feat: process tag (WIP) by 5ec1cff · Pull Request #3378 · tiann/KernelSU

5ec1cff · 2026-03-31T10:22:41Z

No description provided.

for: tiann#3378 ref: https://elixir.bootlin.com/linux/v4.14.1/source/kernel/signal.c#L1974 https://elixir.bootlin.com/linux/v4.14.1/source/include/linux/sched/signal.h#L231 [ 38.584868] KernelSU: sys_execve su->ksud! [ 38.591293] KernelSU: ksu_bprm_check: ksu managed task found with pid: 4681 comm: ksud [ 38.811241] KernelSU: sys_execve su->ksud! [ 38.816113] KernelSU: ksu_bprm_check: ksu managed task found with pid: 4707 comm: ksud [ 38.972612] KernelSU: sys_execve su->ksud! [ 38.998849] KernelSU: ksu_bprm_check: ksu managed task found with pid: 4724 comm: ksud [ 39.513940] KernelSU: sys_execve su->ksud! [ 39.530293] KernelSU: ksu_bprm_check: ksu managed task found with pid: 4774 comm: ksud [ 39.534300] KernelSU: sys_execve su->ksud! [ 39.539604] KernelSU: ksu_bprm_check: ksu managed task found with pid: 4779 comm: ksud [ 51.405629] KernelSU: newfstatat su->sh!

for: tiann#3378 https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h

Copilot

Pull request overview

Adds a new “process tag” feature to KernelSU so kernel components (notably sulog and supercall IOCTLs) can attach and query a small type+name label for processes.

Changes:

Extend UAPI with process-tag IOCTLs, sulog event fields, and a new feature flag (KSU_FEATURE_PROCESS_TAG).
Add a new kernel subsystem (kernel/feature/process_tag.*) to store tags and (attempt to) propagate them via LSM task hooks.
Integrate tagging into supercall dispatch, sulog event emission, and root-escape paths; adjust allowlist APIs to return a refcounted app_profile for root escalation.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
uapi/supercall.h	Adds SET/GET process tag IOCTL command structs and ioctl numbers.
uapi/sulog.h	Extends sulog event struct with process-tag metadata.
uapi/feature.h	Introduces `KSU_FEATURE_PROCESS_TAG`.
kernel/supercall/dispatch.c	Implements new IOCTL handlers and tags manager callers.
kernel/sulog/event.c	Attaches process-tag metadata to emitted sulog events.
kernel/policy/app_profile.c	Tags processes during root escalation and init escape; switches to `ksu_get_root_app_profile()`.
kernel/policy/allowlist.h	Adds UID constants, introduces `ksu_get_root_app_profile()`, exports `default_root_profile`.
kernel/policy/allowlist.c	Makes `default_root_profile` global; implements `ksu_get_root_app_profile()`.
kernel/hook/syscall_event_bridge.c	Tags ksud when init executes it.
kernel/feature/process_tag.h	Declares process tag types and the tag management API.
kernel/feature/process_tag.c	Implements tag storage, lookup, lifecycle, and LSM hook registration.
kernel/core/init.c	Initializes and exits the process-tag subsystem; tags late-load ksud.
kernel/Kbuild	Builds the new `feature/process_tag.o`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

