Samsung_KernelSU_SUSFS/.github/actions/susfs-patches/action.yml

name: apply susfs patches
description: apply susfs patches
inputs:
 flavor:
  description: 'root flavor (kernelsu, next, resukisu) - pershoot commits only apply to next'
  required: false
  default: ""
 susfs_commit:
  description: 'pinned SUSFS commit (empty = latest tip)'
  required: false
  default: ""

runs:
  using: composite
  steps:
   - name: clone susfs
     shell: bash
     run: |
      SUSFS_BRANCH="gki-$ANDROID_VER-$KERNEL_VER"
      git clone https://gitlab.com/simonpunk/susfs4ksu.git -b "$SUSFS_BRANCH"
      if [ -n "${{ inputs.susfs_commit }}" ]; then
        echo "Checking out pinned SUSFS ${{ inputs.susfs_commit }}"
        git -C susfs4ksu fetch --depth 1 origin "${{ inputs.susfs_commit }}" || git -C susfs4ksu fetch origin "${{ inputs.susfs_commit }}"
        git -C susfs4ksu checkout "${{ inputs.susfs_commit }}"
      fi

      git config --global user.name "github-actions[bot]"
      git config --global user.email "41898282+github-actions[bot]@://github.com"
      
      cd susfs4ksu
      # Pershoot's gki-android14-6.1-dev commits only apply to KernelSU-Next
      # (dev-susfs fork). Other flavors use the simonpunk checkout as-is.
      if [ "${{ inputs.flavor }}" = "next" ]; then
        git fetch https://gitlab.com/pershoot/susfs4ksu.git gki-android14-6.1-dev || true
        git log ..FETCH_HEAD --oneline -n 2 | awk '{print $1}' | tac | xargs git cherry-pick 2>/dev/null || true
      fi
      
      SUSFS4KSU="$ROOT/susfs4ksu"
      echo "SUSFS4KSU=$SUSFS4KSU" >> $GITHUB_ENV
      echo "SUSFS_COMMIT=$(git -C "$ROOT/susfs4ksu" rev-parse HEAD)" >> $GITHUB_ENV
      
   - name: Apply to KSUN
     shell: bash
     run: |
       # Tiann KernelSU does not ship SUSFS: apply the enable patch to the
       # root checkout. Next and ReSukiSU already include SUSFS, skip them.
       if [ "${{ inputs.flavor }}" = "kernelsu" ]; then
         PATCH="$SUSFS4KSU/kernel_patches/KernelSU/10_enable_susfs_for_ksu.patch"
         if [ ! -f "$PATCH" ]; then
           echo "Missing 10_enable_susfs_for_ksu.patch at $PATCH" >&2
           exit 1
         fi
         echo "Applying SUSFS enable patch to KernelSU checkout at $ROOT_DIR"
         git -C "$ROOT_DIR" apply --check "$PATCH"
         git -C "$ROOT_DIR" apply "$PATCH"
       else
         echo "SUSFS prepared at $SUSFS4KSU (flavor ${{ inputs.flavor }} ships its own SUSFS)"
       fi
       
   - name: Copy required files
     shell: bash
     run: |
      cd "$COMMON"
      cp "$SUSFS4KSU/kernel_patches/fs/"* ./fs/
      cp "$SUSFS4KSU/kernel_patches/include/linux/"* ./include/linux/
      cp "$SUSFS4KSU/kernel_patches/50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch" ./          

   - name: prepare namespace and open.c for susfs patch because scamsung
     shell: bash
     run: |
      cd "$COMMON"
      sed -i '/#ifdef CONFIG_SECURITY_DEFEX/,/^#endif/d' fs/open.c
      sed -i '/copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;/,/#endif/ {
        /#ifdef CONFIG_KDP_NS/,/#endif/ {
           /#else/,/#endif/!d
           /#else/d
           /#endif/d
        }
       }' fs/namespace.c
          
   - name: apply susfs patch and fix if necessary
     shell: bash
     run: |
      cd "$COMMON"
      patch -p1 < 50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch
      rm -rf 50_add_susfs_in_gki-$ANDROID_VER-$KERNEL_VER.patch
      shopt -s nullglob
      patches=("$KERNEL_PATCHES/samsung/$BRANCH"/*.patch)
      if [ ${#patches[@]} -gt 0 ]; then
       echo "Patches found, applying..."
       cp "${patches[@]}" ./
        for p in *.patch; do
          patch -p1 < "$p"
          rm -f "$p"
        done
        shopt -u nullglob
      else
        echo "No patch file found, skipping"
      fi
        if grep -q 'VMA_PAD_START(' fs/proc/task_mmu.c && ! grep -qE '#include <linux/pgsize_migration(_inline)?\.h>|define VMA_PAD_START' fs/proc/task_mmu.c; then
          sed -i '1a #ifndef VMA_PAD_START\n#define VMA_PAD_START(vma) ((vma)->vm_end)\n#endif' fs/proc/task_mmu.c
          echo "Added VMA_PAD_START fallback"
        fi
        if grep -q '__fold_filemap_fixup_entry' fs/proc/task_mmu.c && ! grep -q '#include <linux/page_size_compat.h>' fs/proc/task_mmu.c; then
          sed -i '/#include <linux\/pkeys.h>/a #include <linux/page_size_compat.h>' fs/proc/task_mmu.c
          echo "Added page_size_compat.h include"
        fi
       
   - name: fix with_policy static on 6.6+ (port from GKI)
     shell: bash
     run: |
      if [ "$(printf '%s\n' "6.6" "$KERNEL_VER" | sort -V | head -n1)" = "6.6" ]; then
        echo "[*] KVER $KERNEL_VER >= 6.6, stripping static from with_policy helpers"
        for f in $(find "$COMMON" -name selinux_hide.c 2>/dev/null); do
          if grep -q "^static int security_context_to_sid_with_policy" "$f"; then
            echo "[*] Stripping static from $f helpers"
            sed -i 's/^static int security_context_to_sid_with_policy/int security_context_to_sid_with_policy/g' "$f"
            sed -i 's/^static int security_sid_to_context_with_policy/int security_sid_to_context_with_policy/g' "$f"
            sed -i 's/^static void security_compute_av_user_with_policy/void security_compute_av_user_with_policy/g' "$f"
            echo "[+] Stripped static from $f"
          fi
        done
      else
        echo "[-] KVER $KERNEL_VER < 6.6, skipping"
      fi

   - name: add ksu-susfs to config
     shell: bash
     run: |
      "$COMMON/scripts/config" --file "$GKI_DEFCONFIG" \
        --enable CONFIG_KSU_SUSFS \
        --enable CONFIG_KSU_SUSFS_SUS_PATH \
        --enable CONFIG_KSU_SUSFS_SUS_MOUNT \
        --enable CONFIG_KSU_SUSFS_SUS_KSTAT \
        --enable CONFIG_KSU_SUSFS_SPOOF_UNAME \
        --enable CONFIG_KSU_SUSFS_ENABLE_LOG \
        --enable CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS \
        --enable CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG \
        --enable CONFIG_KSU_SUSFS_SUS_MAP \
        --enable CONFIG_KSU_SUSFS_OPEN_REDIRECT