From db7a4f5f2553d320a545a9d3e6c6c0b913b493e2 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Fri, 26 Jun 2026 22:42:19 +0800 Subject: [PATCH 1/8] Add KSU SUSFS configuration options --- android14-6.1/defconfig.fragment | 3 +++ 1 file changed, 3 insertions(+) diff --git a/android14-6.1/defconfig.fragment b/android14-6.1/defconfig.fragment index efbe530c..68eb2cf5 100644 --- a/android14-6.1/defconfig.fragment +++ b/android14-6.1/defconfig.fragment @@ -46,6 +46,9 @@ CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y CONFIG_KSU_SUSFS_UNICODE_FILTER=y CONFIG_KSU_SUSFS_AUTO_ADD_SUS_KSU_DEFAULT_MOUNT=y CONFIG_KSU_SUSFS_AUTO_ADD_SUS_BIND_MOUNT=y +CONFIG_KSU_SUSFS_UID_GATED_HIDING=y +CONFIG_KSU_SUSFS_HIDDEN_NAME=y +CONFIG_KSU_SUSFS_HARDENED=y # [zram] CONFIG_ZSMALLOC=y From 14521127e7e85b89dff15d479129ec798981264f Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Fri, 26 Jun 2026 23:47:02 +0800 Subject: [PATCH 2/8] Update SUSFS version to v2.1.0 in patch --- .../patches/50_add_susfs_in_gki-android14-6.1.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/android14-6.1/KernelSU-Next/patches/50_add_susfs_in_gki-android14-6.1.patch b/android14-6.1/KernelSU-Next/patches/50_add_susfs_in_gki-android14-6.1.patch index 3ba29202..df24c37f 100644 --- a/android14-6.1/KernelSU-Next/patches/50_add_susfs_in_gki-android14-6.1.patch +++ b/android14-6.1/KernelSU-Next/patches/50_add_susfs_in_gki-android14-6.1.patch @@ -1085,7 +1085,7 @@ new file mode 100644 +#include +#include + -+#define SUSFS_VERSION "v2.0.0" ++#define SUSFS_VERSION "v2.1.0" +#if LINUX_VERSION_CODE < KERNEL_VERSION(5,0,0) +#define SUSFS_VARIANT "NON-GKI" +#else From 87a3beae23f4a89975cd4382f6aa4858352c0724 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Fri, 26 Jun 2026 23:48:16 +0800 Subject: [PATCH 3/8] Update SUSFS version to v2.1.0 --- .../KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch index 5d0f0d64..d5009da2 100644 --- a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch +++ b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch @@ -1956,7 +1956,7 @@ diff '--color=auto' -ruN post-upstream/include/linux/susfs.h work-50/include/lin +struct super_block; + - #define SUSFS_VERSION "v2.0.0" + #define SUSFS_VERSION "v2.1.0" #if LINUX_VERSION_CODE < KERNEL_VERSION(5,0,0) #define SUSFS_VARIANT "NON-GKI" @@ -54,7 +56,7 @@ From e3e26464af8e5eb1090e87aedce5bd73d036e6df Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Sat, 27 Jun 2026 19:00:37 +0800 Subject: [PATCH 4/8] Update SUSFS header and patch for Android 14 --- .../patches/51_enhanced_susfs-android14-6.1.patch | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch index d5009da2..3236e961 100644 --- a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch +++ b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch @@ -2010,7 +2010,7 @@ diff '--color=auto' -ruN post-upstream/include/linux/susfs.h work-50/include/lin #endif /* spoof_uname */ -@@ -217,6 +240,13 @@ +@@ -242,7 +263,14 @@ void susfs_start_sdcard_monitor_fn(void); @@ -2024,6 +2024,8 @@ diff '--color=auto' -ruN post-upstream/include/linux/susfs.h work-50/include/lin /* susfs_init */ void susfs_init(void); +-#endif ++#endif // #ifndef KSU_SUSFS_H diff '--color=auto' -ruN post-upstream/include/linux/susfs_def.h work-50/include/linux/susfs_def.h --- post-upstream/include/linux/susfs_def.h 2026-03-07 16:32:28.738199507 +0100 +++ work-50/include/linux/susfs_def.h 2026-03-07 16:40:08.359700772 +0100 From 613c100b29dc104b12bceefe7b2c3ea4156c0572 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Sat, 27 Jun 2026 19:33:02 +0800 Subject: [PATCH 5/8] Add files via upload --- .../patches/wildkernels/fix_Makefile.patch | 18 +++ .../wildkernels/fix_kernel_umount.c.patch | 13 ++ .../patches/wildkernels/fix_ksu.c.patch | 72 +++++++++++ .../patches/wildkernels/fix_ksud.c.patch | 121 ++++++++++++++++++ .../patches/wildkernels/fix_rules.c.patch | 18 +++ .../patches/wildkernels/fix_sucompat.c.patch | 12 ++ .../wildkernels/fix_supercalls.c.patch | 116 +++++++++++++++++ 7 files changed, 370 insertions(+) create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch create mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch new file mode 100644 index 00000000..1c408513 --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch @@ -0,0 +1,18 @@ +diff --git a/kernel/Kbuild b/kernel/Kbuild +index 89319229..f1b74946 100644 +--- a/kernel/Kbuild ++++ b/kernel/Kbuild +@@ -89,4 +89,13 @@ ccflags-y += -DEXPECTED_MANAGER_HASH=\"$(KSU_NEXT_MANAGER_HASH)\" + ccflags-y += -Wno-strict-prototypes -Wno-int-conversion -Wno-gcc-compat -Wno-missing-prototypes + ccflags-y += -Wno-declaration-after-statement -Wno-unused-function -Wno-unused-variable + ++## For susfs stuff ## ++ifeq ($(shell test -e $(srctree)/fs/susfs.c; echo $$?),0) ++$(eval SUSFS_VERSION=$(shell cat $(srctree)/include/linux/susfs.h | grep -E '^#define SUSFS_VERSION' | cut -d' ' -f3 | sed 's/"//g')) ++$(info ) ++$(info -- SUSFS_VERSION: $(SUSFS_VERSION)) ++else ++$(info -- You have not integrated susfs in your kernel yet.) ++$(info -- Read: https://gitlab.com/simonpunk/susfs4ksu) ++endif + # Keep a new line here!! Because someone may append config diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch new file mode 100644 index 00000000..315a41bd --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch @@ -0,0 +1,13 @@ +diff --git a/kernel/kernel_umount.c b/kernel/kernel_umount.c +index 62d00b81..4c93b627 100644 +--- a/kernel/kernel_umount.c ++++ b/kernel/kernel_umount.c +@@ -132,6 +132,8 @@ int ksu_handle_umount(uid_t old_uid, uid_t new_uid) + pr_info("handle umount ignore non zygote child: %d\n", current->pid); + return 0; + } ++#endif // #ifndef CONFIG_KSU_SUSFS ++ + // umount the target mnt + pr_info("handle umount for uid: %d, pid: %d\n", new_uid, current->pid); + diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch new file mode 100644 index 00000000..cc06aa15 --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch @@ -0,0 +1,72 @@ +diff --git a/kernel/ksu.c b/kernel/ksu.c +index 6dbad36f..33984a31 100644 +--- a/kernel/ksu.c ++++ b/kernel/ksu.c +@@ -5,6 +5,9 @@ + #include + #include ++#ifdef CONFIG_KSU_SUSFS ++#include ++#endif // #ifdef CONFIG_KSU_SUSFS + + #include "allowlist.h" + #include "feature.h" + #include "klog.h" // IWYU pragma: keep +@@ -104,9 +107,19 @@ int __init kernelsu_init(void) + ksu_allowlist_init(); + ksu_load_allow_list(); + ++#ifndef CONFIG_KSU_SUSFS + ksu_syscall_hook_manager_init(); ++#else ++ ksu_setuid_hook_init(); ++ ksu_sucompat_init(); ++#endif // #ifndef CONFIG_KSU_SUSFS + + ksu_throne_tracker_init(); ++ ++#ifdef CONFIG_KSU_SUSFS ++ susfs_init(); ++#endif // #ifdef CONFIG_KSU_SUSFS ++ + ksu_observer_init(); + ksu_file_wrapper_init(); + +@@ -114,13 +127,24 @@ int __init kernelsu_init(void) + track_throne(false); + + } else { ++#ifndef CONFIG_KSU_SUSFS + ksu_syscall_hook_manager_init(); ++#else ++ ksu_setuid_hook_init(); ++ ksu_sucompat_init(); ++#endif // #ifndef CONFIG_KSU_SUSFS + + ksu_allowlist_init(); + + ksu_throne_tracker_init(); + ++#ifdef CONFIG_KSU_SUSFS ++ susfs_init(); ++#endif // #ifdef CONFIG_KSU_SUSFS ++ ++#ifndef CONFIG_KSU_SUSFS + ksu_ksud_init(); ++#endif // #ifndef CONFIG_KSU_SUSFS + + ksu_file_wrapper_init(); + } +@@ -142,10 +166,12 @@ void kernelsu_exit(void) + + ksu_observer_exit(); + ++#ifndef CONFIG_KSU_SUSFS + if (!ksu_late_loaded) + ksu_ksud_exit(); + + ksu_syscall_hook_manager_exit(); ++#endif // #ifndef CONFIG_KSU_SUSFS + + ksu_supercalls_exit(); + diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch new file mode 100644 index 00000000..3e53a259 --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch @@ -0,0 +1,121 @@ +diff --git a/kernel/ksud.c b/kernel/ksud.c +index 253f361e..2ffc09ff 100644 +--- a/kernel/ksud.c ++++ b/kernel/ksud.c +@@ -120,7 +120,9 @@ void on_boot_completed(void) + ksu_boot_completed = true; + pr_info("on_boot_completed!