for: tiann#3378 https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h

for: tiann#3378

for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa

for: tiann#3378 https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h

for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa

for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa [ 72.716077] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.716516] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.718024] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.718604] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.733396] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.734067] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5580 comm: login [ 72.762384] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.764152] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5581 comm: login [ 72.769936] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.770506] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5582 comm: login [ 72.777585] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.779238] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.782688] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5584 comm: login [ 72.792786] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.795331] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.796197] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: login [ 72.810608] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: bash [ 72.820124] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: login [ 72.845099] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.854435] KernelSU: task_alloc: uid: 10204 pid: 5568 [ 72.877155] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.142322] KernelSU: task_alloc: uid: 10204 pid: 5546 [ 73.318306] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.324878] KernelSU: task_alloc: uid: 10204 pid: 5600 [ 77.861947] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 77.865438] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: bash [ 77.870812] KernelSU: faccessat su->sh! [ 77.870877] KernelSU: faccessat su->sh! [ 77.871118] KernelSU: sys_execve su->ksud! [ 77.871199] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: sh [ 77.876575] KernelSU: sys_reboot: intercepted call! magic: 0xdeadbeef id: -889275714 [ 77.876581] KernelSU: ksu fd installed: 3 for pid 5619 [ 77.876582] KernelSU: [5619] install ksu fd: 3 [ 77.876671] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: ksud [ 77.877275] KernelSU: ksu fd released [ 81.746578] KernelSU: task_alloc: uid: 0 pid: 5619 [ 81.747869] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5709 comm: sh [ 87.314972] KernelSU: task_alloc: uid: 0 pid: 5619 [ 87.316569] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5721 comm: sh

backslashxx · 2026-04-16T07:18:46Z

if not for the name tagging, we can just squat on unused bits on thread info flags.

5ec1cff · 2026-04-16T07:23:51Z

if not for the name tagging, we can just squat on unused bits on thread info flags.

It's for sulog to track the source of root processes

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

backslashxx · 2026-04-16T07:25:23Z

we can track it easier without any alloc, but we will be squatting on thread info flags

backslashxx@b222853
backslashxx@f9b2e86

on aarch64, half of thread info flag is available.

https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h

this is long, so wordsize.

5ec1cff · 2026-04-16T07:32:22Z

Process Tag is a mechanism for tracing the origin of root processes, including apps(their uids and package names will be recorded), ksud, modules(their names will be recorded), and manager. We cannot store this information using only a single bit. Furthermore, this is an optional feature; whether to accept the memory overhead is up to the user.

backslashxx · 2026-04-16T07:33:49Z

yeah thats what I was saying

if not for the name tagging, we can just squat on unused bits on thread info flags.

for: tiann#3378 https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h Update sucompat.c 1 for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa [ 72.716077] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.716516] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.718024] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.718604] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.733396] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.734067] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5580 comm: login [ 72.762384] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.764152] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5581 comm: login [ 72.769936] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.770506] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5582 comm: login [ 72.777585] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.779238] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.782688] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5584 comm: login [ 72.792786] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.795331] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.796197] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: login [ 72.810608] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: bash [ 72.820124] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: login [ 72.845099] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.854435] KernelSU: task_alloc: uid: 10204 pid: 5568 [ 72.877155] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.142322] KernelSU: task_alloc: uid: 10204 pid: 5546 [ 73.318306] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.324878] KernelSU: task_alloc: uid: 10204 pid: 5600 [ 77.861947] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 77.865438] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: bash [ 77.870812] KernelSU: faccessat su->sh! [ 77.870877] KernelSU: faccessat su->sh! [ 77.871118] KernelSU: sys_execve su->ksud! [ 77.871199] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: sh [ 77.876575] KernelSU: sys_reboot: intercepted call! magic: 0xdeadbeef id: -889275714 [ 77.876581] KernelSU: ksu fd installed: 3 for pid 5619 [ 77.876582] KernelSU: [5619] install ksu fd: 3 [ 77.876671] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: ksud [ 77.877275] KernelSU: ksu fd released [ 81.746578] KernelSU: task_alloc: uid: 0 pid: 5619 [ 81.747869] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5709 comm: sh [ 87.314972] KernelSU: task_alloc: uid: 0 pid: 5619 [ 87.316569] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5721 comm: sh

