|
|
@@ -1,9 +1,10 @@
|
|
|
name: apply susfs patches
|
|
|
description: apply susfs patches
|
|
|
inputs:
|
|
|
- nomount:
|
|
|
- description: 'nomount'
|
|
|
- required: true
|
|
|
+ flavor:
|
|
|
+ description: 'root flavor (kernelsu, next, resukisu) - pershoot commits only apply to next'
|
|
|
+ required: false
|
|
|
+ default: ""
|
|
|
susfs_commit:
|
|
|
description: 'pinned SUSFS commit (empty = latest tip)'
|
|
|
required: false
|
|
|
@@ -27,8 +28,12 @@ runs:
|
|
|
git config --global user.email "41898282+github-actions[bot]@://github.com"
|
|
|
|
|
|
cd susfs4ksu
|
|
|
- git fetch https://gitlab.com/pershoot/susfs4ksu.git gki-android14-6.1-dev || true
|
|
|
- git log ..FETCH_HEAD --oneline -n 2 | awk '{print $1}' | tac | xargs git cherry-pick 2>/dev/null || true
|
|
|
+ # Pershoot's gki-android14-6.1-dev commits only apply to KernelSU-Next
|
|
|
+ # (dev-susfs fork). Other flavors use the simonpunk checkout as-is.
|
|
|
+ if [ "${{ inputs.flavor }}" = "next" ]; then
|
|
|
+ git fetch https://gitlab.com/pershoot/susfs4ksu.git gki-android14-6.1-dev || true
|
|
|
+ git log ..FETCH_HEAD --oneline -n 2 | awk '{print $1}' | tac | xargs git cherry-pick 2>/dev/null || true
|
|
|
+ fi
|
|
|
|
|
|
SUSFS4KSU="$ROOT/susfs4ksu"
|
|
|
echo "SUSFS4KSU=$SUSFS4KSU" >> $GITHUB_ENV
|
|
|
@@ -37,7 +42,20 @@ runs:
|
|
|
- name: Apply to KSUN
|
|
|
shell: bash
|
|
|
run: |
|
|
|
- echo "SUSFS prepared at $SUSFS4KSU"
|
|
|
+ # Tiann KernelSU does not ship SUSFS: apply the enable patch to the
|
|
|
+ # root checkout. Next and ReSukiSU already include SUSFS, skip them.
|
|
|
+ if [ "${{ inputs.flavor }}" = "kernelsu" ]; then
|
|
|
+ PATCH="$SUSFS4KSU/kernel_patches/KernelSU/10_enable_susfs_for_ksu.patch"
|
|
|
+ if [ ! -f "$PATCH" ]; then
|
|
|
+ echo "Missing 10_enable_susfs_for_ksu.patch at $PATCH" >&2
|
|
|
+ exit 1
|
|
|
+ fi
|
|
|
+ echo "Applying SUSFS enable patch to KernelSU checkout at $ROOT_DIR"
|
|
|
+ git -C "$ROOT_DIR" apply --check "$PATCH"
|
|
|
+ git -C "$ROOT_DIR" apply "$PATCH"
|
|
|
+ else
|
|
|
+ echo "SUSFS prepared at $SUSFS4KSU (flavor ${{ inputs.flavor }} ships its own SUSFS)"
|
|
|
+ fi
|
|
|
|
|
|
- name: Copy required files
|
|
|
shell: bash
|
|
|
@@ -64,7 +82,7 @@ runs:
|
|
|
shell: bash
|
|
|
run: |
|
|
|
cd "$COMMON"
|
|
|
- patch -p1 < 50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch || true
|
|
|
+ patch -p1 < 50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch
|
|
|
rm -rf 50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch
|
|
|
shopt -s nullglob
|
|
|
patches=("$KERNEL_PATCHES/samsung/$BRANCH"/*.patch)
|
|
|
@@ -88,13 +106,35 @@ runs:
|
|
|
echo "Added page_size_compat.h include"
|
|
|
fi
|
|
|
|
|
|
- - name: add ksu-susfs to config
|
|
|
+ - name: fix with_policy static on 6.6+ (port from GKI)
|
|
|
shell: bash
|
|
|
run: |
|
|
|
- "$COMMON/scripts/config" --file "$GKI_DEFCONFIG" --enable CONFIG_KSU_SUSFS
|
|
|
+ if [ "$(printf '%s\n' "6.6" "$KERNEL_VER" | sort -V | head -n1)" = "6.6" ]; then
|
|
|
+ echo "[*] KVER $KERNEL_VER >= 6.6, stripping static from with_policy helpers"
|
|
|
+ for f in $(find -L "$COMMON" -name selinux_hide.c 2>/dev/null); do
|
|
|
+ if grep -q "^static int security_context_to_sid_with_policy" "$f"; then
|
|
|
+ echo "[*] Stripping static from $f helpers"
|
|
|
+ sed -i 's/^static int security_context_to_sid_with_policy/int security_context_to_sid_with_policy/g' "$f"
|
|
|
+ sed -i 's/^static int security_sid_to_context_with_policy/int security_sid_to_context_with_policy/g' "$f"
|
|
|
+ sed -i 's/^static void security_compute_av_user_with_policy/void security_compute_av_user_with_policy/g' "$f"
|
|
|
+ echo "[+] Stripped static from $f"
|
|
|
+ fi
|
|
|
+ done
|
|
|
+ else
|
|
|
+ echo "[-] KVER $KERNEL_VER < 6.6, skipping"
|
|
|
+ fi
|
|
|
|
|
|
- - name: remove open redirect if nomount is enabled
|
|
|
- if: inputs.nomount == 'true'
|
|
|
+ - name: add ksu-susfs to config
|
|
|
shell: bash
|
|
|
run: |
|
|
|
- "$COMMON/scripts/config" --file "$GKI_DEFCONFIG" --disable CONFIG_KSU_SUSFS_OPEN_REDIRECT
|
|
|
+ "$COMMON/scripts/config" --file "$GKI_DEFCONFIG" \
|
|
|
+ --enable CONFIG_KSU_SUSFS \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SUS_PATH \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SUS_MOUNT \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SUS_KSTAT \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SPOOF_UNAME \
|
|
|
+ --enable CONFIG_KSU_SUSFS_ENABLE_LOG \
|
|
|
+ --enable CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG \
|
|
|
+ --enable CONFIG_KSU_SUSFS_SUS_MAP \
|
|
|
+ --enable CONFIG_KSU_SUSFS_OPEN_REDIRECT
|
TheWildJames