\n"); + track_throne(true); ++#ifndef CONFIG_KSU_SUSFS + ksu_avc_spoof_late_init(); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + #ifndef CONFIG_KSU_SUSFS +@@ -286,6 +288,11 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr, + } + } + ++#ifdef CONFIG_KSU_SUSFS ++ // - We need to run ksu_handle_execveat_init() at the very end in case the above checks are skipped ++ (void)ksu_handle_execveat_init(filename); ++#endif // #ifdef CONFIG_KSU_SUSFS ++ + return 0; + } + +@@ -455,6 +462,12 @@ static bool is_volumedown_enough(unsigned int count) + int ksu_handle_input_handle_event(unsigned int *type, unsigned int *code, + int *value) + { ++#ifdef CONFIG_KSU_SUSFS ++ if (!ksu_input_hook) { ++ return 0; ++ } ++#endif // #ifdef CONFIG_KSU_SUSFS ++ + if (*type == EV_KEY && *code == KEY_VOLUMEDOWN) { + int val = *value; + pr_info("KEY_VOLUMEDOWN val: %d\n", val); +@@ -631,17 +644,45 @@ static void do_stop_input_hook(struct work_struct *work) + { + unregister_kprobe(&input_event_kp); + } ++#endif // #ifndef CONFIG_KSU_SUSFS ++ ++#ifdef CONFIG_KSU_SUSFS ++void ksu_handle_vfs_fstat(int fd, loff_t *kstat_size_ptr) { ++ loff_t new_size = *kstat_size_ptr + ksu_rc_len; ++ struct file *file = fget(fd); ++ ++ if (!file) ++ return; ++ ++ if (is_init_rc(file)) { ++ pr_info("stat init.rc"); ++ pr_info("adding ksu_rc_len: %lld -> %lld", *kstat_size_ptr, new_size); ++ *kstat_size_ptr = new_size; ++ } ++ fput(file); ++} ++#endif // #ifdef CONFIG_KSU_SUSFS + + static void stop_init_rc_hook() + { ++#ifndef CONFIG_KSU_SUSFS + bool ret = schedule_work(&stop_init_rc_hook_work); + pr_info("unregister init_rc_hook kprobe: %d!\n", ret); ++#else ++ ksu_init_rc_hook = false; ++ pr_info("stop init_rc_hook\n"); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + static void stop_execve_hook() + { ++#ifndef CONFIG_KSU_SUSFS + bool ret = schedule_work(&stop_execve_hook_work); + pr_info("unregister execve kprobe: %d!\n", ret); ++#else ++ ksu_execveat_hook = false; ++ pr_info("stop execve_hook\n"); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + static void stop_input_hook() +@@ -651,13 +692,19 @@ static void stop_input_hook() + return; + } + input_hook_stopped = true; ++#ifndef CONFIG_KSU_SUSFS + bool ret = schedule_work(&stop_input_hook_work); + pr_info("unregister input kprobe: %d!\n", ret); ++#else ++ ksu_input_hook = false; ++ pr_info("stop input_hook\n"); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + // ksud: module support + void ksu_ksud_init() + { ++#ifndef CONFIG_KSU_SUSFS + int ret; + + ret = register_kprobe(&execve_kp); +@@ -675,12 +722,15 @@ void ksu_ksud_init() + INIT_WORK(&stop_init_rc_hook_work, do_stop_init_rc_hook); + INIT_WORK(&stop_execve_hook_work, do_stop_execve_hook); + INIT_WORK(&stop_input_hook_work, do_stop_input_hook); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + void ksu_ksud_exit() + { ++#ifndef CONFIG_KSU_SUSFS + unregister_kprobe(&execve_kp); + // this should be done before unregister sys_read_kp + // unregister_kprobe(&sys_read_kp); + unregister_kprobe(&input_event_kp); ++#endif // #ifndef CONFIG_KSU_SUSFS + } diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch new file mode 100644 index 00000000..ed400d9f --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch @@ -0,0 +1,18 @@ +diff --git a/kernel/selinux/rules.c b/kernel/selinux/rules.c +index 9c6b8674..d08da740 100644 +--- a/kernel/selinux/rules.c ++++ b/kernel/selinux/rules.c +@@ -94,6 +94,13 @@ void apply_kernelsu_rules() + ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "getpgid"); + ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "sigkill"); + ++#ifdef CONFIG_KSU_SUSFS ++ susfs_set_priv_app_sid(); ++ susfs_set_init_sid(); ++ susfs_set_ksu_sid(); ++ susfs_set_zygote_sid(); ++#endif // #ifdef CONFIG_KSU_SUSFS ++ + mutex_unlock(&ksu_rules); + } + diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch new file mode 100644 index 00000000..78992aa9 --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch @@ -0,0 +1,12 @@ +diff --git a/kernel/sucompat.c b/kernel/sucompat.c +index 7b6de590..97493b1e 100644 +--- a/kernel/sucompat.c ++++ b/kernel/sucompat.c +@@ -77,6 +77,7 @@ static char __user *ksud_user_path(void) + return userspace_stack_buffer(ksud_path, sizeof(ksud_path)); + } + ++#ifndef CONFIG_KSU_SUSFS + int ksu_handle_faccessat(int *dfd, const char __user **filename_user, + int *mode, int *__unused_flags) + { diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch new file mode 100644 index 00000000..1e11b3a4 --- /dev/null +++ b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch @@ -0,0 +1,116 @@ +diff --git a/kernel/supercalls.c b/kernel/supercalls.c +index 4a03af4e..d4ef7fa6 100644 +--- a/kernel/supercalls.c ++++ b/kernel/supercalls.c +@@ -12,6 +12,10 @@ + #include + #include + #include // utsname() and uts_sem ++#ifdef CONFIG_KSU_SUSFS ++#include ++#include ++#endif // #ifdef CONFIG_KSU_SUSFS + + #include "supercalls.h" + #include "arch.h" +@@ -130,6 +134,9 @@ static int do_report_event(void __user *arg) + } else { + pr_info("boot_complete triggered\n"); + on_boot_completed(); ++#ifdef CONFIG_KSU_SUSFS ++ susfs_start_sdcard_monitor_fn(); ++#endif // #ifdef CONFIG_KSU_SUSFS + } + } + break; +@@ -447,6 +454,7 @@ static int do_manage_mark(void __user *arg) + + switch (cmd.operation) { + case KSU_MARK_GET: { ++#ifndef CONFIG_KSU_SUSFS + // Get task mark status + ret = ksu_get_task_mark(cmd.pid); + if (ret < 0) { +@@ -455,8 +463,19 @@ static int do_manage_mark(void __user *arg) + } + cmd.result = (u32)ret; + break; ++#else ++ if (susfs_is_current_proc_umounted()) { ++ ret = 0; // SYSCALL_TRACEPOINT is NOT flagged ++ } else { ++ ret = 1; // SYSCALL_TRACEPOINT is flagged ++ } ++ pr_info("manage_mark: ret for pid %d: %d\n", cmd.pid, ret); ++ cmd.result = (u32)ret; ++ break; ++#endif // #ifndef CONFIG_KSU_SUSFS + } + case KSU_MARK_MARK: { ++#ifndef CONFIG_KSU_SUSFS + if (cmd.pid == 0) { + ksu_mark_all_process(); + } else { +@@ -467,9 +486,15 @@ static int do_manage_mark(void __user *arg) + return ret; + } + } ++#else ++ if (cmd.pid != 0) { ++ return ret; ++ } ++#endif // #ifndef CONFIG_KSU_SUSFS + break; + } + case KSU_MARK_UNMARK: { ++#ifndef CONFIG_KSU_SUSFS + if (cmd.pid == 0) { + ksu_unmark_all_process(); + } else { +@@ -480,11 +505,20 @@ static int do_manage_mark(void __user *arg) + return ret; + } + } ++#else ++ if (cmd.pid != 0) { ++ return ret; ++ } ++#endif // #ifndef CONFIG_KSU_SUSFS + break; + } + case KSU_MARK_REFRESH: { ++#ifndef CONFIG_KSU_SUSFS + ksu_mark_running_process(); + pr_info("manage_mark: refreshed running processes\n"); ++#else ++ pr_info("susfs: cmd: KSU_MARK_REFRESH: do nothing\n"); ++#endif // #ifndef CONFIG_KSU_SUSFS + break; + } + default: { +@@ -1103,19 +1137,25 @@ void ksu_supercalls_init(void) + ksu_ioctl_handlers[i].cmd); + } + ++#ifndef CONFIG_KSU_SUSFS + int rc = register_kprobe(&reboot_kp); + if (rc) { + pr_err("reboot kprobe failed: %d\n", rc); + } else { + pr_info("reboot kprobe registered successfully\n"); + } ++#endif // #ifndef CONFIG_KSU_SUSFS + + sulog_init_heap(); // grab heap memory + } + + void ksu_supercalls_exit(void) + { ++#ifndef CONFIG_KSU_SUSFS + unregister_kprobe(&reboot_kp); ++#else ++ pr_info("susfs: do nothing\n"); ++#endif // #ifndef CONFIG_KSU_SUSFS + } + + // IOCTL dispatcher From ec624aa7150e0f3f4be92f7428118674d4747f47 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Sat, 27 Jun 2026 19:35:38 +0800 Subject: [PATCH 6/8] Implement WildKernels patch application in build workflow Add WildKernels SUSFS fix patch application to workflow. --- .github/workflows/build-ksu-next.