for: 3378 https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm64/include/asm/thread_info.h https://elixir.bootlin.com/linux/v7.0-rc6/source/arch/arm/include/asm/thread_info.h Update sucompat.c 1 for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa [ 72.716077] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.716516] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.718024] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.718604] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: com.termux [ 72.733396] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.734067] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5580 comm: login [ 72.762384] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.764152] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5581 comm: login [ 72.769936] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.770506] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5582 comm: login [ 72.777585] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.779238] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.782688] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5584 comm: login [ 72.792786] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.795331] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 72.796197] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: login [ 72.810608] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5586 comm: bash [ 72.820124] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5576 comm: login [ 72.845099] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 72.854435] KernelSU: task_alloc: uid: 10204 pid: 5568 [ 72.877155] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.142322] KernelSU: task_alloc: uid: 10204 pid: 5546 [ 73.318306] KernelSU: task_alloc: uid: 10204 pid: 5188 [ 73.324878] KernelSU: task_alloc: uid: 10204 pid: 5600 [ 77.861947] KernelSU: task_alloc: uid: 10204 pid: 5576 [ 77.865438] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: bash [ 77.870812] KernelSU: faccessat su->sh! [ 77.870877] KernelSU: faccessat su->sh! [ 77.871118] KernelSU: sys_execve su->ksud! [ 77.871199] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: sh [ 77.876575] KernelSU: sys_reboot: intercepted call! magic: 0xdeadbeef id: -889275714 [ 77.876581] KernelSU: ksu fd installed: 3 for pid 5619 [ 77.876582] KernelSU: [5619] install ksu fd: 3 [ 77.876671] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5619 comm: ksud [ 77.877275] KernelSU: ksu fd released [ 81.746578] KernelSU: task_alloc: uid: 0 pid: 5619 [ 81.747869] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5709 comm: sh [ 87.314972] KernelSU: task_alloc: uid: 0 pid: 5619 [ 87.316569] KernelSU: ksu_bprm_check: ksu managed task found with pid: 5721 comm: sh

5ec1cff force-pushed the proctag branch from 5d08279 to 2d2677c Compare April 4, 2026 15:53

backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Apr 4, 2026

process tagging bullshit

3f84fa1

for: tiann#3378

backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Apr 5, 2026

process tagging bullshit

f0475d3

for: tiann#3378

5ec1cff force-pushed the proctag branch from 2d2677c to a52d105 Compare April 15, 2026 15:17

5ec1cff requested a review from Copilot April 15, 2026 15:17

Copilot started reviewing on behalf of 5ec1cff April 15, 2026 15:18 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Apr 16, 2026

1

9f4aa73

for: tiann#3378

backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Apr 16, 2026

1

c49e5c2

for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa

backslashxx added a commit to backslashxx/KernelSU that referenced this pull request Apr 16, 2026

1

8deac7a

for: tiann#3378 ximi-mojito-test/mojito_krenol@d961afa

5ec1cff force-pushed the proctag branch from 58ede6e to 74a6a13 Compare April 16, 2026 06:55

5ec1cff requested a review from Copilot April 16, 2026 07:18

Copilot started reviewing on behalf of 5ec1cff April 16, 2026 07:19 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

5ec1cff added 20 commits April 17, 2026 12:22

feat: process tag (WIP)

e99aace

use task_struct as key

8d95bad

use security hook

8210f46

remove wrong usage of pid

4bcc154

refine set tag from app profile

6263b7c

use kfree_rcu

1b93af6

fix wrong rcu_read_unlock

1e7278b

fix wrong task_pid_nr usage

b6a59cd

fix put app profile

ee07121

format

dc2f372

implement userspace

eb5c64e

use unsigned char

2aad528

ksud: refine process tag name handling

74c5b05

uapi: use const instead of enum

69ceddd

avoid 0 ref

d583b12

fix help

0ebf223

write tag to sulog

dbdb4b3

use unsigned char (otherwise x64 bindgen will generate i8 for char)

4f04633

fix packed

6a751cd

fix lsm hook

82787bb

5ec1cff force-pushed the proctag branch from 0846383 to 82787bb Compare April 17, 2026 04:27

Uh oh!

Conversation

5ec1cff commented Mar 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

backslashxx commented Apr 16, 2026

Uh oh!

5ec1cff commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

backslashxx commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

5ec1cff commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

backslashxx commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

backslashxx commented Apr 16, 2026 •

edited

Loading

5ec1cff commented Apr 16, 2026 •

edited

Loading