping the existing Superuser app list?

I need both behaviors at the same time:

1. Superuser tab: manually select apps that are permanently allowed/denied SU access.
2. Interactive request: when an app that isn't permanently allowed executes "su", KernelSU Manager should show a Magisk-style dialog:
   “Superuser Request — [App] requests root” → GRANT / DENY

Ideally, the user could choose something like Ask as the default policy, so unlisted apps trigger the dialog instead of being silently denied.

I don't want MagiskSU or another root backend. I need this functionality integrated into KernelSU's existing SU permission system.

Basically: KernelSU root backend + KernelSU Superuser list + MagiskSU-style request popup.

[Raviexthegod]

The issue with this, at least from how I understand the way KernelSU works, this isn't possible, as unless specifically whitelisted in the KSU list, then the app doesn't even know that Su exists, nor with the kernel module allow it to work. Allowing this would in turn get rid of a lot of what makes KSU more hidden than MagiskSU, as Magisk is constantly listening and will allow any app to ask for Su privileges whereas KSU will only communicate with approved apps.

[mvastola]

@Raviexthegod is mostly right here, but I do think there's some room for middle ground.

One of the security benefits of the way magisk does this is you can grant su just once or on a time-limited basis, and there's something to be said for that.

There's no reason KSU can't allow you to make su visible to an app but still prompt the you for whether to grant it when an app tries to use it.

As @Raviexthegod3 explained, in order to preserve KSU being hidden by default, there would still be the need to toggle something first on the Superuser tab of KSU to make su visible to the app, but there's no reason why root access needs to be permanently granted there as well.

As for doing this without having to whitelist the app, I think this might be technically possible, but the biggest issue would be that many apps check for the existence of su, not because they are apps that require root, but because they are trying to check if your device is rooted. And KSU wouldn't be able to tell the difference.

That said, I would think it's possible for monitor for failed attempts to read/execute the su binary (while making it appear to not exist), and triggering a prompt to the user when that happens. Another option that might be easier would be to simply prompt once, the first time a new app is opened, whether su should be visible to it.