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/build-ksu-next.yml b/.github/workflows/build-ksu-next.yml index 48e4b16e..658d65fd 100644 --- a/.github/workflows/build-ksu-next.yml +++ b/.github/workflows/build-ksu-next.yml @@ -224,6 +224,27 @@ jobs: echo "No 70_ patch needed" fi + WILDFIX="$GITHUB_WORKSPACE/$VERSION_DIR/KernelSU-Next/patches/wildkernels" + if [ -d "$WILDFIX" ]; then + echo "Applying WildKernels SUSFS fix patches..." + for P in \ + fix_Makefile.patch \ + fix_ksu_c.patch \ + fix_ksud_c.patch \ + fix_supercalls_c.patch \ + fix_sucompat_c.patch \ + fix_kernel_umount_c.patch \ + fix_rules_c.patch; do + if [ -f "$WILDFIX/$P" ]; then + echo " → $P" + patch -p1 --no-backup-if-mismatch < "$WILDFIX/$P" || \ + echo "::warning::WildKernels patch $P had issues" + fi + done + else + echo "No WildKernels patches directory found — skipping" + fi + - name: Apply ZeroMount Patch if: inputs.add_zeromount && inputs.add_susfs working-directory: ${{ env.KERNEL_ROOT }}/common From 4e317278bd7c7e874e3df959b414d4e708fc4619 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Sat, 27 Jun 2026 19:48:45 +0800 Subject: [PATCH 7/8] Update SUSFS configuration in Kconfig and namei.c Enhance SUSFS configuration options and error handling. --- .../51_enhanced_susfs-android14-6.1.patch | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch index 3236e961..49a5a96c 100644 --- a/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch +++ b/android14-6.1/KernelSU-Next/patches/51_enhanced_susfs-android14-6.1.patch @@ -1,7 +1,7 @@ diff '--color=auto' -ruN post-upstream/fs/Kconfig work-50/fs/Kconfig --- post-upstream/fs/Kconfig 2026-03-07 16:32:21.906120792 +0100 +++ work-50/fs/Kconfig 2026-03-07 16:47:56.973232698 +0100 -@@ -387,4 +387,34 @@ +@@ -387,4 +387,58 @@ config IO_WQ bool @@ -34,6 +34,30 @@ diff '--color=auto' -ruN post-upstream/fs/Kconfig work-50/fs/Kconfig + help + Fixes upstream SUSFS concurrency and error-handling bugs. + Disable to match exact upstream behavior. ++ ++config KSU_SUSFS_AUTO_ADD_SUS_KSU_DEFAULT_MOUNT ++ bool "Auto-add KSU default mounts to sus_mount" ++ depends on KSU_SUSFS_SUS_MOUNT ++ default y ++ help ++ Automatically adds KernelSU default bind mounts to the ++ sus_mount list so they are hidden without manual configuration. ++ ++config KSU_SUSFS_AUTO_ADD_SUS_BIND_MOUNT ++ bool "Auto-add module bind mounts to sus_mount" ++ depends on KSU_SUSFS_SUS_MOUNT ++ default y ++ help ++ Automatically adds module bind mounts to the sus_mount list ++ so they are hidden without manual configuration. ++ ++config KSU_SUSFS_UID_GATED_HIDING ++ bool "UID-gated hiding (v2.1.0+)" ++ depends on KSU_SUSFS ++ default y ++ help ++ Gates sus_path and sus_mount hiding behind a per-UID allowlist. ++ Requires susfs v2.1.0 or newer kernel patches. + endmenu diff '--color=auto' -ruN post-upstream/fs/namei.c work-50/fs/namei.c From dade36d0234dec557d463b0fdb8fd10b78d860d0 Mon Sep 17 00:00:00 2001 From: IUenkodr Date: Sun, 28 Jun 2026 10:32:04 +0800 Subject: [PATCH 8/8] Delete android14-6.1/KernelSU-Next/patches/wildkernels directory --- .../patches/wildkernels/fix_Makefile.patch | 18 --- .../wildkernels/fix_kernel_umount.c.patch | 13 -- .../patches/wildkernels/fix_ksu.c.patch | 72 ----------- .../patches/wildkernels/fix_ksud.c.patch | 121 ------------------ .../patches/wildkernels/fix_rules.c.patch | 18 --- .../patches/wildkernels/fix_sucompat.c.patch | 12 -- .../wildkernels/fix_supercalls.c.patch | 116 ----------------- 7 files changed, 370 deletions(-) delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch delete mode 100644 android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch deleted file mode 100644 index 1c408513..