Optimize & fix numerous detections - #282
Open
MhmRdd wants to merge 6 commits into
Open
Conversation
MhmRdd
force-pushed
the
fix/sucompat-timing-sidechannel
branch
from
July 22, 2026 21:46
ca04ba8 to
48e90ae
Compare
get_kstorage walked a per-group linked list, so every su check on the hot path was O(N) in the number of allowed uids. Replace each group with a fixed bucket array hashed on did, making lookup, update and remove O(1) on average. Traverse with the _rcu iterators to match the _rcu mutators, fix on_each_kstorage_elem returning 0 through a shadowed rc, and free the new entry on the memdup_user error path.
The faccessat and newfstatat table hooks add a fixed cost only to those syscalls, so userspace can detect them by averaging cntvct_el0 timed samples against an unhooked path syscall. Hook the shared getname_flags path that faccessat, newfstatat, statx, openat and execve all reach, so every path syscall carries the same cost. The su path is redirected in place on the already-copied kernel name, so the callback reads no user memory and faults no page.
The trampoline entry reached the replace address with a RET, but the entry is a call target, not a return edge, so RET desyncs the return address stack predictor and mispredicts on every hooked call. Use branch_absolute so the entry stays a normal branch.
MhmRdd
force-pushed
the
fix/sucompat-timing-sidechannel
branch
from
July 22, 2026 22:01
48e90ae to
8e06e80
Compare
MhmRdd
force-pushed
the
fix/sucompat-timing-sidechannel
branch
from
July 22, 2026 22:37
1b4a47f to
b322eef
Compare
The in-place redirect only fired when sh_path fit within the resolved su path buffer, so a shorter configured su path silently failed to redirect. Reallocate through getname_kernel and hand the new filename back via putname, staying kernel-side so no user stack buffer is written. getname_kernel and putname are a matched alloc/free pair on every supported version, so this works across 3.18 - 6.6; log when the su path still cannot be redirected.
MhmRdd
force-pushed
the
fix/sucompat-timing-sidechannel
branch
from
July 22, 2026 22:38
b322eef to
750abdb
Compare
before_openat kept copying the openat filename from userspace on every call even after its one-shot rc redirect was done, and before_execve copied the exec filename for every caller. Both let an unprivileged app detect the hook by timing and by the page it faults in. Return before the compat_strncpy_from_user: in before_openat once the redirect has run, and in before_execve for callers that are neither root nor the trusted manager. The locals are still zeroed and the auto su flag is still set first, so the after handlers and every boot-time trigger are unchanged.
before_openat only self-unhooks after a rc file matches. If no match ever happens the hook stays live into app runtime, where the replaced early-return is not taken and every openat is copied from userspace, letting an app detect it by timing and residency. Return for non-root callers. The rc files are opened by init as root, so the redirect still fires, while app openat calls no longer reach the user read.
MhmRdd
force-pushed
the
fix/sucompat-timing-sidechannel
branch
from
July 22, 2026 23:44
78882fa to
cd52cf0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.