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_Makefile.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff --git a/kernel/Kbuild b/kernel/Kbuild -index 89319229..f1b74946 100644 ---- a/kernel/Kbuild -+++ b/kernel/Kbuild -@@ -89,4 +89,13 @@ ccflags-y += -DEXPECTED_MANAGER_HASH=\"$(KSU_NEXT_MANAGER_HASH)\" - ccflags-y += -Wno-strict-prototypes -Wno-int-conversion -Wno-gcc-compat -Wno-missing-prototypes - ccflags-y += -Wno-declaration-after-statement -Wno-unused-function -Wno-unused-variable - -+## For susfs stuff ## -+ifeq ($(shell test -e $(srctree)/fs/susfs.c; echo $$?),0) -+$(eval SUSFS_VERSION=$(shell cat $(srctree)/include/linux/susfs.h | grep -E '^#define SUSFS_VERSION' | cut -d' ' -f3 | sed 's/"//g')) -+$(info ) -+$(info -- SUSFS_VERSION: $(SUSFS_VERSION)) -+else -+$(info -- You have not integrated susfs in your kernel yet.) -+$(info -- Read: https://gitlab.com/simonpunk/susfs4ksu) -+endif - # Keep a new line here!! Because someone may append config diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch deleted file mode 100644 index 315a41bd..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_kernel_umount.c.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/kernel/kernel_umount.c b/kernel/kernel_umount.c -index 62d00b81..4c93b627 100644 ---- a/kernel/kernel_umount.c -+++ b/kernel/kernel_umount.c -@@ -132,6 +132,8 @@ int ksu_handle_umount(uid_t old_uid, uid_t new_uid) - pr_info("handle umount ignore non zygote child: %d\n", current->pid); - return 0; - } -+#endif // #ifndef CONFIG_KSU_SUSFS -+ - // umount the target mnt - pr_info("handle umount for uid: %d, pid: %d\n", new_uid, current->pid); - diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch deleted file mode 100644 index cc06aa15..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksu.c.patch +++ /dev/null @@ -1,72 +0,0 @@ -diff --git a/kernel/ksu.c b/kernel/ksu.c -index 6dbad36f..33984a31 100644 ---- a/kernel/ksu.c -+++ b/kernel/ksu.c -@@ -5,6 +5,9 @@ - #include - #include -+#ifdef CONFIG_KSU_SUSFS -+#include -+#endif // #ifdef CONFIG_KSU_SUSFS - - #include "allowlist.h" - #include "feature.h" - #include "klog.h" // IWYU pragma: keep -@@ -104,9 +107,19 @@ int __init kernelsu_init(void) - ksu_allowlist_init(); - ksu_load_allow_list(); - -+#ifndef CONFIG_KSU_SUSFS - ksu_syscall_hook_manager_init(); -+#else -+ ksu_setuid_hook_init(); -+ ksu_sucompat_init(); -+#endif // #ifndef CONFIG_KSU_SUSFS - - ksu_throne_tracker_init(); -+ -+#ifdef CONFIG_KSU_SUSFS -+ susfs_init(); -+#endif // #ifdef CONFIG_KSU_SUSFS -+ - ksu_observer_init(); - ksu_file_wrapper_init(); - -@@ -114,13 +127,24 @@ int __init kernelsu_init(void) - track_throne(false); - - } else { -+#ifndef CONFIG_KSU_SUSFS - ksu_syscall_hook_manager_init(); -+#else -+ ksu_setuid_hook_init(); -+ ksu_sucompat_init(); -+#endif // #ifndef CONFIG_KSU_SUSFS - - ksu_allowlist_init(); - - ksu_throne_tracker_init(); - -+#ifdef CONFIG_KSU_SUSFS -+ susfs_init(); -+#endif // #ifdef CONFIG_KSU_SUSFS -+ -+#ifndef CONFIG_KSU_SUSFS - ksu_ksud_init(); -+#endif // #ifndef CONFIG_KSU_SUSFS - - ksu_file_wrapper_init(); - } -@@ -142,10 +166,12 @@ void kernelsu_exit(void) - - ksu_observer_exit(); - -+#ifndef CONFIG_KSU_SUSFS - if (!ksu_late_loaded) - ksu_ksud_exit(); - - ksu_syscall_hook_manager_exit(); -+#endif // #ifndef CONFIG_KSU_SUSFS - - ksu_supercalls_exit(); - diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch deleted file mode 100644 index 3e53a259..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_ksud.c.patch +++ /dev/null @@ -1,121 +0,0 @@ -diff --git a/kernel/ksud.c b/kernel/ksud.c -index 253f361e..2ffc09ff 100644 ---- a/kernel/ksud.c -+++ b/kernel/ksud.c -@@ -120,7 +120,9 @@ void on_boot_completed(void) - ksu_boot_completed = true; - pr_info("on_boot_completed!\n"); - track_throne(true); -+#ifndef CONFIG_KSU_SUSFS - ksu_avc_spoof_late_init(); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - #ifndef CONFIG_KSU_SUSFS -@@ -286,6 +288,11 @@ int ksu_handle_execveat_ksud(int *fd, struct filename **filename_ptr, - } - } - -+#ifdef CONFIG_KSU_SUSFS -+ // - We need to run ksu_handle_execveat_init() at the very end in case the above checks are skipped -+ (void)ksu_handle_execveat_init(filename); -+#endif // #ifdef CONFIG_KSU_SUSFS -+ - return 0; - } - -@@ -455,6 +462,12 @@ static bool is_volumedown_enough(unsigned int count) - int ksu_handle_input_handle_event(unsigned int *type, unsigned int *code, - int *value) - { -+#ifdef CONFIG_KSU_SUSFS -+ if (!ksu_input_hook) { -+ return 0; -+ } -+#endif // #ifdef CONFIG_KSU_SUSFS -+ - if (*type == EV_KEY && *code == KEY_VOLUMEDOWN) { - int val = *value; - pr_info("KEY_VOLUMEDOWN val: %d\n", val); -@@ -631,17 +644,45 @@ static void do_stop_input_hook(struct work_struct *work) - { - unregister_kprobe(&input_event_kp); - } -+#endif // #ifndef CONFIG_KSU_SUSFS -+ -+#ifdef CONFIG_KSU_SUSFS -+void ksu_handle_vfs_fstat(int fd, loff_t *kstat_size_ptr) { -+ loff_t new_size = *kstat_size_ptr + ksu_rc_len; -+ struct file *file = fget(fd); -+ -+ if (!file) -+ return; -+ -+ if (is_init_rc(file)) { -+ pr_info("stat init.rc"); -+ pr_info("adding ksu_rc_len: %lld -> %lld", *kstat_size_ptr, new_size); -+ *kstat_size_ptr = new_size; -+ } -+ fput(file); -+} -+#endif // #ifdef CONFIG_KSU_SUSFS - - static void stop_init_rc_hook() - { -+#ifndef CONFIG_KSU_SUSFS - bool ret = schedule_work(&stop_init_rc_hook_work); - pr_info("unregister init_rc_hook kprobe: %d!\n", ret); -+#else -+ ksu_init_rc_hook = false; -+ pr_info("stop init_rc_hook\n"); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - static void stop_execve_hook() - { -+#ifndef CONFIG_KSU_SUSFS - bool ret = schedule_work(&stop_execve_hook_work); - pr_info("unregister execve kprobe: %d!\n", ret); -+#else -+ ksu_execveat_hook = false; -+ pr_info("stop execve_hook\n"); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - static void stop_input_hook() -@@ -651,13 +692,19 @@ static void stop_input_hook() - return; - } - input_hook_stopped = true; -+#ifndef CONFIG_KSU_SUSFS - bool ret = schedule_work(&stop_input_hook_work); - pr_info("unregister input kprobe: %d!\n", ret); -+#else -+ ksu_input_hook = false; -+ pr_info("stop input_hook\n"); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - // ksud: module support - void ksu_ksud_init() - { -+#ifndef CONFIG_KSU_SUSFS - int ret; - - ret = register_kprobe(&execve_kp); -@@ -675,12 +722,15 @@ void ksu_ksud_init() - INIT_WORK(&stop_init_rc_hook_work, do_stop_init_rc_hook); - INIT_WORK(&stop_execve_hook_work, do_stop_execve_hook); - INIT_WORK(&stop_input_hook_work, do_stop_input_hook); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - void ksu_ksud_exit() - { -+#ifndef CONFIG_KSU_SUSFS - unregister_kprobe(&execve_kp); - // this should be done before unregister sys_read_kp - // unregister_kprobe(&sys_read_kp); - unregister_kprobe(&input_event_kp); -+#endif // #ifndef CONFIG_KSU_SUSFS - } diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch deleted file mode 100644 index ed400d9f..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_rules.c.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff --git a/kernel/selinux/rules.c b/kernel/selinux/rules.c -index 9c6b8674..d08da740 100644 ---- a/kernel/selinux/rules.c -+++ b/kernel/selinux/rules.c -@@ -94,6 +94,13 @@ void apply_kernelsu_rules() - ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "getpgid"); - ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "sigkill"); - -+#ifdef CONFIG_KSU_SUSFS -+ susfs_set_priv_app_sid(); -+ susfs_set_init_sid(); -+ susfs_set_ksu_sid(); -+ susfs_set_zygote_sid(); -+#endif // #ifdef CONFIG_KSU_SUSFS -+ - mutex_unlock(&ksu_rules); - } - diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch deleted file mode 100644 index 78992aa9..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_sucompat.c.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/kernel/sucompat.c b/kernel/sucompat.c -index 7b6de590..97493b1e 100644 ---- a/kernel/sucompat.c -+++ b/kernel/sucompat.c -@@ -77,6 +77,7 @@ static char __user *ksud_user_path(void) - return userspace_stack_buffer(ksud_path, sizeof(ksud_path)); - } - -+#ifndef CONFIG_KSU_SUSFS - int ksu_handle_faccessat(int *dfd, const char __user **filename_user, - int *mode, int *__unused_flags) - { diff --git a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch b/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch deleted file mode 100644 index 1e11b3a4..00000000 --- a/android14-6.1/KernelSU-Next/patches/wildkernels/fix_supercalls.c.patch +++ /dev/null @@ -1,116 +0,0 @@ -diff --git a/kernel/supercalls.c b/kernel/supercalls.c -index 4a03af4e..d4ef7fa6 100644 ---- a/kernel/supercalls.c -+++ b/kernel/supercalls.c -@@ -12,6 +12,10 @@ - #include - #include - #include // utsname() and uts_sem -+#ifdef CONFIG_KSU_SUSFS -+#include -+#include -+#endif // #ifdef CONFIG_KSU_SUSFS - - #include "supercalls.h" - #include "arch.h" -@@ -130,6 +134,9 @@ static int do_report_event(void __user *arg) - } else { - pr_info("boot_complete triggered\n"); - on_boot_completed(); -+#ifdef CONFIG_KSU_SUSFS -+ susfs_start_sdcard_monitor_fn(); -+#endif // #ifdef CONFIG_KSU_SUSFS - } - } - break; -@@ -447,6 +454,7 @@ static int do_manage_mark(void __user *arg) - - switch (cmd.operation) { - case KSU_MARK_GET: { -+#ifndef CONFIG_KSU_SUSFS - // Get task mark status - ret = ksu_get_task_mark(cmd.pid); - if (ret < 0) { -@@ -455,8 +463,19 @@ static int do_manage_mark(void __user *arg) - } - cmd.result = (u32)ret; - break; -+#else -+ if (susfs_is_current_proc_umounted()) { -+ ret = 0; // SYSCALL_TRACEPOINT is NOT flagged -+ } else { -+ ret = 1; // SYSCALL_TRACEPOINT is flagged -+ } -+ pr_info("manage_mark: ret for pid %d: %d\n", cmd.pid, ret); -+ cmd.result = (u32)ret; -+ break; -+#endif // #ifndef CONFIG_KSU_SUSFS - } - case KSU_MARK_MARK: { -+#ifndef CONFIG_KSU_SUSFS - if (cmd.pid == 0) { - ksu_mark_all_process(); - } else { -@@ -467,9 +486,15 @@ static int do_manage_mark(void __user *arg) - return ret; - } - } -+#else -+ if (cmd.pid != 0) { -+ return ret; -+ } -+#endif // #ifndef CONFIG_KSU_SUSFS - break; - } - case KSU_MARK_UNMARK: { -+#ifndef CONFIG_KSU_SUSFS - if (cmd.pid == 0) { - ksu_unmark_all_process(); - } else { -@@ -480,11 +505,20 @@ static int do_manage_mark(void __user *arg) - return ret; - } - } -+#else -+ if (cmd.pid != 0) { -+ return ret; -+ } -+#endif // #ifndef CONFIG_KSU_SUSFS - break; - } - case KSU_MARK_REFRESH: { -+#ifndef CONFIG_KSU_SUSFS - ksu_mark_running_process(); - pr_info("manage_mark: refreshed running processes\n"); -+#else -+ pr_info("susfs: cmd: KSU_MARK_REFRESH: do nothing\n"); -+#endif // #ifndef CONFIG_KSU_SUSFS - break; - } - default: { -@@ -1103,19 +1137,25 @@ void ksu_supercalls_init(void) - ksu_ioctl_handlers[i].cmd); - } - -+#ifndef CONFIG_KSU_SUSFS - int rc = register_kprobe(&reboot_kp); - if (rc) { - pr_err("reboot kprobe failed: %d\n", rc); - } else { - pr_info("reboot kprobe registered successfully\n"); - } -+#endif // #ifndef CONFIG_KSU_SUSFS - - sulog_init_heap(); // grab heap memory - } - - void ksu_supercalls_exit(void) - { -+#ifndef CONFIG_KSU_SUSFS - unregister_kprobe(&reboot_kp); -+#else -+ pr_info("susfs: do nothing\n"); -+#endif // #ifndef CONFIG_KSU_SUSFS - } - - // IOCTL dispatcher